Skip to content

Commit cef4e3a

Browse files
pitbulkpitbulk
committed
Update php-saml to 2.14.0
1 parent 0fd954e commit cef4e3a

10 files changed

Lines changed: 334 additions & 174 deletions

File tree

‎onelogin-saml-sso/php/lib/Saml2/Auth.php‎

Lines changed: 31 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -129,14 +129,16 @@ class OneLogin_Saml2_Auth
129129
* (SAMLResponse, LogoutResponse). If the SAMLResponse was
130130
* encrypted, by default tries to return the decrypted XML
131131
*
132-
* @var string
132+
* @var string|\DomDocument|null
133133
*/
134134
private $_lastResponse;
135135

136136
/**
137137
* Initializes the SP SAML instance.
138138
*
139139
* @param array|object|null $oldSettings Setting data (You can provide a OneLogin_Saml_Settings, the settings object of the Saml folder implementation)
140+
*
141+
* @throws OneLogin_Saml2_Error
140142
*/
141143
public function __construct($oldSettings = null)
142144
{
@@ -157,11 +159,12 @@ public function getSettings()
157159
* Set the strict mode active/disable
158160
*
159161
* @param bool $value Strict parameter
162+
*
160163
* @throws OneLogin_Saml2_Error
161164
*/
162165
public function setStrict($value)
163166
{
164-
if (! (is_bool($value))) {
167+
if (!is_bool($value)) {
165168
throw new OneLogin_Saml2_Error(
166169
'Invalid value passed to setStrict()',
167170
OneLogin_Saml2_Error::SETTINGS_INVALID_SYNTAX
@@ -177,12 +180,13 @@ public function setStrict($value)
177180
* @param string|null $requestId The ID of the AuthNRequest sent by this SP to the IdP
178181
*
179182
* @throws OneLogin_Saml2_Error
183+
* @throws OneLogin_Saml2_ValidationError
180184
*/
181185
public function processResponse($requestId = null)
182186
{
183187
$this->_errors = array();
184188
$this->_errorReason = null;
185-
if (isset($_POST) && isset($_POST['SAMLResponse'])) {
189+
if (isset($_POST['SAMLResponse'])) {
186190
// AuthnResponse -- HTTP_POST Binding
187191
$response = new OneLogin_Saml2_Response($this->_settings, $_POST['SAMLResponse']);
188192
$this->_lastResponse = $response->getXMLDocument();
@@ -215,21 +219,21 @@ public function processResponse($requestId = null)
215219
/**
216220
* Process the SAML Logout Response / Logout Request sent by the IdP.
217221
*
218-
* @param bool $keepLocalSession When false will destroy the local session, otherwise will keep it
219-
* @param string|null $requestId The ID of the LogoutRequest sent by this SP to the IdP
220-
* @param bool $retrieveParametersFromServer
221-
* @param callable $cbDeleteSession
222-
* @param bool $stay True if we want to stay (returns the url string) False to redirect
222+
* @param bool $keepLocalSession When false will destroy the local session, otherwise will keep it
223+
* @param string|null $requestId The ID of the LogoutRequest sent by this SP to the IdP
224+
* @param bool $retrieveParametersFromServer True if we want to use parameters from $_SERVER to validate the signature
225+
* @param callable $cbDeleteSession Callback to be executed to delete session
226+
* @param bool $stay True if we want to stay (returns the url string) False to redirect
223227
*
224-
* @return string|void
228+
* @return string|null
225229
*
226230
* @throws OneLogin_Saml2_Error
227231
*/
228232
public function processSLO($keepLocalSession = false, $requestId = null, $retrieveParametersFromServer = false, $cbDeleteSession = null, $stay = false)
229233
{
230234
$this->_errors = array();
231235
$this->_errorReason = null;
232-
if (isset($_GET) && isset($_GET['SAMLResponse'])) {
236+
if (isset($_GET['SAMLResponse'])) {
233237
$logoutResponse = new OneLogin_Saml2_LogoutResponse($this->_settings, $_GET['SAMLResponse']);
234238
$this->_lastResponse = $logoutResponse->getXML();
235239
if (!$logoutResponse->isValid($requestId, $retrieveParametersFromServer)) {
@@ -247,7 +251,7 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
247251
}
248252
}
249253
}
250-
