@@ -, +, @@
expand_entities_unsafe
---
Koha/XSLT/Security.pm | 2 +-
t/db_dependent/Koha/XSLT/Security.t | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/Koha/XSLT/Security.pm
+++ a/Koha/XSLT/Security.pm
@@ -144,7 +144,7 @@ sub set_parser_options {
my ($self, $parser) = @_;
my $conf = $self->{_options};
- if( $conf->{expand_entities} ) {
+ if( $conf->{expand_entities_unsafe} ) { # NOT recommended
_set_option($parser, 'expand_entities', 1);
} else {
# If not explicitly set, we should disable expanding for security
--- a/t/db_dependent/Koha/XSLT/Security.t
+++ a/t/db_dependent/Koha/XSLT/Security.t
@@ -25,7 +25,7 @@ use Test::Warn;
use Koha::XSLT::Base;
use t::lib::Mocks;
-t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 1 } );
+t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 1 } );
my $engine=Koha::XSLT::Base->new;
my $secret_file = mytempfile('Big secret');
@@ -44,7 +44,7 @@ my $xslt_file = mytempfile($xslt);
my $output= $engine->transform( "", $xslt_file );
like($output, qr/Big secret/, 'external entity got through');
-t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities => 0 } );
+t::lib::Mocks::mock_config( 'koha_xslt_security', { expand_entities_unsafe => 0 } );
$engine=Koha::XSLT::Base->new;
$output= $engine->transform( "", $xslt_file );
unlike($output, qr/Big secret/, 'external entity did not get through');
--