Skip to content

Commit 0ba6f67

Browse files
pitbulkpitbulk
committed
Sanitize SAML settings input
1 parent 5c174df commit 0ba6f67

3 files changed

Lines changed: 42 additions & 36 deletions

File tree

‎onelogin-saml-sso/php/configuration.php‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -184,25 +184,25 @@ function onelogin_saml_configuration() {
184184

185185
function plugin_setting_string_onelogin_saml_idp_entityid() {
186186
echo '<input type="text" name="onelogin_saml_idp_entityid" id="onelogin_saml_idp_entityid"
187-
value= "'.get_option('onelogin_saml_idp_entityid').'" size="80">'.
187+
value= "'.esc_html(get_option('onelogin_saml_idp_entityid')).'" size="80">'.
188188
'<p class="description">'.__('Identifier of the IdP entity. ("Issuer URL")', 'onelogin-saml-sso').'</p>';
189189
}
190190

191191
function plugin_setting_string_onelogin_saml_idp_sso() {
192192
echo '<input type="text" name="onelogin_saml_idp_sso" id="onelogin_saml_idp_sso"
193-
value= "'.get_option('onelogin_saml_idp_sso').'" size="80">'.
193+
value= "'.esc_url(get_option('onelogin_saml_idp_sso')).'" size="80">'.
194194
'<p class="description">'.__('SSO endpoint info of the IdP. URL target of the IdP where the SP will send the Authentication Request. ("SAML 2.0 Endpoint (HTTP)")', 'onelogin-saml-sso').'</p>';
195195
}
196196

197197
function plugin_setting_string_onelogin_saml_idp_slo() {
198198
echo '<input type="text" name="onelogin_saml_idp_slo" id="onelogin_saml_idp_slo"
199-
value= "'.get_option('onelogin_saml_idp_slo').'" size="80">'.
199+
value= "'.esc_url(get_option('onelogin_saml_idp_slo')).'" size="80">'.
200200
'<p class="description">'.__('SLO endpoint info of the IdP. URL target of the IdP where the SP will send the SLO Request. ("SLO Endpoint (HTTP)")', 'onelogin-saml-sso').'</p>';
201201
}
202202

203203
function plugin_setting_string_onelogin_saml_idp_x509cert() {
204204
echo '<textarea name="onelogin_saml_idp_x509cert" id="onelogin_saml_idp_x509cert" style="width:600px; height:220px; font-size:12px; font-family:courier,arial,sans-serif;">';
205-
echo get_option('onelogin_saml_idp_x509cert');
205+
echo esc_textarea(get_option('onelogin_saml_idp_x509cert'));
206206
echo '</textarea>';
207207
echo '<p class="description">'.__('Public x509 certificate of the IdP. ("X.509 certificate")', 'onelogin-saml-sso');
208208
}
@@ -268,50 +268,50 @@ function plugin_setting_boolean_onelogin_saml_alternative_acs() {
268268

269269
function plugin_setting_string_onelogin_saml_attr_mapping_username() {
270270
echo '<input type="text" name="onelogin_saml_attr_mapping_username" id="onelogin_saml_attr_mapping_username"
271-
value= "'.get_option('onelogin_saml_attr_mapping_username').'" size="30">';
271+
value= "'.esc_html(get_option('onelogin_saml_attr_mapping_username')).'" size="30">';
272272
}
273273

274274
function plugin_setting_string_onelogin_saml_attr_mapping_mail() {
275275
echo '<input type="text" name="onelogin_saml_attr_mapping_mail" id="onelogin_saml_attr_mapping_mail"
276-
value= "'.get_option('onelogin_saml_attr_mapping_mail').'" size="30">';
276+
value= "'.esc_html(get_option('onelogin_saml_attr_mapping_mail')).'" size="30">';
277277
}
278278