} else if (isset($_GET) && isset($_GET['SAMLRequest'])) {
254+
} else if (isset($_GET['SAMLRequest'])) {
251255
$logoutRequest = new OneLogin_Saml2_LogoutRequest($this->_settings, $_GET['SAMLRequest']);
252256
$this->_lastRequest = $logoutRequest->getXML();
253257
if (!$logoutRequest->isValid($retrieveParametersFromServer)) {
@@ -296,10 +300,13 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
296300
* Redirects the user to the url past by parameter
297301
* or to the url that we defined in our SSO Request.
298302
*
299-
* @param string $url The target URL to redirect the user.
300-
* @param array $parameters Extra parameters to be passed as part of the url
301-
* @param bool $stay True if we want to stay (returns the url string) False to redirect
303+
* @param string $url The target URL to redirect the user.
304+
* @param array $parameters Extra parameters to be passed as part of the url
305+
* @param bool $stay True if we want to stay (returns the url string) False to redirect
306+
*
302307
* @return string|null
308+
*
309+
* @throws OneLogin_Saml2_Error
303310
*/
304311
public function redirectTo($url = '', $parameters = array(), $stay = false)
305312
{
@@ -386,7 +393,7 @@ public function getSessionIndex()
386393
/**
387394
* Returns the SessionNotOnOrAfter
388395
*
389-
* @return DateTime|null The SessionNotOnOrAfter of the assertion
396+
* @return int|null The SessionNotOnOrAfter of the assertion
390397
*/
391398
public function getSessionExpiration()
392399
{
@@ -452,14 +459,16 @@ public function getAttributeWithFriendlyName($friendlyName)
452459
/**
453460
* Initiates the SSO process.
454461
*
455-
* @param string|null $returnTo The target URL the user should be returned to after login.
456-
* @param array $parameters Extra parameters to be added to the GET
457-
* @param bool $forceAuthn When true the AuthNReuqest will set the ForceAuthn='true'
458-
* @param bool $isPassive When true the AuthNReuqest will set the Ispassive='true'
459-
* @param bool $stay True if we want to stay (returns the url string) False to redirect
460-
* @param bool $setNameIdPolicy When true the AuthNReuqest will set a nameIdPolicy element
462+
* @param string|null $returnTo The target URL the user should be returned to after login.
463+
* @param array $parameters Extra parameters to be added to the GET
464+
* @param bool $forceAuthn When true the AuthNRequest will set the ForceAuthn='true'
465+
* @param bool $isPassive When true the AuthNRequest will set the Ispassive='true'
466+
* @param bool $stay True if we want to stay (returns the url string) False to redirect
467+
* @param bool $setNameIdPolicy When true the AuthNRueqest will set a nameIdPolicy element
461468
*
462469
* @return string|null If $stay is True, it return a string with the SLO URL + LogoutRequest + parameters
470+
*
471+
* @throws OneLogin_Saml2_Error
463472
*/
464473
public function login($returnTo = null, $parameters = array(), $forceAuthn = false, $isPassive = false, $stay = false, $setNameIdPolicy = true)
465474
{
@@ -560,7 +569,7 @@ public function getSSOurl()
560569
/**
561570
* Gets the SLO url.
562571
*
563-
* @return string The url of the Single Logout Service
572+
* @return string|null The url of the Single Logout Service
564573
*/
565574
public function getSLOurl()
566575
{
@@ -591,7 +600,6 @@ public function getLastRequestID()
591600
*
592601
* @return string A base64 encoded signature
593602
*
594-
* @throws Exception
595603
* @throws OneLogin_Saml2_Error
596604
*/
597605
public function buildRequestSignature($samlRequest, $relayState, $signAlgorithm = XMLSecurityKey::RSA_SHA1)
@@ -634,7 +642,6 @@ public function buildRequestSignature($samlRequest, $relayState, $signAlgorithm
634642
*
635643
* @return string A base64 encoded signature
636644
*
637-
* @throws Exception
638645
* @throws OneLogin_Saml2_Error
639646
*/
640647
public function buildResponseSignature($samlResponse, $relayState, $signAlgorithm = XMLSecurityKey::RSA_SHA1)

