Fixed OpenIdAjaxTextBox to skip requests that are canceled by a LoggingIn event handler.

1 files changed, 9 insertions, 5 deletions

diff --git a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdAjaxTextBox.cs b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdAjaxTextBox.cs
index bb3e49b..f4f7ca7 100644
--- a/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdAjaxTextBox.cs
+++ b/src/DotNetOpenAuth/OpenId/RelyingParty/OpenIdAjaxTextBox.cs
@@ -906,12 +906,11 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 			StringBuilder discoveryResultBuilder = new StringBuilder();
 			discoveryResultBuilder.Append("{");
 			try {
-				List<IAuthenticationRequest> requests = this.CreateRequests(userSuppliedIdentifier, true);
+				List<IAuthenticationRequest> requests = this.CreateRequests(userSuppliedIdentifier, true).Where(req => this.OnLoggingIn(req)).ToList();
 				if (requests.Count > 0) {
 					discoveryResultBuilder.AppendFormat("claimedIdentifier: {0},", MessagingUtilities.GetSafeJavascriptValue(requests[0].ClaimedIdentifier));
 					discoveryResultBuilder.Append("requests: [");
 					foreach (IAuthenticationRequest request in requests) {
-						this.OnLoggingIn(request);
 						discoveryResultBuilder.Append("{");
 						discoveryResultBuilder.AppendFormat("endpoint: {0},", MessagingUtilities.GetSafeJavascriptValue(request.Provider.Uri.AbsoluteUri));
 						request.Mode = AuthenticationRequestMode.Immediate;
@@ -1087,11 +1086,16 @@ namespace DotNetOpenAuth.OpenId.RelyingParty {
 		/// Fires the <see cref="LoggingIn"/> event.
 		/// </summary>
 		/// <param name="request">The request.</param>
-		private void OnLoggingIn(IAuthenticationRequest request) {
+		/// <returns><c>true</c> if the login should proceed; <c>false</c> otherwise.</returns>
+		private bool OnLoggingIn(IAuthenticationRequest request) {
 			var loggingIn = this.LoggingIn;
 			if (loggingIn != null) {
-				loggingIn(this, new OpenIdEventArgs(request));
+				var args = new OpenIdEventArgs(request);
+				loggingIn(this, args);
+				return !args.Cancel;
 			}
+
+			return true;
 		}
 
 		/// <summary>
@@ -1231,7 +1235,7 @@ if (!openidbox.dnoi_internal.onSubmit()) {{ return false; }}
 		/// requests should be initialized for use in invisible iframes for background authentication.</param>
 		/// <returns>The list of authentication requests, any one of which may be 
 		/// used to determine the user's control of the <see cref="IAuthenticationRequest.ClaimedIdentifier"/>.</returns>
-		private List<IAuthenticationRequest> CreateRequests(string userSuppliedIdentifier, bool immediate) {
+		private IEnumerable<IAuthenticationRequest> CreateRequests(string userSuppliedIdentifier, bool immediate) {
 			var requests = new List<IAuthenticationRequest>();
 
 			// Approximate the returnTo (either based on the customize property or the page URL)