gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 23042: Only include GET params in return URL for Shibboleth 

The shibboleth return target included POST parameters in the URL string,
this meant that a failed local login POST would include the username and
password used in the attemtped login in plaintext in the redirect URL
that is appended to the shibboleth login URL.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This commit is contained in:
Martin Renvoize 2019-06-13 17:02:33 +01:00
parent d93f17bfaa
commit 4e02adb5df
No known key found for this signature in database
GPG Key ID: 422B469130441A0F
1 changed files with 26 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
C4/Auth_with_shibboleth.pm
View File

@ -54,18 +54,17 @@ sub shib_ok {
sub logout_shib {
my ($query) = @_;
my $uri = _get_uri();
print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" );
my $return = _get_return($query);
print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$return" );
}
# Returns Shibboleth login URL with callback to the requesting URL
sub login_shib_url {
my ($query) = @_;
my $param = _get_uri() . get_script_name();
if ( $query->query_string() ) {
$param = $param . '?' . $query->query_string();
}
my $uri = _get_uri() . "/Shibboleth.sso/Login?target=$param";
my $target = _get_return($query);
my $uri = _get_uri() . "/Shibboleth.sso/Login?target=" . $target;
return $uri;
}
@ -194,6 +193,27 @@ sub _get_uri {
return $return;
}
sub _get_return {
my ($query) = @_;
my $uri_base_part = _get_uri() . get_script_name();
my $uri_params_part = '';
foreach my $param ( $query->url_param() ) {
# url_param() always returns parameters that were deleted by delete()
# This additional check ensure that parameter was not deleted.
my $uriPiece = $query->param($param);
if ($uriPiece) {
$uri_params_part .= '&' if $uri_params_part;
$uri_params_part .= $param . '=';
$uri_params_part .= URI::Escape::uri_escape( $uriPiece );
}
}
$uri_base_part .= '%3F' if $uri_params_part;
return $uri_base_part . $uri_params_part;
}
sub _get_shib_config {
my $config = C4::Context->config('shibboleth');