279279
function plugin_setting_string_onelogin_saml_attr_mapping_firstname() {
280280
echo '<input type="text" name="onelogin_saml_attr_mapping_firstname" id="onelogin_saml_attr_mapping_firstname"
281-
value= "'.get_option('onelogin_saml_attr_mapping_firstname').'" size="30">';
281+
value= "'.esc_html(get_option('onelogin_saml_attr_mapping_firstname')).'" size="30">';
282282
}
283283

284284
function plugin_setting_string_onelogin_saml_attr_mapping_lastname() {
285285
echo '<input type="text" name="onelogin_saml_attr_mapping_lastname" id="onelogin_saml_attr_mapping_lastname"
286-
value= "'.get_option('onelogin_saml_attr_mapping_lastname').'" size="30">';
286+
value= "'.esc_html(get_option('onelogin_saml_attr_mapping_lastname')).'" size="30">';
287287
}
288288

289289
function plugin_setting_string_onelogin_saml_attr_mapping_role() {
290290
echo '<input type="text" name="onelogin_saml_attr_mapping_role" id="onelogin_saml_attr_mapping_role"
291-
value= "'.get_option('onelogin_saml_attr_mapping_role').'" size="30">'.
291+
value= "'.esc_html(get_option('onelogin_saml_attr_mapping_role')).'" size="30">'.
292292
'<p class="description">'.__("The attribute that contains the role of the user, For example 'memberOf'. If WordPress can't figure what role assign to the user, it will assign the default role defined at the general settings.", 'onelogin-saml-sso').'</p>';
293293
}
294294

295295
function plugin_setting_string_onelogin_saml_role_mapping($role_value) {
296296
echo '<input type="text" name="onelogin_saml_role_mapping_'.$role_value.'" id="onelogin_saml_role_mapping_'.$role_value.'"
297-
value= "'.get_option('onelogin_saml_role_mapping_'.$role_value).'" size="30">';
297+
value= "'.esc_html(get_option('onelogin_saml_role_mapping_'.$role_value)).'" size="30">';
298298
}
299299

300300
function plugin_setting_string_onelogin_saml_role_order($role_value) {
301301
echo '<input type="text" name="onelogin_saml_role_order_'.$role_value.'" id="onelogin_saml_role_order_'.$role_value.'"
302-
value= "'.get_option('onelogin_saml_role_order_'.$role_value).'" size="3">';
302+
value= "'.esc_html(get_option('onelogin_saml_role_order_'.$role_value)).'" size="3">';
303303
}
304304

305305
function plugin_setting_boolean_onelogin_saml_role_mapping_multivalued_in_one_attribute_value() {
306-
$value = get_option('onelogin_saml_role_mapping_multivalued_in_one_attribute_value');
306+
$value = esc_html(get_option('onelogin_saml_role_mapping_multivalued_in_one_attribute_value'));
307307
echo '<input type="checkbox" name="onelogin_saml_role_mapping_multivalued_in_one_attribute_value" id="onelogin_saml_role_mapping_multivalued_in_one_attribute_value"
308308
'.($value ? 'checked="checked"': '').'>
309309
<p class="description">'.__("Sometimes role values are provided in an unique attribute statement (instead multiple attribute statements). If that is the case, activate this and the plugin will try to split those values by ;<br>Use a regular expression pattern in order to extract complex data.", 'onelogin-saml-sso').'</p>';
310310
}
311311

312312
function plugin_setting_string_onelogin_saml_role_mapping_multivalued_pattern() {
313313
echo '<input type="text" name="onelogin_saml_role_mapping_multivalued_pattern" id="onelogin_saml_role_mapping_multivalued_pattern"
314-
value= "'.get_option('onelogin_saml_role_mapping_multivalued_pattern').'" size="70">
314+
value= "'.esc_html(get_option('onelogin_saml_role_mapping_multivalued_pattern')).'" size="70">
315315
<p class="description">'.__("Regular expression that extract roles from complex multivalued data (required to active the previous option).<br> E.g. If the SAMLResponse has a role attribute like: CN=admin;CN=superuser;CN=europe-admin; , use the regular expression <code>/CN=([A-Z0-9\s _-]*);/i</code> to retrieve the values. Or use <code>/CN=([^,;]*)/</code>", 'onelogin-saml-sso').'</p>';
316316
}
317317

