Bugzilla – Attachment 94432 Details for
Bug 23042
Local login attempt populates shibboleth url with userid and password in plain text
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 23042: Only include GET params in return URL for Shibboleth
Bug-23042-Only-include-GET-params-in-return-URL-fo.patch (text/plain), 2.57 KB, created by
Marcel de Rooy
on 2019-10-21 10:48:58 UTC
(
hide
)
Description:
Bug 23042: Only include GET params in return URL for Shibboleth
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2019-10-21 10:48:58 UTC
Size:
2.57 KB
patch
obsolete
>From 9b746755598a314c061658bfeaca3d84a77b659b Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Thu, 13 Jun 2019 17:02:33 +0100 >Subject: [PATCH] Bug 23042: Only include GET params in return URL for > Shibboleth >Content-Type: text/plain; charset=utf-8 > >The shibboleth return target included POST parameters in the URL string, >this meant that a failed local login POST would include the username and >password used in the attemtped login in plaintext in the redirect URL >that is appended to the shibboleth login URL. > >Signed-off-by: Mark Tompsett <mtompset@hotmail.com> > >Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > C4/Auth_with_shibboleth.pm | 32 ++++++++++++++++++++++++++------ > 1 file changed, 26 insertions(+), 6 deletions(-) > >diff --git a/C4/Auth_with_shibboleth.pm b/C4/Auth_with_shibboleth.pm >index 55cee73569..54813ba6f6 100644 >--- a/C4/Auth_with_shibboleth.pm >+++ b/C4/Auth_with_shibboleth.pm >@@ -54,18 +54,17 @@ sub shib_ok { > sub logout_shib { > my ($query) = @_; > my $uri = _get_uri(); >- print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" ); >+ my $return = _get_return($query); >+ print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$return" ); > } > > # Returns Shibboleth login URL with callback to the requesting URL > sub login_shib_url { > my ($query) = @_; > >- my $param = _get_uri() . get_script_name(); >- if ( $query->query_string() ) { >- $param = $param . '?' . $query->query_string(); >- } >- my $uri = _get_uri() . "/Shibboleth.sso/Login?target=$param"; >+ my $target = _get_return($query); >+ my $uri = _get_uri() . "/Shibboleth.sso/Login?target=" . $target; >+ > return $uri; > } > >@@ -189,6 +188,27 @@ sub _get_uri { > return $return; > } > >+sub _get_return { >+ my ($query) = @_; >+ >+ my $uri_base_part = _get_uri() . get_script_name(); >+ >+ my $uri_params_part = ''; >+ foreach my $param ( $query->url_param() ) { >+ # url_param() always returns parameters that were deleted by delete() >+ # This additional check ensure that parameter was not deleted. >+ my $uriPiece = $query->param($param); >+ if ($uriPiece) { >+ $uri_params_part .= '&' if $uri_params_part; >+ $uri_params_part .= $param . '='; >+ $uri_params_part .= URI::Escape::uri_escape( $uriPiece ); >+ } >+ } >+ $uri_base_part .= '%3F' if $uri_params_part; >+ >+ return $uri_base_part . $uri_params_part; >+} >+ > sub _get_shib_config { > my $config = C4::Context->config('shibboleth'); > >-- >2.11.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 23042
:
90579
|
90636
|
90772
|
90773
|
90811
|
90814
|
90911
|
90912
|
90913
|
94404
|
94405
|
94406
|
94431
| 94432 |
94433