diff --git a/classes/context/Context.class.php b/classes/context/Context.class.php
index 95b5b8776..ef96466d0 100644
--- a/classes/context/Context.class.php
+++ b/classes/context/Context.class.php
@@ -1120,6 +1120,14 @@ class Context
self::$_instance->security_check = 'DENY ALL';
self::$_instance->security_check_detail = 'ERR_UNSAFE_ENV';
}
+
+ if (PHP_VERSION_ID < 80000)
+ {
+ libxml_disable_entity_loader(true);
+ }
+ libxml_set_external_entity_loader(function($a, $b, $c) {
+ return null;
+ });
}
/**
@@ -1261,10 +1269,6 @@ class Context
$GLOBALS['HTTP_RAW_POST_DATA'] = '';
return;
}
- if (PHP_VERSION_ID < 80000)
- {
- libxml_disable_entity_loader(true);
- }
$params = Rhymix\Framework\Parsers\XMLRPCParser::parse($GLOBALS['HTTP_RAW_POST_DATA']) ?: [];
}
elseif($request_method === 'JSON')
@@ -1339,7 +1343,7 @@ class Context
unset($_FILES[$key]);
continue;
}
- $val['name'] = str_replace('&', '&', escape($val['name'], false));
+ $val['name'] = Rhymix\Framework\Filters\FilenameFilter::clean($val['name']);
self::set($key, $val, true);
self::set('is_uploaded', true);
self::$_instance->is_uploaded = true;
@@ -1365,7 +1369,7 @@ class Context
break;
}
$file = array();
- $file['name'] = str_replace('&', '&', escape($val['name'][$i], false));
+ $file['name'] = Rhymix\Framework\Filters\FilenameFilter::clean($val['name'][$i]);
$file['type'] = $val['type'][$i];
$file['tmp_name'] = $val['tmp_name'][$i];
$file['error'] = $val['error'][$i];
diff --git a/classes/display/DisplayHandler.class.php b/classes/display/DisplayHandler.class.php
index 1d2fd8194..be853571b 100644
--- a/classes/display/DisplayHandler.class.php
+++ b/classes/display/DisplayHandler.class.php
@@ -257,7 +257,7 @@ class DisplayHandler extends Handler
case 'HTML':
$json_options = defined('JSON_PRETTY_PRINT') ? (JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE) : 0;
$panel_script = sprintf('', RX_BASEURL, 'common/js/debug.js', filemtime(RX_BASEDIR . 'common/js/debug.js'));
- $panel_script .= "\n";
+ $panel_script .= "\n";
$body_end_position = strrpos($output, '