@@ -352,19 +352,19 @@ function plugin_setting_boolean_onelogin_saml_customize_stay_in_wordpress_after_
352352

353353
function plugin_setting_string_onelogin_saml_customize_links_user_registration() {
354354
echo '<input type="text" name="onelogin_saml_customize_links_user_registration" id="onelogin_saml_customize_links_user_registration"
355-
value= "'.get_option('onelogin_saml_customize_links_user_registration').'" size="80">
355+
value= "'.esc_url(get_option('onelogin_saml_customize_links_user_registration')).'" size="80">
356356
<p class="description">'.__("Override the user registration link. ", 'onelogin-saml-sso').'</p>';
357357
}
358358

359359
function plugin_setting_string_onelogin_saml_customize_links_lost_password() {
360360
echo '<input type="text" name="onelogin_saml_customize_links_lost_password" id="onelogin_saml_customize_links_lost_password"
361-
value= "'.get_option('onelogin_saml_customize_links_lost_password').'" size="80">
361+
value= "'.esc_url(get_option('onelogin_saml_customize_links_lost_password')).'" size="80">
362362
<p class="description">'.__("Override the lost password link. (Prevent reset password must be deactivated or the SAML SSO will be used.)", 'onelogin-saml-sso').'</p>';
363363
}
364364

365365
function plugin_setting_string_onelogin_saml_customize_links_saml_login() {
366366
echo '<input type="text" name="onelogin_saml_customize_links_saml_login" id="onelogin_saml_customize_links_saml_login"
367-
value= "'.get_option('onelogin_saml_customize_links_saml_login').'" size="80">
367+
value= "'.esc_url(get_option('onelogin_saml_customize_links_saml_login')).'" size="80">
368368
<p class="description">'.__("If 'Keep Local login' enabled, this will be showed as message at the SAML link.", 'onelogin-saml-sso').'</p>';
369369
}
370370

@@ -385,7 +385,7 @@ function plugin_setting_boolean_onelogin_saml_advanced_settings_strict_mode() {
385385

386386
function plugin_setting_string_onelogin_saml_advanced_settings_sp_entity_id() {
387387
echo '<input type="text" name="onelogin_saml_advanced_settings_sp_entity_id" id="onelogin_saml_advanced_settings_sp_entity_id"
388-
value= "'.get_option('onelogin_saml_advanced_settings_sp_entity_id').'" size="80">'.
388+
value= "'.esc_html(get_option('onelogin_saml_advanced_settings_sp_entity_id')).'" size="80">'.
389389
'<p class="description">'.__("Set the Entity ID for the Service Provider. If not provided, 'php-saml' will be used.", 'onelogin-saml-sso').'</p>';
390390
}
391391

@@ -441,14 +441,14 @@ function plugin_setting_boolean_onelogin_saml_advanced_settings_want_assertion_e
441441

442442
function plugin_setting_string_onelogin_saml_advanced_settings_sp_x509cert() {
443443
echo '<textarea name="onelogin_saml_advanced_settings_sp_x509cert" id="onelogin_saml_advanced_settings_sp_x509cert" style="width:600px; height:220px; font-size:12px; font-family:courier,arial,sans-serif;">';
444-
echo get_option('onelogin_saml_advanced_settings_sp_x509cert');
444+
echo esc_textarea(get_option('onelogin_saml_advanced_settings_sp_x509cert'));
445445
echo '</textarea>';
446446
echo '<p class="description">'.__('Public x509 certificate of the SP. Leave this field empty if you are providing the cert by the sp.crt.', 'onelogin-saml-sso');
447447
}
448448

