From 2185780beff4e845f6edfcabef2494ee494d99b3 Mon Sep 17 00:00:00 2001
From: FusionPBX <markjcrane@gmail.com>
Date: Mon, 23 Dec 2019 11:20:43 -0700
Subject: [PATCH] Update xml_cdr.php

---
 app/xml_cdr/resources/classes/xml_cdr.php | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/app/xml_cdr/resources/classes/xml_cdr.php b/app/xml_cdr/resources/classes/xml_cdr.php
index 2adae85fe1..cd6b1dd99d 100644
--- a/app/xml_cdr/resources/classes/xml_cdr.php
+++ b/app/xml_cdr/resources/classes/xml_cdr.php
@@ -254,9 +254,11 @@ if (!class_exists('xml_cdr')) {
 
 			//parse the xml to get the call detail record info
 				try {
-					//$this->log($xml_string);
-					$xml = simplexml_load_string($xml_string);
-					//$this->log("\nxml load done\n");
+					//disable xml entities
+					libxml_disable_entity_loader(true);
+
+					//load the string into an xml object
+					$xml = simplexml_load_string($xml_string, 'SimpleXMLElement', LIBXML_NOCDATA);
 				}
 				catch(Exception $e) {
 					echo $e->getMessage();
@@ -810,7 +812,11 @@ if (!class_exists('xml_cdr')) {
 
 							//parse the xml to get the call detail record info
 								try {
-									$conf_xml = simplexml_load_string($conf_xml_string);
+									//disable xml entities
+									libxml_disable_entity_loader(true);
+
+									//load the string into an xml object
+									$conf_xml = simplexml_load_string($conf_xml_string, 'SimpleXMLElement', LIBXML_NOCDATA);
 								}
 								catch(Exception $e) {
 									echo $e->getMessage();