8 files changed, 28 insertions, 9 deletions

diff --git a/OpenSim/Framework/PhysicsInertia.cs b/OpenSim/Framework/PhysicsInertia.cs
index 6e15791..8a0e43e 100644
--- a/OpenSim/Framework/PhysicsInertia.cs
+++ b/OpenSim/Framework/PhysicsInertia.cs
@@ -187,16 +187,18 @@ namespace OpenSim.Framework
             if (text == String.Empty)
                 return null;
 
-            UTF8Encoding enc = new UTF8Encoding();
-            MemoryStream ms = new MemoryStream(enc.GetBytes(text));
-            XmlTextReader xreader = new XmlTextReader(ms);
-
-            PhysicsInertiaData v = new PhysicsInertiaData();
             bool error;
+            PhysicsInertiaData v;
+            UTF8Encoding enc = new UTF8Encoding();
+            using(MemoryStream ms = new MemoryStream(enc.GetBytes(text)))
+                using(XmlTextReader xreader = new XmlTextReader(ms))
+                {
+                    xreader.DtdProcessing = DtdProcessing.Prohibit;
+                    xreader.XmlResolver = null;
 
-            v.FromXml2(xreader, out error);
-
-            xreader.Close();
+                    v = new PhysicsInertiaData();
+                    v.FromXml2(xreader, out error);
+                }
 
             if (error)
                 return null;
diff --git a/OpenSim/Framework/PrimitiveBaseShape.cs b/OpenSim/Framework/PrimitiveBaseShape.cs
index 5056c04..1dc8bc3 100644
--- a/OpenSim/Framework/PrimitiveBaseShape.cs
+++ b/OpenSim/Framework/PrimitiveBaseShape.cs
@@ -1595,6 +1595,9 @@ namespace OpenSim.Framework
                     {
                         using (XmlTextReader xtr = new XmlTextReader(sr))
                         {
+                            xtr.DtdProcessing = DtdProcessing.Prohibit;
+                            xtr.XmlResolver = null;
+
                             xtr.MoveToContent();
 
                             string type = xtr.GetAttribute("type");
diff --git a/OpenSim/Framework/Serialization/External/ExternalRepresentationUtils.cs b/OpenSim/Framework/Serialization/External/ExternalRepresentationUtils.cs
index d2ca049..da877a7 100644
--- a/OpenSim/Framework/Serialization/External/ExternalRepresentationUtils.cs
+++ b/OpenSim/Framework/Serialization/External/ExternalRepresentationUtils.cs
@@ -221,7 +221,7 @@ namespace OpenSim.Framework.Serialization.External
             using (StringWriter sw = new StringWriter())
             using (XmlTextWriter writer = new XmlTextWriter(sw))
             using (XmlTextReader wrappedReader = new XmlTextReader(xmlData, XmlNodeType.Element, null))
-            using (XmlReader reader = XmlReader.Create(wrappedReader, new XmlReaderSettings() { IgnoreWhitespace = true, ConformanceLevel = ConformanceLevel.Fragment }))
+            using (XmlReader reader = XmlReader.Create(wrappedReader, new XmlReaderSettings() { IgnoreWhitespace = true, ConformanceLevel = ConformanceLevel.Fragment, DtdProcessing = DtdProcessing.Prohibit, XmlResolver = null }))
             {
                 TransformXml(reader, writer, sceneName, homeURL, userService, scopeID);
 
diff --git a/OpenSim/Framework/Serialization/External/LandDataSerializer.cs b/OpenSim/Framework/Serialization/External/LandDataSerializer.cs
index e42d56f..d323f45 100644
--- a/OpenSim/Framework/Serialization/External/LandDataSerializer.cs
+++ b/OpenSim/Framework/Serialization/External/LandDataSerializer.cs
@@ -178,6 +178,8 @@ namespace OpenSim.Framework.Serialization.External
 
             using (XmlTextReader reader = new XmlTextReader(new StringReader(serializedLandData)))
             {
+                reader.DtdProcessing = DtdProcessing.Prohibit;
+                reader.XmlResolver = null;
                 reader.ReadStartElement("LandData");
 
