Skip to content

Commit c249257

Browse files
pitbulkpitbulk
committed
Update php-saml to 3.8.1
1 parent 7c1cbd6 commit c249257

14 files changed

Lines changed: 317 additions & 170 deletions

‎onelogin-saml-sso/php/lib/Saml2/Auth.php‎

Lines changed: 48 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,13 @@
22
/**
33
* This file is part of php-saml.
44
*
5-
* (c) OneLogin Inc
6-
*
75
* For the full copyright and license information, please view the LICENSE
86
* file that was distributed with this source code.
97
*
108
* @package OneLogin
11-
* @author OneLogin Inc <saml-info@onelogin.com>
12-
* @license MIT https://github.com/onelogin/php-saml/blob/master/LICENSE
13-
* @link https://github.com/onelogin/php-saml
9+
* @author Sixto Martin <sixto.martin.garcia@gmail.com>
10+
* @license MIT https://github.com/SAML-Toolkits/php-saml/blob/master/LICENSE
11+
* @link https://github.com/SAML-Toolkits/php-saml
1412
*/
1513

1614
namespace OneLogin\Saml2;
@@ -20,7 +18,7 @@
2018
use Exception;
2119

2220
/**
23-
* Main class of OneLogin's PHP Toolkit
21+
* Main class of SAML PHP Toolkit
2422
*/
2523
class Auth
2624
{
@@ -167,14 +165,15 @@ class Auth
167165
/**
168166
* Initializes the SP SAML instance.
169167
*
170-
* @param array|null $settings Setting data
168+
* @param array|null $settings Setting data
169+
* @param bool $spValidationOnly Validate or not the IdP data
171170
*
172171
* @throws Exception
173172
* @throws Error
174173
*/
175-
public function __construct(array $settings = null)
174+
public function __construct(array $settings = null, $spValidationOnly = false)
176175
{
177-
$this->_settings = new Settings($settings);
176+
$this->_settings = new Settings($settings, $spValidationOnly);
178177
}
179178

180179
/**
@@ -271,6 +270,7 @@ public function processResponse($requestId = null)
271270
* @param bool $stay True if we want to stay (returns the url string) False to redirect
272271
*
273272
* @return string|null
273+
* @phpstan-return ($stay is true ? string : never)
274274
*
275275
* @throws Error
276276
*/
@@ -279,7 +279,7 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
279279
$this->_errors = array();
280280
$this->_lastError = $this->_lastErrorException = null;
281281
if (isset($_GET['SAMLResponse'])) {
282-
$logoutResponse = new LogoutResponse($this->_settings, $_GET['SAMLResponse']);
282+
$logoutResponse = $this->buildLogoutResponse($this->_settings, $_GET['SAMLResponse']);
283283
$this->_lastResponse = $logoutResponse->getXML();
284284
if (!$logoutResponse->isValid($requestId, $retrieveParametersFromServer)) {
285285
$this->_errors[] = 'invalid_logout_response';
@@ -299,7 +299,7 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
299299
}
300300
}
301301
} else if (isset($_GET['SAMLRequest'])) {
302-
$logoutRequest = new LogoutRequest($this->_settings, $_GET['SAMLRequest']);
302+
$logoutRequest = $this->buildLogoutRequest($this->_settings, $_GET['SAMLRequest']);
303303
$this->_lastRequest = $logoutRequest->getXML();
304304
if (!$logoutRequest->isValid($retrieveParametersFromServer)) {
305305
$this->_errors[] = 'invalid_logout_request';
@@ -315,7 +315,7 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
315315
}
316316
$inResponseTo = $logoutRequest->id;
317317
$this->_lastMessageId = $logoutRequest->id;
318-
$responseBuilder = new LogoutResponse($this->_settings);
318+
$responseBuilder = $this->buildLogoutResponse($this->_settings);
319319
$responseBuilder->build($inResponseTo);
320320
$this->_lastResponse = $responseBuilder->getXML();
321321

