diff options
| -rw-r--r-- | Auth/OpenID/Consumer.php | 38 | ||||
| -rw-r--r-- | Tests/Auth/OpenID/Consumer.php | 4 |
2 files changed, 13 insertions, 29 deletions
diff --git a/Auth/OpenID/Consumer.php b/Auth/OpenID/Consumer.php index 52fb100..546fe52 100644 --- a/Auth/OpenID/Consumer.php +++ b/Auth/OpenID/Consumer.php @@ -1144,37 +1144,19 @@ class Auth_OpenID_GenericConsumer { $to_match->claimed_id)); } - /** - * @access private + /* + * Extract the nonce from an OpenID 1 response. Return the nonce + * from the BARE_NS since we independently check the return_to + * arguments are the same as those in the response message. + * + * See the openid1_nonce_query_arg_name class variable + * + * @returns $nonce The nonce as a string or null */ function _idResGetNonceOpenID1($message, $endpoint) { - $return_to = $message->getArg(Auth_OpenID_OPENID1_NS, - 'return_to'); - if ($return_to === null) { - return null; - } - - $parsed_url = parse_url($return_to); - - if (!array_key_exists('query', $parsed_url)) { - return null; - } - - $query = $parsed_url['query']; - $pairs = Auth_OpenID::parse_str($query); - - if ($pairs === null) { - return null; - } - - foreach ($pairs as $k => $v) { - if ($k == $this->openid1_nonce_query_arg_name) { - return $v; - } - } - - return null; + return $message->getArg(Auth_OpenID_BARE_NS, + $this->openid1_nonce_query_arg_name); } /** diff --git a/Tests/Auth/OpenID/Consumer.php b/Tests/Auth/OpenID/Consumer.php index 1bfecb2..70312b6 100644 --- a/Tests/Auth/OpenID/Consumer.php +++ b/Tests/Auth/OpenID/Consumer.php @@ -615,10 +615,12 @@ class Tests_Auth_OpenID_Consumer_CheckNonceTest extends _TestIdRes { function test_openid1Success() { // use consumer-generated nonce + $nonce_value = Auth_OpenID_mkNonce(); $this->return_to = sprintf('http://rt.unittest/?nonce=%s', - Auth_OpenID_mkNonce()); + $nonce_value); $this->response = Auth_OpenID_Message::fromOpenIDArgs( array('return_to' => $this->return_to)); + $this->response->setArg(Auth_OpenID_BARE_NS, 'nonce', $nonce_value); $result = $this->consumer->_idResCheckNonce($this->response, $this->endpoint); $this->assertFalse(Auth_OpenID::isFailure($result)); |