Patch files for 1.2 and 1.3 versions

[Mike]

See the posts above - it explains what the issue is. You can workaround it like XF.

 

[Chris D]

Question, Mike, what should add-on authors do to ensure addons aren't vulnerable, if they use XML files?

Liam

Just use the same helpers that XenForo uses for processing all XML files.

Previously a new vanilla SimpleXML object used to be instantiated. Now, that is created through a helper which wraps around that and a Zend security function.