449449
function plugin_setting_string_onelogin_saml_advanced_settings_sp_privatekey() {
450450
echo '<textarea name="onelogin_saml_advanced_settings_sp_privatekey" id="onelogin_saml_advanced_settings_sp_privatekey" style="width:600px; height:220px; font-size:12px; font-family:courier,arial,sans-serif;">';
451-
echo get_option('onelogin_saml_advanced_settings_sp_privatekey');
451+
echo esc_textarea(get_option('onelogin_saml_advanced_settings_sp_privatekey'));
452452
echo '</textarea>';
453453
echo '<p class="description">'.__('Private Key of the SP. Leave this field empty if you are providing the private key by the sp.key.', 'onelogin-saml-sso');
454454
}

‎onelogin-saml-sso/php/functions.php‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
function saml_checker() {
1313
if (isset($_GET['saml_acs'])) {
1414
if (empty($_POST['SAMLResponse'])) {
15-
print_r("That ACS endpoint expects a SAMLResponse value sent using HTTP-POST binding. Nothing was found");
15+
echo "That ACS endpoint expects a SAMLResponse value sent using HTTP-POST binding. Nothing was found";
1616
exit();
1717
}
1818
saml_acs();
@@ -32,7 +32,7 @@ function saml_custom_login_footer() {
3232
$saml_login_message = "SAML Login";
3333
}
3434

35-
echo '<div style="font-size: 110%;padding:8px;background: #fff;text-align: center;"><a href="'.get_site_url().'/wp-login.php?saml_sso">'.$saml_login_message.'</a></div>';
35+
echo '<div style="font-size: 110%;padding:8px;background: #fff;text-align: center;"><a href="'.get_site_url().'/wp-login.php?saml_sso">'.esc_html($saml_login_message).'</a></div>';
3636
}
3737

3838
function saml_load_translations() {
@@ -137,8 +137,10 @@ function saml_acs() {
137137
$errors = $auth->getErrors();
138138
if (!empty($errors)) {
139139
echo '<br>'.__("There was at least one error processing the SAML Response").': ';
140-
echo implode("<br>", $errors);
141-
echo '<br>'.__("Contact the administrator");
140+
foreach($errors as $error) {
141+
echo esc_html($error).'<br>';
142+
}
143+
echo __("Contact the administrator");
142144
exit();
143145
}
144146

@@ -254,19 +256,21 @@ function saml_acs() {
254256
}
255257
} else if (get_option('onelogin_saml_autocreate')) {
256258
if (!validate_username($username)) {
257-
echo __("The username provided by the IdP"). ' "'. $username. '" '. __("is not valid and can't create the user at wordpress");
259+
echo __("The username provided by the IdP"). ' "'. esc_attr($username). '" '. __("is not valid and can't create the user at wordpress");
258260
exit();
259261
}
260262
$userdata['user_pass'] = wp_generate_password();
261263
$user_id = wp_insert_user($userdata);
262264
} else {
263-
echo __("User provided by the IdP "). ' "'. $matcherValue. '" '. __("does not exist in wordpress and auto-provisioning is disabled.");
265+
echo __("User provided by the IdP "). ' "'. esc_attr($matcherValue). '" '. __("does not exist in wordpress and auto-provisioning is disabled.");
264266
exit();
265267
}
266268

267269
if (is_a($user_id, 'WP_Error')) {
268-
$error = $user_id->get_error_messages();
269-
echo implode('<br>', $error);
270+
$errors = $user_id->get_error_messages();
271+
foreach($errors as $error) {
272+
echo esc_html($error).'<br>';
273+
}
270274
exit();
271275
} else if ($user_id) {
272276
wp_set_current_user($user_id);
@@ -324,7 +328,9 @@ function saml_sls() {
324328
exit();
325329
} else {
326330
echo __("SLS endpoint found an error.");
327-
echo implode("<br>", $errors);
331+
foreach($errors as $error) {
332+
echo esc_html($error).'<br>';
333+
}
328334
exit();
329335
}
330336
}
@@ -337,7 +343,7 @@ function saml_metadata() {
337343
$metadata = $samlSettings->getSPMetadata();
338344

