[cpp-sp COMMIT] in /branches/REL_2: adfs/adfs.cpp schemas/shibboleth-2.0-native-sp-config.xsd shibsp/Application.cpp ...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Feb  3 04:03:45 2012
New Revision: 3572

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3572&view=rev
Log:
https://issues.shibboleth.net/jira/browse/SSPCPP-352

Modified:
    branches/REL_2/adfs/adfs.cpp
    branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd
    branches/REL_2/shibsp/Application.cpp
    branches/REL_2/shibsp/Application.h
    branches/REL_2/shibsp/handler/impl/AbstractHandler.cpp
    branches/REL_2/shibsp/handler/impl/AssertionConsumerService.cpp
    branches/REL_2/shibsp/handler/impl/LocalLogoutInitiator.cpp
    branches/REL_2/shibsp/handler/impl/SAML2Logout.cpp
    branches/REL_2/shibsp/handler/impl/SAML2LogoutInitiator.cpp
    branches/REL_2/shibsp/handler/impl/SAML2NameIDMgmt.cpp
    branches/REL_2/shibsp/handler/impl/SAML2SessionInitiator.cpp
    branches/REL_2/shibsp/handler/impl/Shib1SessionInitiator.cpp
    branches/REL_2/shibsp/handler/impl/WAYFSessionInitiator.cpp
    branches/REL_2/shibsp/impl/XMLServiceProvider.cpp
    branches/REL_2/shibsp/internal.h

Modified: branches/REL_2/adfs/adfs.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/adfs/adfs.cpp?rev=3572&r1=3571&r2=3572&view=diff
==============================================================================
--- branches/REL_2/adfs/adfs.cpp (original)
+++ branches/REL_2/adfs/adfs.cpp Fri Feb  3 04:03:45 2012
@@ -361,6 +361,7 @@
         // Since we're passing the ACS by value, we need to compute the return URL,
         // so we'll need the target resource for real.
         recoverRelayState(app, request, request, target, false);
+        app.limitRedirect(request, target.c_str());
 
         acClass = getString("authnContextClassRef", request);
     }
@@ -961,6 +962,10 @@
                 );
         }
 
+        const char* returnloc = httpRequest.getParameter("return");
+        if (returnloc)
+            application.limitRedirect(httpRequest, returnloc);
+
         // Log the request.
         scoped_ptr<LogoutEvent> logout_event(newLogoutEvent(application, &httpRequest, session));
         if (logout_event) {
@@ -968,12 +973,19 @@
             application.getServiceProvider().getTransactionLog()->write(*logout_event);
         }
 
-        const URLEncoder* urlenc = XMLToolingConfig::getConfig().getURLEncoder();
-        const char* returnloc = httpRequest.getParameter("return");
         auto_ptr_char dest(ep->getLocation());
         string req=string(dest.get()) + (strchr(dest.get(),'?') ? '&' : '?') + "wa=wsignout1.0";
-        if (returnloc)
-            req += "&wreply=" + urlenc->encode(returnloc);
+        if (returnloc) {
+            req += "&wreply=";
+            if (*returnloc == '/') {
+                string s(returnloc);
+                httpRequest.absolutize(s);
+                req += XMLToolingConfig::getConfig().getURLEncoder()->encode(s.c_str());
+            }
+            else {
+                req += XMLToolingConfig::getConfig().getURLEncoder()->encode(returnloc);
+            }
+        }
         ret.second = httpResponse.sendRedirect(req.c_str());
         ret.first = true;
 
@@ -1045,7 +1057,16 @@
         }
     }
 
-    if (param)
-        return make_pair(true, request.sendRedirect(param));
+    if (param) {
+        if (*param == '/') {
+            string p(param);
+            request.absolutize(p);
+            return make_pair(true, request.sendRedirect(p.c_str()));
+        }
+        else {
+            app.limitRedirect(request, param);
+            return make_pair(true, request.sendRedirect(param));
+        }
+    }
     return sendLogoutPage(app, request, request, "global");
 }

Modified: branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd?rev=3572&r1=3571&r2=3572&view=diff
==============================================================================
--- branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd (original)
+++ branches/REL_2/schemas/shibboleth-2.0-native-sp-config.xsd Fri Feb  3 04:03:45 2012
@@ -46,12 +46,14 @@
     </restriction>
   </simpleType>
 
-  <simpleType name="relayStateLimitType">
+  <simpleType name="redirectLimitType">
     <restriction base="string">
       <enumeration value="none"/>
       <enumeration value="exact"/>
       <enumeration value="host"/>
       <enumeration value="whitelist"/>
+      <enumeration value="exact+whitelist"/>
+      <enumeration value="host+whitelist"/>
     </restriction>
   </simpleType>
 
@@ -524,8 +526,10 @@
     <attribute name="postTemplate" type="conf:string"/>
     <attribute name="postExpire" type="boolean"/>
     <attribute name="relayState" type="conf:string"/>
-    <attribute name="relayStateLimit" type="conf:relayStateLimitType"/>
+    <attribute name="relayStateLimit" type="conf:redirectLimitType"/>
     <attribute name="relayStateWhitelist" type="conf:listOfURIs"/>
+    <attribute name="redirectLimit" type="conf:redirectLimitType"/>
+    <attribute name="redirectWhitelist" type="conf:listOfURIs"/>
     <anyAttribute namespace="##other" processContents="lax"/>

[... 451 lines stripped ...]