SAM-2041: XXE Injection allows to access to server filesystem

git-svn-id: https://source.sakaiproject.org/svn/sam/trunk@118175 66ffb92e-73f9-0310-93c1-f5514f145a0a