339345
header('Content-Type: text/xml');
340-
echo $metadata;
346+
echo ent2ncr($metadata);
341347
exit();
342348
}
343349

@@ -358,7 +364,7 @@ function initialize_saml() {
358364
$auth = new Onelogin_Saml2_Auth($settings);
359365
} catch (Exception $e) {
360366
echo '<br>'.__("The Onelogin SSO/SAML plugin is not correctly configured.", 'onelogin-saml-sso').'<br>';
361-
print_r($e->getMessage());
367+
echo esc_html($e->getMessage());
362368
echo '<br>'.__("If you are the administrator", 'onelogin-saml-sso').', <a href="'.get_site_url().'/wp-login.php?normal">'.__("access using your wordpress credentials", 'onelogin-saml-sso').'</a> '.__("and fix the problem", 'onelogin-saml-sso');
363369
exit();
364370
}

‎onelogin-saml-sso/php/validate.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
echo '<br>'.__("SAML settings are", 'onelogin-saml-sso').' <strong>ok</strong>.<br>';
3636
} catch (Exception $e) {
3737
echo '<br>'.__("Found errors while validating SAML settings info.", 'onelogin-saml-sso');
38-
print_r($e->getMessage());
38+
echo esc_html($e->getMessage());
3939
echo '<br>';
4040
}
4141

@@ -54,7 +54,7 @@
5454
$fileSystemKeyExists = file_exists(plugin_dir_path(__FILE__).'certs/sp.key');
5555
$fileSystemCertExists = file_exists(plugin_dir_path(__FILE__).'certs/sp.crt');
5656
if ($fileSystemKeyExists) {
57-
$privatekey_url = plugins_url('php/certs/sp.key', dirname(__FILE__));
57+
$privatekey_url = plugins_url('php/certs/sp.key', __DIR__);
5858
echo '<br>'.__("There is a private key stored at the filesystem. Protect the 'certs' path. Nobody should be allowed to access:", 'onelogin-saml-sso').'<br>'.$privatekey_url.'<br>';
5959
}
6060

@@ -103,14 +103,14 @@
103103
}
104104
if ($account_matcher == 'email' && $field == 'onelogin_saml_attr_mapping_mail') {
105105
echo '<br>'.__("E-mail mapping is required in order to enable the SAML Single Sign On", 'onelogin-saml-sso').'<br>';
106-
}
106+
}
107107
$lacked_attr_mappings[] = $name;
108108
}
109109
}
110110

111111
if (!empty($lacked_attr_mappings)) {
112112
echo '<br>'.__("Notice that there are attributes without mapping:", 'onelogin-saml-sso').'<br>';
113-
print_r(implode('<br>', $lacked_attr_mappings).'</br>');
113+
echo implode('<br>', $lacked_attr_mappings).'</br>';
114114
}
115115

116116
$lacked_role_mappings = array();
@@ -128,12 +128,12 @@
128128

129129
if (!empty($lacked_role_mappings)) {
130130
echo '<br>'.__("Notice that there are roles without mapping:", 'onelogin-saml-sso').'<br>';
131-
print_r(implode('<br>', $lacked_role_mappings).'</br>');
131+
echo implode('<br>', $lacked_role_mappings).'</br>';
132132
}
133133

134134
if (!empty($lacked_role_orders)) {
135135
echo '<br>'.__("Notice that there are roles without ordering:", 'onelogin-saml-sso').'<br>';
136-
print_r(implode('<br>', $lacked_role_orders).'</br>');
136+
echo implode('<br>', $lacked_role_orders).'</br>';
137137
}
138138
?>
139139

0 commit comments

Comments
 (0)