@@ -353,6 +353,7 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
353353
* @param bool $stay True if we want to stay (returns the url string) False to redirect
354354
*
355355
* @return string|null
356+
* @phpstan-return ($stay is true ? string : never)
356357
*/
357358
public function redirectTo($url = '', array $parameters = array(), $stay = false)
358359
{
@@ -534,6 +535,7 @@ public function getAttributeWithFriendlyName($friendlyName)
534535
* @param string $nameIdValueReq Indicates to the IdP the subject that should be authenticated
535536
*
536537
* @return string|null If $stay is True, it return a string with the SLO URL + LogoutRequest + parameters
538+
* @phpstan-return ($stay is true ? string : never)
537539
*
538540
* @throws Error
539541
*/
@@ -574,6 +576,7 @@ public function login($returnTo = null, array $parameters = array(), $forceAuthn
574576
* @param string|null $nameIdNameQualifier The NameID NameQualifier will be set in the LogoutRequest.
575577
*
576578
* @return string|null If $stay is True, it return a string with the SLO URL + LogoutRequest + parameters
579+
* @phpstan-return ($stay is true ? string : never)
577580
*
578581
* @throws Error
579582
*/
@@ -594,7 +597,7 @@ public function logout($returnTo = null, array $parameters = array(), $nameId =
594597
$nameIdFormat = $this->_nameidFormat;
595598
}
596599

597-
$logoutRequest = new LogoutRequest($this->_settings, null, $nameId, $sessionIndex, $nameIdFormat, $nameIdNameQualifier, $nameIdSPNameQualifier);
600+
$logoutRequest = $this->buildLogoutRequest($this->_settings, null, $nameId, $sessionIndex, $nameIdFormat, $nameIdNameQualifier, $nameIdSPNameQualifier);
598601

599602
$this->_lastRequest = $logoutRequest->getXML();
600603
$this->_lastRequestID = $logoutRequest->id;
@@ -670,11 +673,42 @@ public function getLastRequestID()
670673
*
671674
* @return AuthnRequest The AuthnRequest object
672675
*/
673-
public function buildAuthnRequest($settings, $forceAuthn, $isPassive, $setNameIdPolicy, $nameIdValueReq = null)
676+
public function buildAuthnRequest(Settings $settings, $forceAuthn, $isPassive, $setNameIdPolicy, $nameIdValueReq = null)
674677
{
675678
return new AuthnRequest($settings, $forceAuthn, $isPassive, $setNameIdPolicy, $nameIdValueReq);
676679
}
677680

681+
/**
682+
* Creates an LogoutRequest
683+
*
684+
* @param Settings $settings Settings
685+
* @param string|null $request A UUEncoded Logout Request.
686+
* @param string|null $nameId The NameID that will be set in the LogoutRequest.
687+
* @param string|null $sessionIndex The SessionIndex (taken from the SAML Response in the SSO process).
688+
* @param string|null $nameIdFormat The NameID Format will be set in the LogoutRequest.
689+
* @param string|null $nameIdNameQualifier The NameID NameQualifier will be set in the LogoutRequest.
690+
* @param string|null $nameIdSPNameQualifier The NameID SP NameQualifier will be set in the LogoutRequest.
691+
*/
692+
public function buildLogoutRequest(Settings $settings, $request = null, $nameId = null, $sessionIndex = null, $nameIdFormat = null, $nameIdNameQualifier = null, $nameIdSPNameQualifier = null)
693+
{
694+
return new LogoutRequest($settings, $request, $nameId, $sessionIndex, $nameIdFormat, $nameIdNameQualifier, $nameIdSPNameQualifier);
695+
}
696+
697+
/**
698+
* Constructs a Logout Response object (Initialize params from settings and if provided
699+
* load the Logout Response.
700+
*
701+
* @param Settings $settings Settings.
702+
* @param string|null $response An UUEncoded SAML Logout response from the IdP.
703+
*
704+
* @throws Error
705+
* @throws Exception
706+
*/
707+
public function buildLogoutResponse(Settings $settings, $response = null)
708+
{
709+
return new LogoutResponse($settings, $response);
710+
}
711+
678712
/**
679713
* Generates the Signature for a SAML Request
680714
*

‎onelogin-saml-sso/php/lib/Saml2/AuthnRequest.php‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,13 @@
22
/**
33
* This file is part of php-saml.
44
*
5-
* (c) OneLogin Inc
6-
*
75
* For the full copyright and license information, please view the LICENSE
86
* file that was distributed with this source code.
97
*
108
* @package OneLogin
11-
* @author OneLogin Inc <saml-info@onelogin.com>
12-
* @license MIT https://github.com/onelogin/php-saml/blob/master/LICENSE
13-
* @link https://github.com/onelogin/php-saml
9+
* @author Sixto Martin <sixto.martin.garcia@gmail.com>
10+
* @license MIT https://github.com/SAML-Toolkits/php-saml/blob/master/LICENSE
11+
* @link https://github.com/SAML-Toolkits/php-saml
1412
*/
1513