‎onelogin-saml-sso/php/lib/Saml2/AuthnRequest.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,8 @@ public function __construct(OneLogin_Saml2_Settings $settings, $forceAuthn = fal
141141
* Returns deflated, base64 encoded, unsigned AuthnRequest.
142142
*
143143
* @param bool|null $deflate Whether or not we should 'gzdeflate' the request body before we return it.
144+
*
145+
* @return string
144146
*/
145147
public function getRequest($deflate = null)
146148
{

‎onelogin-saml-sso/php/lib/Saml2/IdPMetadataParser.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,8 @@ public static function parseFileXML($filepath, $entityId = null, $desiredNameIdF
8585
* @param string $desiredSLOBinding Parse specific binding SLO endpoint.
8686
*
8787
* @return array metadata info in php-saml settings format
88-
* @throws \Exception
88+
*
89+
* @throws Exception
8990
*/
9091
public static function parseXML($xml, $entityId = null, $desiredNameIdFormat = null, $desiredSSOBinding = OneLogin_Saml2_Constants::BINDING_HTTP_REDIRECT, $desiredSLOBinding = OneLogin_Saml2_Constants::BINDING_HTTP_REDIRECT)
9192
{

‎onelogin-saml-sso/php/lib/Saml2/LogoutRequest.php‎

Lines changed: 43 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,14 @@ class OneLogin_Saml2_LogoutRequest
3333
/**
3434
* Constructs the Logout Request object.
3535
*
36-
* @param OneLogin_Saml2_Settings $settings Settings
37-
* @param string|null $request A UUEncoded Logout Request.
38-
* @param string|null $nameId The NameID that will be set in the LogoutRequest.
39-
* @param string|null $sessionIndex The SessionIndex (taken from the SAML Response in the SSO process).
40-
* @param string|null $nameIdFormat The NameID Format will be set in the LogoutRequest.
41-
* @param string|null $nameIdNameQualifier The NameID NameQualifier will be set in the LogoutRequest.
36+
* @param OneLogin_Saml2_Settings $settings Settings
37+
* @param string|null $request A UUEncoded Logout Request.
38+
* @param string|null $nameId The NameID that will be set in the LogoutRequest.
39+
* @param string|null $sessionIndex The SessionIndex (taken from the SAML Response in the SSO process).
40+
* @param string|null $nameIdFormat The NameID Format will be set in the LogoutRequest.
41+
* @param string|null $nameIdNameQualifier The NameID NameQualifier will be set in the LogoutRequest.
42+
*
43+
* @throws OneLogin_Saml2_Error
4244
*/
4345
public function __construct(OneLogin_Saml2_Settings $settings, $request = null, $nameId = null, $sessionIndex = null, $nameIdFormat = null, $nameIdNameQualifier = null)
4446
{
@@ -150,6 +152,8 @@ public function getRequest($deflate = null)
150152
* @param string|DOMDocument $request Logout Request Message
151153
*
152154
* @return string ID
155+
*
156+
* @throws OneLogin_Saml2_Error
153157
*/
154158
public static function getID($request)
155159
{
@@ -158,6 +162,13 @@ public static function getID($request)
158162
} else {
159163
$dom = new DOMDocument();
160164
$dom = OneLogin_Saml2_Utils::loadXML($dom, $request);
165+
166+
if (false === $dom) {
167+
throw new OneLogin_Saml2_Error(
168+
"LogoutRequest could not be processed",
169+
OneLogin_Saml2_Error::SAML_LOGOUTREQUEST_INVALID
170+
);
171+
}
161172
}
162173

