Bug 24779

Summary: Shibboleth login url double encodes "=" in query
Product: Koha Reporter: Hannah Co <hannah.co>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: RESOLVED INVALID QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: dpavlin, jonathan.druart, martin.renvoize, matthias.meusburger
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on: 23042    
Bug Blocks:    

Description Hannah Co 2020-03-02 19:38:33 UTC
login_shib_url and logout_shib use _get_return to process a url and parameters. I am seeing urls come through with the "=" between the parameter name and the query encoded to "%3D". I think this is because url encoding is done on line 214 to the whole parameter string after assembly. 

  214    return $uri_base_part . URI::Escape::uri_escape_utf8($uri_params_part);

I believe only the query part of the parameter should be uri escaped, on line 209:

  209    $uri_params_part .= $uriPiece;

My installation with shibboleth login works with lines 209 and 214 changed as follows:

  209    $uri_params_part .= URI::Escape::uri_escape_utf8($uriPiece);
  214    return $uri_base_part . $uri_params_part;
Comment 1 Jonathan Druart 2020-08-10 11:21:04 UTC
Hi Hannah, can you detail a bit more please? We had the discussion about this on bug 23042 and it seems that it is the expected behavior.

The variables return and target contains an URI that must be escaped.