1614
namespace OneLogin\Saml2;

‎onelogin-saml-sso/php/lib/Saml2/Constants.php‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,19 @@
22
/**
33
* This file is part of php-saml.
44
*
5-
* (c) OneLogin Inc
6-
*
75
* For the full copyright and license information, please view the LICENSE
86
* file that was distributed with this source code.
97
*
108
* @package OneLogin
11-
* @author OneLogin Inc <saml-info@onelogin.com>
12-
* @license MIT https://github.com/onelogin/php-saml/blob/master/LICENSE
13-
* @link https://github.com/onelogin/php-saml
9+
* @author Sixto Martin <sixto.martin.garcia@gmail.com>
10+
* @license MIT https://github.com/SAML-Toolkits/php-saml/blob/master/LICENSE
11+
* @link https://github.com/SAML-Toolkits/php-saml
1412
*/
1513

1614
namespace OneLogin\Saml2;
1715

1816
/**
19-
* Constants of OneLogin PHP Toolkit
17+
* Constants of SAML PHP Toolkit
2018
*
2119
* Defines all required constants
2220
*/

‎onelogin-saml-sso/php/lib/Saml2/Error.php‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,21 @@
22
/**
33
* This file is part of php-saml.
44
*
5-
* (c) OneLogin Inc
6-
*
75
* For the full copyright and license information, please view the LICENSE
86
* file that was distributed with this source code.
97
*
108
* @package OneLogin
11-
* @author OneLogin Inc <saml-info@onelogin.com>
12-
* @license MIT https://github.com/onelogin/php-saml/blob/master/LICENSE
13-
* @link https://github.com/onelogin/php-saml
9+
* @author Sixto Martin <sixto.martin.garcia@gmail.com>
10+
* @license MIT https://github.com/SAML-Toolkits/php-saml/blob/master/LICENSE
11+
* @link https://github.com/SAML-Toolkits/php-saml
1412
*/
1513

1614
namespace OneLogin\Saml2;
1715

1816
use Exception;
1917

2018
/**
21-
* Error class of OneLogin PHP Toolkit
19+
* Error class of SAML PHP Toolkit
2220
*
2321
* Defines the Error class
2422
*/
@@ -42,6 +40,7 @@ class Error extends Exception
4240
const SAML_SINGLE_LOGOUT_NOT_SUPPORTED = 12;
4341
const PRIVATE_KEY_NOT_FOUND = 13;
4442
const UNSUPPORTED_SETTINGS_OBJECT = 14;
43+
const INVALID_PARAMETER = 15;
4544

4645
/**
4746
* Constructor

‎onelogin-saml-sso/php/lib/Saml2/IdPMetadataParser.php‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,13 @@
22
/**
33
* This file is part of php-saml.
44
*
5-
* (c) OneLogin Inc
6-
*
75
* For the full copyright and license information, please view the LICENSE
86
* file that was distributed with this source code.
97
*
108
* @package OneLogin
11-
* @author OneLogin Inc <saml-info@onelogin.com>
12-
* @license MIT https://github.com/onelogin/php-saml/blob/master/LICENSE
13-
* @link https://github.com/onelogin/php-saml
9+
* @author Sixto Martin <sixto.martin.garcia@gmail.com>
10+
* @license MIT https://github.com/SAML-Toolkits/php-saml/blob/master/LICENSE
11+
* @link https://github.com/SAML-Toolkits/php-saml
1412
*/
1513

