mahara-contributors team mailing list archive

[Mahara Bot <1047111@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://reviews.mahara.org/1790
Committed: http://gitorious.org/mahara/mahara/commit/353870b01a0ba0d6c94c8f7c4e30cabf5627d95f
Submitter: Melissa Draper (melissa@xxxxxxxxxxxxxxx)
Branch:    1.4_STABLE

commit 353870b01a0ba0d6c94c8f7c4e30cabf5627d95f
Author: Hugh Davenport <hugh@xxxxxxxxxxxxxxx>
Date:   Tue Oct 16 13:25:56 2012 +1300

    Fix Leap2A import from Moodle
    
    Related to bug #1047111
    
    That bug fixed the XXE attack by setting the following to true
     libxml_disable_entity_loader
    
    This caused issues with the leap2a importer used by mnet, which
    used the simplexml_load to load the xml which relies on file
    based remote entities. For this situation, a the following flag
    is used, which stops network based XXE attacks
     LIBXML_NONET
    
    Change-Id: I3d95ebc9c38374d339d66a80feaa39f5c15f1022
    Signed-off-by: Hugh Davenport <hugh@xxxxxxxxxxxxxxx>

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
https://bugs.launchpad.net/bugs/1047111

Title:
  XEE possible in mahara

Status in Mahara ePortfolio:
  Fix Committed
Status in Mahara 1.4 series:
  Fix Released
Status in Mahara 1.5 series:
  Fix Released

Bug description:
  There is a security issue with the default XML parser for PHP, where ENTITY fields are
  loaded and substituted in text parts. 

  This allows possible attackers to read from internal networks, or files readable by the
  web server user.

  This includes reading of the config.php file, which contains sensitive information such
  as the database password, and the password salt field.

  The fix for this was to include a call to libxml_disable_entity_loader(true) during the
  initialization of a page.

  More information can be found at the following:
   http://projects.webappsec.org/w/page/13247003/XML%20External%20Entities
   http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html

  Reported by Mike Haworth.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1047111/+subscriptions