Merge branch 'MAINT_3_3_10' into QA_3_3

Documentation.html

@@ -81,6 +81,12 @@ vim: expandtab ts=4 sw=4 sts=4 tw=78
                 </li>
                 <li>To support upload progress bars, see <a href="#faq2_9">
                     <abbr title="Frequently Asked Questions">FAQ</abbr> 2.9</a>.</li>
+                <li>To support BLOB streaming, see PHP and MySQL requirements
+                in <a href="#faq6_25">
+                    <abbr title="Frequently Asked Questions">FAQ</abbr> 6.25</a>.</li>
+                <li>To support XML and Open Document Spreadsheet importing,
+                you need PHP 5.2.17 or newer and the 
+                <a href="http://www.php.net/libxml"><tt>libxml</tt></a> extension.</li>
         </ul>
     </li>
     <li><b>MySQL</b> 5.0 or newer (<a href="#faq1_17">details</a>);</li>

db_datadict.php

@@ -70,7 +70,7 @@ while ($row = PMA_DBI_fetch_assoc($rowset)) {
         echo '<div>' . "\n";
     }
 
-    echo '<h2>' . $table . '</h2>' . "\n";
+    echo '<h2>' . htmlspecialchars($table) . '</h2>' . "\n";
 
     /**
      * Gets table informations

libraries/import/ods.php

@@ -13,6 +13,13 @@ if (! defined('PHPMYADMIN')) {
     exit;
 }
 
+/**
+ * We need way to disable external XML entities processing.
+ */
+if (!function_exists('libxml_disable_entity_loader')) {
+    return;
+}
+
 /**
  * The possible scopes for $plugin_param are: 'table', 'database', and 'server'
  */
@@ -61,6 +68,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) {
 
 unset($data);
 
+/**
+ * Disable loading of external XML entities.
+ */
+libxml_disable_entity_loader();
+
 /**
  * Load the XML string
  *

libraries/import/xml.php

@@ -12,6 +12,13 @@ if (! defined('PHPMYADMIN')) {
     exit;
 }
 
+/**
+ * We need way to disable external XML entities processing.
+ */
+if (!function_exists('libxml_disable_entity_loader')) {
+    return;
+}
+
 /**
  * The possible scopes for $plugin_param are: 'table', 'database', and 'server'
  */
@@ -56,6 +63,11 @@ while (! ($finished && $i >= $len) && ! $error && ! $timeout_passed) {
 
 unset($data);
 
+/**
+ * Disable loading of external XML entities.
+ */
+libxml_disable_entity_loader();
+
 /**
  * Load the XML string
  *