[js-embedded-discovery] branch main updated: EDS-90 Deprecate and replace sensitive terms in APIs and components

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository js-embedded-discovery.

View the commit online:
http://git.shibboleth.net/view/?p=js-embedded-discovery.git;a=commit;h=2c84676bc217f5c7b0931cfe328f19ef01b6095b

The following commit(s) were added to refs/heads/main by this push:
     new 2c84676  EDS-90 Deprecate and replace sensitive terms in APIs and components
2c84676 is described below

commit 2c84676bc217f5c7b0931cfe328f19ef01b6095b
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon Mar 14 15:01:43 2022 +0000

    EDS-90 Deprecate and replace sensitive terms in APIs and components
    
    https://shibboleth.atlassian.net/browse/EDS-90
---
 src/javascript/idpselect.js        | 5 +++++
 src/javascript/idpselect_config.js | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/javascript/idpselect.js b/src/javascript/idpselect.js
index 9d8a14c..8012a1f 100644
--- a/src/javascript/idpselect.js
+++ b/src/javascript/idpselect.js
@@ -344,6 +344,11 @@ function IdPSelectUI() {
             fatal(getLocalizedMessage('fatal.badProtocol'));
             return false;
         }
+
+        if (!validateReturn(paramsSupplied.redirectAllow, returnString)) {
+            fatalNoAlert(getLocalizedMessage('fatal.badReturnString'));
+            return false;
+        }
         if (!validateReturn(paramsSupplied.returnWhiteList, returnString)) {
 
             fatalNoAlert(getLocalizedMessage('fatal.badReturnString'));
diff --git a/src/javascript/idpselect_config.js b/src/javascript/idpselect_config.js
index 5c21fc5..754e2c1 100644
--- a/src/javascript/idpselect_config.js
+++ b/src/javascript/idpselect_config.js
@@ -15,7 +15,7 @@ function IdPSelectUIParms(){
                                      // Approaching via the Discovery Protocol for example
     //this.defaultReturn = "https://example.org/Shibboleth.sso/DS?SAMLDS=1&target=https://example.org/secure";
     this.defaultReturnIDParam = null;
-    this.returnWhiteList = [ "^https:\/\/example\.org\/Shibboleth\.sso\/Login.*$" , "^https:\/\/example\.com\/Shibboleth\.sso\/Login.*$" ];
+    this.redirectAllow = [ "^https:\/\/example\.org\/Shibboleth\.sso\/Login.*$" , "^https:\/\/example\.com\/Shibboleth\.sso\/Login.*$" ];
     this.helpURL = 'https://wiki.shibboleth.net/confluence/display/SHIB2/DSRoadmap';
     this.ie6Hack = null;             // An array of structures to disable when drawing the pull down (needed to 
                                      // handle the ie6 z axis problem

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.