diff options
| author | Johan B. C. Engelen <jbc.engelen@swissonline.ch> | 2012-12-05 22:39:22 +0000 |
|---|---|---|
| committer | Johan B. C. Engelen <j.b.c.engelen@alumnus.utwente.nl> | 2012-12-05 22:39:22 +0000 |
| commit | bc29141167ff3df4b92d85edae209d3fb9ffab93 (patch) | |
| tree | c3e35038a6a0a68677b0a63b6ba4f4f1721f3ba4 /src/xml | |
| parent | i18n. Improving windows's title internationalization (color mode wasn't corre... (diff) | |
| download | inkscape-bc29141167ff3df4b92d85edae209d3fb9ffab93.tar.gz inkscape-bc29141167ff3df4b92d85edae209d3fb9ffab93.zip | |
- fix security bug lp:1025185
- make network access optional for XML loading
Fixed bugs:
- https://launchpad.net/bugs/1025185
(bzr r11931)
Diffstat (limited to 'src/xml')
| -rw-r--r-- | src/xml/repr-io.cpp | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/src/xml/repr-io.cpp b/src/xml/repr-io.cpp index 29a5b4a78..1258617c7 100644 --- a/src/xml/repr-io.cpp +++ b/src/xml/repr-io.cpp @@ -297,12 +297,18 @@ Document *sp_repr_read_file (const gchar * filename, const gchar *default_ns) XmlSource src; if ( (src.setFile(filename) == 0) ) { + int parse_options = XML_PARSE_HUGE; // do not use XML_PARSE_NOENT ! see bug lp:1025185 + Inkscape::Preferences *prefs = Inkscape::Preferences::get(); + bool allowNetAccess = prefs->getBool("/options/externalresources/xml/allow_net_access", false); + if (!allowNetAccess) { + parse_options |= XML_PARSE_NONET; + } doc = xmlReadIO( XmlSource::readCb, XmlSource::closeCb, &src, localFilename, src.getEncoding(), - XML_PARSE_NOENT | XML_PARSE_HUGE); + parse_options); } } |