--- parser3/src/main/pa_xml_io.C	2004/02/13 14:01:08	1.17
+++ parser3/src/main/pa_xml_io.C	2009/07/06 12:07:04	1.24
@@ -1,7 +1,7 @@
 /** @file
 	Parser: plugins to xml library, controlling i/o; implementation
 
-	Copyright (c) 2001-2004 ArtLebedev Group (http://www.artlebedev.com)
+	Copyright (c) 2001-2009 ArtLebedev Group (http://www.artlebedev.com)
 	Author: Alexandr Petrosian <paf@design.ru> (http://paf.design.ru)
 */
 
@@ -9,7 +9,7 @@
 
 #ifdef XML
 
-static const char * const IDENT="$Date: 2004/02/13 14:01:08 $";
+static const char * const IDENT="$Date: 2009/07/06 12:07:04 $";
 
 #include "libxslt/extensions.h"
 
@@ -85,6 +85,14 @@ struct MemoryStream {
 
 static void *
 xmlFileOpen_ReadIntoStream (const char* do_not_store_filename, bool adjust_path_to_root_from_document_root=false) {
+#ifdef PA_SAFE_MODE
+//copied from libxml/catalog.c
+#	define XML_XML_DEFAULT_CATALOG "file:///etc/xml/catalog"
+	// disable attempts to consult default catalog [usually, that file belongs to other user/group]
+	if(strcmp(do_not_store_filename, XML_XML_DEFAULT_CATALOG)==0)
+		return 0;
+#endif
+
 	Request& r=pa_thread_request();
 	char adjust_buf[MAX_STRING];	
 	if(adjust_path_to_root_from_document_root) {
@@ -97,19 +105,23 @@ xmlFileOpen_ReadIntoStream (const char*
 		strcat(adjust_buf, &do_not_store_filename[16]);
 		do_not_store_filename=adjust_buf;
 	} else
-		if(strstr(do_not_store_filename, "file://"))
-			do_not_store_filename+=7/*strlen("file://")*/; 
-		else if(*do_not_store_filename && do_not_store_filename[1]!=':' && strstr(do_not_store_filename, "://"))  {
-			pa_xmlStopMonitoringDependencies();
-			return 0; // plug out [do not handle other prefixes]
-		}
+		if(!strstr(do_not_store_filename, "http://"))
+			if(strstr(do_not_store_filename, "file://"))
+				do_not_store_filename+=7/*strlen("file://")*/; 
+			else if(*do_not_store_filename && do_not_store_filename[1]!=':' && strstr(do_not_store_filename, "://"))  {
+				pa_xmlStopMonitoringDependencies();
+				return 0; // plug out [do not handle other prefixes]
+			}
 
 	const char* can_store_filename=pa_strdup(do_not_store_filename);
 	add_dependency(can_store_filename);
 
 	const char *buf;
 	try {
-		buf=file_read_text(r.charsets, *new String(can_store_filename));
+		buf=file_load_text(r, *new String(can_store_filename), 
+							true/*fail_on_read_problem*/,
+							0/*params*/,
+							false/*don't transcode result because it must be fit with @encoding value!*/);
 	} catch(const Exception& e) {
 		if(strcmp(e.type(), "file.missing")==0)
 			return 0; // let the library try that and report an error properly
@@ -189,7 +201,7 @@ xmlFileOpenMethod (const char* afilename
 			Request::Execute_nonvirtual_method_result body=
 				r.execute_nonvirtual_method(r.main_class, *method, vparam, true);
 			if(body.string) {
-				buf=body.string->cstr(String::L_UNSPECIFIED);
+				buf=body.string->untaint_cstr(String::L_AS_IS);
 			} else
 				throw Exception(0,
 					new String(afilename),