Bug 24779 - Shibboleth login url double encodes "=" in query
Summary: Shibboleth login url double encodes "=" in query
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low major (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 23042
Blocks:
  Show dependency treegraph
 
Reported: 2020-03-02 19:38 UTC by Hannah Co
Modified: 2020-08-10 11:21 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Hannah Co 2020-03-02 19:38:33 UTC
login_shib_url and logout_shib use _get_return to process a url and parameters. I am seeing urls come through with the "=" between the parameter name and the query encoded to "%3D". I think this is because url encoding is done on line 214 to the whole parameter string after assembly. 

  214    return $uri_base_part . URI::Escape::uri_escape_utf8($uri_params_part);

I believe only the query part of the parameter should be uri escaped, on line 209:

  209    $uri_params_part .= $uriPiece;

My installation with shibboleth login works with lines 209 and 214 changed as follows:

  209    $uri_params_part .= URI::Escape::uri_escape_utf8($uriPiece);
  214    return $uri_base_part . $uri_params_part;
Comment 1 Jonathan Druart 2020-08-10 11:21:04 UTC
Hi Hannah, can you detail a bit more please? We had the discussion about this on bug 23042 and it seems that it is the expected behavior.

The variables return and target contains an URI that must be escaped.