163174
$id = $dom->documentElement->getAttribute('ID');
@@ -168,11 +179,12 @@ public static function getID($request)
168179
* Gets the NameID Data of the the Logout Request.
169180
*
170181
* @param string|DOMDocument $request Logout Request Message
171-
* @param string|null $key The SP key
182+
* @param string|null $key The SP key
172183
*
173184
* @return array Name ID Data (Value, Format, NameQualifier, SPNameQualifier)
174185
*
175-
* @throws Exception
186+
* @throws OneLogin_Saml2_Error
187+
* @throws OneLogin_Saml2_ValidationError
176188
*/
177189
public static function getNameIdData($request, $key = null)
178190
{
@@ -230,9 +242,12 @@ public static function getNameIdData($request, $key = null)
230242
* Gets the NameID of the Logout Request.
231243
*
232244
* @param string|DOMDocument $request Logout Request Message
233-
* @param string|null $key The SP key
245+
* @param string|null $key The SP key
234246
*
235247
* @return string Name ID Value
248+
*
249+
* @throws OneLogin_Saml2_Error
250+
* @throws OneLogin_Saml2_ValidationError
236251
*/
237252
public static function getNameId($request, $key = null)
238253
{
@@ -246,6 +261,7 @@ public static function getNameId($request, $key = null)
246261
* @param string|DOMDocument $request Logout Request Message
247262
*
248263
* @return string|null $issuer The Issuer
264+
* @throws Exception
249265
*/
250266
public static function getIssuer($request)
251267
{
@@ -273,6 +289,8 @@ public static function getIssuer($request)
273289
* @param string|DOMDocument $request Logout Request Message
274290
*
275291
* @return array The SessionIndex value
292+
*
293+
* @throws Exception
276294
*/
277295
public static function getSessionIndexes($request)
278296
{
@@ -294,6 +312,8 @@ public static function getSessionIndexes($request)
294312
/**
295313
* Checks if the Logout Request recieved is valid.
296314
*
315+
* @param bool $retrieveParametersFromServer
316+
*
297317
* @return bool If the Logout Request is or not valid
298318
*/
299319
public function isValid($retrieveParametersFromServer = false)
@@ -335,34 +355,30 @@ public function isValid($retrieveParametersFromServer = false)
335355
// Check destination
336356
if ($dom->documentElement->hasAttribute('Destination')) {
337357
$destination = $dom->documentElement->getAttribute('Destination');
338-
if (!empty($destination)) {
339-
if (strpos($destination, $currentURL) === false) {
340-
throw new OneLogin_Saml2_ValidationError(
341-
"The LogoutRequest was received at $currentURL instead of $destination",
342-
OneLogin_Saml2_ValidationError::WRONG_DESTINATION
343-
);
344-
}
358+
if (!empty($destination) && strpos($destination, $currentURL) === false) {
359+
throw new OneLogin_Saml2_ValidationError(
360+
"The LogoutRequest was received at $currentURL instead of $destination",
361+
OneLogin_Saml2_ValidationError::WRONG_DESTINATION
362+
);
345363
}
346364
}
347365

348-
$nameId = $this->getNameId($dom, $this->_settings->getSPkey());
366+
$nameId = static::getNameId($dom, $this->_settings->getSPkey());
349367

350368
// Check issuer
351-
$issuer = $this->getIssuer($dom);
369+
$issuer = static::getIssuer($dom);
352370
if (!empty($issuer) && $issuer != $idPEntityId) {
353371
throw new OneLogin_Saml2_ValidationError(
354372
"Invalid issuer in the Logout Request",
355373
OneLogin_Saml2_ValidationError::WRONG_ISSUER
356374
);
357375
}
358376

359-
if ($security['wantMessagesSigned']) {
360-
if (!isset($_GET['Signature'])) {
361-
throw new OneLogin_Saml2_ValidationError(
362-
"The Message of the Logout Request is not signed and the SP require it",
363-
OneLogin_Saml2_ValidationError::NO_SIGNED_MESSAGE
364-
);
365-
}
377+
if ($security['wantMessagesSigned'] && !isset($_GET['Signature'])) {
378+
throw new OneLogin_Saml2_ValidationError(
379+
"The Message of the Logout Request is not signed and the SP require it",
380+
OneLogin_Saml2_ValidationError::NO_SIGNED_MESSAGE
381+
);
366382
}
367383
}
368384

@@ -387,7 +403,8 @@ public function isValid($retrieveParametersFromServer = false)
387403
}
388404
}
389405

390-
/* After execute a validation process, if fails this method returns the cause
406+
/**
407+
* After execute a validation process, if fails this method returns the cause
391408
*
392409
* @return string Cause
393410
*/

0 commit comments

Comments
 (0)