SAM-2041: XXE Injection allows to access to server filesystem

git-svn-id: https://source.sakaiproject.org/svn/sam/branches/samigo-2.9.x@118339 66ffb92e-73f9-0310-93c1-f5514f145a0a