svn: /php/php-src/ branches/PHP_5_4/NEWS branches/PHP_5_4/UPGRADING branches/PHP_5_4/ext/xsl/php_xsl.c branches/PHP_5_4/ext/xsl/php_xsl.h
branches/PHP_5_4/ext/xsl/xsl_fe.h branches/PHP_5_4/ext/xsl/xsltprocessor.c trunk/ext/xsl/xsltprocessor.c
| From: | Christian Stocker | Date: | Tue, 12 Jul 2011 04:58:38 +0000 |
| Subject: | svn: /php/php-src/ branches/PHP_5_4/NEWS branches/PHP_5_4/UPGRADING branches/PHP_5_4/ext/xsl/php_xsl.c branches/PHP_5_4/ext/xsl/php_xsl.h branches/PHP_5_4/ext/xsl/xsl_fe.h branches/PHP_5_4/ext/xsl/xsltprocessor.c trunk/ext/xsl/xsltprocessor.c |
||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-65468@lists.php.net to get a copy of this message | ||
chregu Tue, 12 Jul 2011 04:58:38 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=313160
Log:
Added XsltProcessor::setSecurityPrefs($options) and getSecurityPrefs()
to define forbidden operations within XSLT stylesheets, default is not to
enable any write operations from XSLT anymore. Bug #54446
(second iteration of the code for trunk, first commit for 5.4 branch)
Bug: https://bugs.php.net/54446 (To be documented)
Arbitrary file creation via libxslt 'output' extension
Changed paths:
U php/php-src/branches/PHP_5_4/NEWS
U php/php-src/branches/PHP_5_4/UPGRADING
U php/php-src/branches/PHP_5_4/ext/xsl/php_xsl.c
U php/php-src/branches/PHP_5_4/ext/xsl/php_xsl.h
U php/php-src/branches/PHP_5_4/ext/xsl/xsl_fe.h
U php/php-src/branches/PHP_5_4/ext/xsl/xsltprocessor.c
U php/php-src/trunk/ext/xsl/xsltprocessor.c
Attachment: [text/x-diff] svn-diffs-313160.txt
Attachment: [text/x-diff] svn-diffs-313160.txt