                 ExternalRepresentationUtils.ExecuteReadProcessors<LandData>(landData, m_ldProcessors, reader);
diff --git a/OpenSim/Framework/Serialization/External/RegionSettingsSerializer.cs b/OpenSim/Framework/Serialization/External/RegionSettingsSerializer.cs
index 617c451..fb4f904 100644
--- a/OpenSim/Framework/Serialization/External/RegionSettingsSerializer.cs
+++ b/OpenSim/Framework/Serialization/External/RegionSettingsSerializer.cs
@@ -63,6 +63,8 @@ namespace OpenSim.Framework.Serialization.External
 
             StringReader sr = new StringReader(serializedSettings);
             XmlTextReader xtr = new XmlTextReader(sr);
+            xtr.DtdProcessing = DtdProcessing.Prohibit;
+            xtr.XmlResolver = null;
 
             xtr.ReadStartElement("RegionSettings");
 
diff --git a/OpenSim/Framework/Serialization/External/UserInventoryItemSerializer.cs b/OpenSim/Framework/Serialization/External/UserInventoryItemSerializer.cs
index 9b02553..3c51140 100644
--- a/OpenSim/Framework/Serialization/External/UserInventoryItemSerializer.cs
+++ b/OpenSim/Framework/Serialization/External/UserInventoryItemSerializer.cs
@@ -202,6 +202,9 @@ namespace OpenSim.Framework.Serialization.External
 
             using (XmlTextReader reader = new XmlTextReader(new StringReader(serialization)))
             {
+                reader.DtdProcessing = DtdProcessing.Prohibit;
+                reader.XmlResolver = null;
+
                 reader.ReadStartElement("InventoryItem");
 
                 ExternalRepresentationUtils.ExecuteReadProcessors<InventoryItemBase>(
diff --git a/OpenSim/Framework/Servers/HttpServer/RestDeserialiseHandler.cs b/OpenSim/Framework/Servers/HttpServer/RestDeserialiseHandler.cs
index bd55657..fbc51d5 100644
--- a/OpenSim/Framework/Servers/HttpServer/RestDeserialiseHandler.cs
+++ b/OpenSim/Framework/Servers/HttpServer/RestDeserialiseHandler.cs
@@ -54,6 +54,9 @@ namespace OpenSim.Framework.Servers.HttpServer
             TRequest deserial;
             using (XmlTextReader xmlReader = new XmlTextReader(request))
             {
+                xmlReader.DtdProcessing = DtdProcessing.Prohibit;
+                xmlReader.XmlResolver = null;
+
                 XmlSerializer deserializer = new XmlSerializer(typeof (TRequest));
                 deserial = (TRequest) deserializer.Deserialize(xmlReader);
             }
diff --git a/OpenSim/Framework/Servers/HttpServer/RestSessionService.cs b/OpenSim/Framework/Servers/HttpServer/RestSessionService.cs
index 68073c1..dc720dd 100644
--- a/OpenSim/Framework/Servers/HttpServer/RestSessionService.cs
+++ b/OpenSim/Framework/Servers/HttpServer/RestSessionService.cs
@@ -210,6 +210,8 @@ namespace OpenSim.Framework.Servers.HttpServer
             {
                 try
                 {
+                    xmlReader.DtdProcessing = DtdProcessing.Prohibit;
+                    xmlReader.XmlResolver = null;
                     XmlSerializer deserializer = new XmlSerializer(typeof(RestSessionObject<TRequest>));
                     deserial = (RestSessionObject<TRequest>)deserializer.Deserialize(xmlReader);
                 }
@@ -269,6 +271,8 @@ namespace OpenSim.Framework.Servers.HttpServer
             {
                 try
                 {
+                    xmlReader.DtdProcessing = DtdProcessing.Prohibit;
+                    xmlReader.XmlResolver = null;
                     XmlSerializer deserializer = new XmlSerializer(typeof(TRequest));
                     deserial = (TRequest)deserializer.Deserialize(xmlReader);
                 }