diff options
| author | Jaime Perez Crespo <jaime.perez@uninett.no> | 2015-10-21 12:07:40 +0200 |
|---|---|---|
| committer | Jaime Perez Crespo <jaime.perez@uninett.no> | 2015-10-21 12:07:40 +0200 |
| commit | 7be5684e41effce46df3cf48dbfdefb3b876d749 (patch) | |
| tree | 905659598a604912d6d262b5dfeff1e92ea41619 /lib/SimpleSAML | |
| parent | 6500ca1c34dfaab6a44f5507f69c8748c5d21ed5 (diff) | |
| download | simplesamlphp-7be5684e41effce46df3cf48dbfdefb3b876d749.zip simplesamlphp-7be5684e41effce46df3cf48dbfdefb3b876d749.tar.gz simplesamlphp-7be5684e41effce46df3cf48dbfdefb3b876d749.tar.bz2 | |
Make SimpleSAMLphp resilient to open redirections by default.
Diffstat (limited to 'lib/SimpleSAML')
| -rw-r--r-- | lib/SimpleSAML/Utils/HTTP.php | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/lib/SimpleSAML/Utils/HTTP.php b/lib/SimpleSAML/Utils/HTTP.php index 8b0caf3..fd6437e 100644 --- a/lib/SimpleSAML/Utils/HTTP.php +++ b/lib/SimpleSAML/Utils/HTTP.php @@ -313,15 +313,11 @@ class HTTP // get the white list of domains if ($trustedSites === null) { - $trustedSites = \SimpleSAML_Configuration::getInstance()->getArray('trusted.url.domains', null); - // TODO: remove this before 2.0 - if ($trustedSites === null) { - $trustedSites = \SimpleSAML_Configuration::getInstance()->getArray('redirect.trustedsites', null); - } + $trustedSites = \SimpleSAML_Configuration::getInstance()->getValue('trusted.url.domains', array()); } // validates the URL's host is among those allowed - if ($trustedSites !== null) { + if (is_array($trustedSites)) { assert(is_array($trustedSites)); preg_match('@^https?://([^/]+)@i', $url, $matches); $hostname = $matches[1]; |