set xml whitelist for php to file