1614
namespace OneLogin\Saml2;
@@ -19,13 +17,17 @@
1917
use Exception;
2018

2119
/**
22-
* IdP Metadata Parser of OneLogin PHP Toolkit
20+
* IdP Metadata Parser of SAML PHP Toolkit
2321
*/
2422
class IdPMetadataParser
2523
{
2624
/**
2725
* Get IdP Metadata Info from URL
2826
*
27+
* This class does not validate in any way the URL that is introduced,
28+
* make sure to validate it properly before use it in the parseRemoteXML
29+
* method in order to avoid security issues like SSRF attacks.
30+
*
2931
* @param string $url URL where the IdP metadata is published
3032
* @param string $entityId Entity Id of the desired IdP, if no
3133
* entity Id is provided and the XML
@@ -34,19 +36,23 @@ class IdPMetadataParser
3436
* @param string $desiredNameIdFormat If available on IdP metadata, use that nameIdFormat
3537
* @param string $desiredSSOBinding Parse specific binding SSO endpoint
3638
* @param string $desiredSLOBinding Parse specific binding SLO endpoint
39+
* @param bool $validatePeer Enable or disable validate peer SSL certificate
3740
*
3841
* @return array metadata info in php-saml settings format
3942
*/
40-
public static function parseRemoteXML($url, $entityId = null, $desiredNameIdFormat = null, $desiredSSOBinding = Constants::BINDING_HTTP_REDIRECT, $desiredSLOBinding = Constants::BINDING_HTTP_REDIRECT)
43+
public static function parseRemoteXML($url, $entityId = null, $desiredNameIdFormat = null, $desiredSSOBinding = Constants::BINDING_HTTP_REDIRECT, $desiredSLOBinding = Constants::BINDING_HTTP_REDIRECT, $validatePeer = false)
4144
{
4245
$metadataInfo = array();
4346

4447
try {
4548
$ch = curl_init($url);
49+
curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS | CURLPROTO_HTTP);
50+
curl_setopt($ch, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTPS | CURLPROTO_HTTP);
51+
curl_setopt($ch, CURLOPT_MAXREDIRS, 5);
4652
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
4753
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
4854
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
49-
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
55+
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, $validatePeer);
5056
curl_setopt($ch, CURLOPT_FAILONERROR, 1);
5157

5258
$xml = curl_exec($ch);

‎onelogin-saml-sso/php/lib/Saml2/LogoutRequest.php‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,14 @@
22
/**
33
* This file is part of php-saml.
44
*
5-
* (c) OneLogin Inc
6-
*
75
* For the full copyright and license information, please view the LICENSE
86
* file that was distributed with this source code.
97
*
108
* @package OneLogin
11-
* @author OneLogin Inc <saml-info@onelogin.com>
12-
* @license MIT https://github.com/onelogin/php-saml/blob/master/LICENSE
13-
* @link https://github.com/onelogin/php-saml
9+
* @author Sixto Martin <sixto.martin.garcia@gmail.com>
10+
* @license MIT https://github.com/SAML-Toolkits/php-saml/blob/master/LICENSE
11+
* @link https://github.com/SAML-Toolkits/php-saml
1412
*/
15-
1613
namespace OneLogin\Saml2;
1714

1815
use RobRichards\XMLSecLibs\XMLSecurityKey;
@@ -158,7 +155,7 @@ public function __construct(\OneLogin\Saml2\Settings $settings, $request = null,
158155
}
159156

160157
/**
161-
* Returns the Logout Request defated, base64encoded, unsigned
158+
* Returns the Logout Request deflated, base64encoded, unsigned
162159
*
163160
* @param bool|null $deflate Whether or not we should 'gzdeflate' the request body before we return it.
164161
*
@@ -347,7 +344,7 @@ public static function getSessionIndexes($request)
347344
}
348345

349346
/**
350-
* Checks if the Logout Request recieved is valid.
347+
* Checks if the Logout Request received is valid.
351348
*
352349
* @param bool $retrieveParametersFromServer True if we want to use parameters from $_SERVER to validate the signature
353350
*

‎onelogin-saml-sso/php/lib/Saml2/LogoutResponse.php‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,13 @@
22
/**
33
* This file is part of php-saml.
44
*
5-
* (c) OneLogin Inc
6-
*
75
* For the full copyright and license information, please view the LICENSE
86
* file that was distributed with this source code.
97
*
108
* @package OneLogin
11-
* @author OneLogin Inc <saml-info@onelogin.com>
12-
* @license MIT https://github.com/onelogin/php-saml/blob/master/LICENSE
13-
* @link https://github.com/onelogin/php-saml
9+
* @author Sixto Martin <sixto.martin.garcia@gmail.com>
10+
* @license MIT https://github.com/SAML-Toolkits/php-saml/blob/master/LICENSE
11+
* @link https://github.com/SAML-Toolkits/php-saml
1412
*/
1513

1614
namespace OneLogin\Saml2;
@@ -237,7 +235,7 @@ public function isValid($requestId = null, $retrieveParametersFromServer = false
237235
}
238236

239237
/**
240-
* Extracts a node from the DOMDocument (Logout Response Menssage)
238+
* Extracts a node from the DOMDocument (Logout Response Message)
241239
*
242240
* @param string $query Xpath Expression
243241
*

0 commit comments

Comments
 (0)