diff --git a/Documentation/PHPExcel User Documentation - Reading Spreadsheet Files.doc b/Documentation/PHPExcel User Documentation - Reading Spreadsheet Files.doc index c1dc2b55..a85a3168 100644 Binary files a/Documentation/PHPExcel User Documentation - Reading Spreadsheet Files.doc and b/Documentation/PHPExcel User Documentation - Reading Spreadsheet Files.doc differ diff --git a/Documentation/markdown/ReadingSpreadsheetFiles/02-Security.md b/Documentation/markdown/ReadingSpreadsheetFiles/02-Security.md index 5c8cf990..12da958f 100644 --- a/Documentation/markdown/ReadingSpreadsheetFiles/02-Security.md +++ b/Documentation/markdown/ReadingSpreadsheetFiles/02-Security.md @@ -10,15 +10,4 @@ XML-based formats such as OfficeOpen XML, Excel2003 XML, OASIS and Gnumeric are - Command Execution (depending on the installed PHP wrappers) -To prevent this, PHPExcel sets the LIBXML_DTDLOAD and LIBXML_DTDATTR settings for the XML Readers by default. - - -Should you ever need to change these settings, the following method is available through the PHPExcel_Settings: - -``` -PHPExcel_Settings::setLibXmlLoaderOptions(); -``` - -Allowing you to specify the XML loader settings that those that you want to use instead. - - > While PHPExcel protects you with its default settings, if you do change these settings yourself, then you're responsible for ensuring that your XML-based formats aren't open to XXE injection. +To prevent this, PHPExcel sets `libxml_disable_entity_loader` to `true` for the XML-based Readers by default. \ No newline at end of file