Fixed XXE vulnerability when importing a new blog

Author: 0xLanks

BlogEngine/BlogEngine.Core/Services/Syndication/BlogML/BlogReader.cs

@@ -53,13 +53,15 @@ public string XmlData
         /// <summary>
         ///     Gets an XmlReader that converts BlogML data saved as string into XML stream
         /// </summary>
-        private XmlTextReader XmlReader
+        private XmlReader XmlReader
         {
             get
             {
                 var byteArray = Encoding.UTF8.GetBytes(this.xmlData);
                 var stream = new MemoryStream(byteArray);
-                return new XmlTextReader(stream);
+                XmlReaderSettings settings = new XmlReaderSettings();
+                settings.XmlResolver = null;
+                return XmlReader.Create(stream, settings);
             }
         }