Bug #64938 [Com]: libxml_disable_entity_loader setting is shared between threads

Edit report at https://bugs.php.net/bug.php?id=64938&edit=1

 ID:                 64938
 Comment by:         robert dot egginton at c3media dot co dot uk
 Reported by:        Sjon at hortensius dot net
 Summary:            libxml_disable_entity_loader setting is shared
                     between threads
 Status:             Closed
 Type:               Bug
 Package:            *XML functions
 Operating System:   Archlinux
 PHP Version:        5.4.15
 Block user comment: N
 Private report:     N

 New Comment:

For mark at netalico dot com:

The workaround for something like Magento (not required for CE>1.9.2.0 when a workaround was added) is to add this line to the start of your script:

if (function_exists('libxml_disable_entity_loader')) {
    libxml_disable_entity_loader(false);
}


Previous Comments:
------------------------------------------------------------------------
[2015-12-22 12:26:24] robert dot egginton at c3media dot co dot uk

I'm using 5.5.30 and php-fpm and can reproduce the problem by using the inverse of the script:

Test script:
---------------
<?php

die(var_dump(libxml_disable_entity_loader(true)));

---------------

The default seems to be false for me. After a few hits the results all end up true, so somehow this value is persisting within php-fpm children.

------------------------------------------------------------------------
[2015-11-25 08:52:53] [email protected]

Also fixed in 5.5.22 (per the commits above).

------------------------------------------------------------------------
[2015-10-16 12:46:00] mark at netalico dot com

Any suggested workarounds for this issue? This bug is pretty critical because it can basically take down sites running something like Magento. It appears to only be fixed in PHP 5.6, which a lot of codebases aren't ready for yet.

------------------------------------------------------------------------
[2015-04-29 11:57:41] freitsabes at gmail dot com

Sorry, but I would like to ask for clarification:
For php-cgi I see the following behaviour:
1. I issue a request that has a call of libxml_disable_entity_loader()
2. A subsequent request to a different script that is NOT calling libxml_disable_entity_loader is affected by the first request because the setting is shared between subsequent requests on the same process.

Is this a bug or working as intended?

PHP 5.4.39 with libxml 2.9.2

------------------------------------------------------------------------
[2015-02-01 08:10:11] [email protected]

Automatic comment on behalf of [email protected]
Revision: http://git.php.net/?p=php-src.git;a=commit;h=c1eb87ab1a2e2df1868b70cd7b8016c6147092c5
Log: Fix bug #64938: libxml_disable_entity_loader setting is shared between threads

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=64938


--
Edit this bug report at https://bugs.php.net/bug.php?id=64938&edit=1