Issues in openid.php (master) - Issues in master - Cyberbyte-Studios/CyberWorks - Measure and Improve Code Quality continuously with Scrutinizer

Issues (501)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

classes/openid.php (115 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/**
     * This class provides a simple interface for OpenID (1.1 and 2.0) authentication.
     * Supports Yadis discovery.
     * The authentication process is stateless/dumb.
     *
     * Usage:
     * Sign-on with OpenID is a two step process:
     * Step one is authentication with the provider:
     * <code>
     * $openid = new LightOpenID('my-host.example.org');
     * $openid->identity = 'ID supplied by user';
     * header('Location: ' . $openid->authUrl());
     * </code>
     * The provider then sends various parameters via GET, one of them is openid_mode.
     * Step two is verification:
     * <code>
     * $openid = new LightOpenID('my-host.example.org');
     * if ($openid->mode) {
     *     echo $openid->validate() ? 'Logged in.' : 'Failed';
     * }
     * </code>
     *
     * Change the 'my-host.example.org' to your domain name. Do NOT use $_SERVER['HTTP_HOST']
     * for that, unless you know what you are doing.
     *
     * Optionally, you can set $returnUrl and $realm (or $trustRoot, which is an alias).
     * The default values for those are:
     * $openid->realm     = (!empty($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'];
     * $openid->returnUrl = $openid->realm . $_SERVER['REQUEST_URI'];
     * If you don't know their meaning, refer to any openid tutorial, or specification. Or just guess.
     *
     * AX and SREG extensions are supported.
     * To use them, specify $openid->required and/or $openid->optional before calling $openid->authUrl().
     * These are arrays, with values being AX schema paths (the 'path' part of the URL).
     * For example:
     *   $openid->required = array('namePerson/friendly', 'contact/email');
     *   $openid->optional = array('namePerson/first');
     * If the server supports only SREG or OpenID 1.1, these are automaticaly
     * mapped to SREG names, so that user doesn't have to know anything about the server.
     *
     * To get the values, use $openid->getAttributes().
     *
     *
     * The library requires PHP >= 5.1.2 with curl or http/https stream wrappers enabled.
     * @author Mewp
     * @copyright Copyright (c) 2010, Mewp
     * @license http://www.opensource.org/licenses/mit-license.php MIT
     */
class LightOpenID
namespace YourVendor;

class YourClass { }
{
    public $returnUrl

            , $required = array()
            , $optional = array()
            , $verify_peer = null
            , $capath = null
            , $cainfo = null
            , $data;
    private $identity, $claimed_id;

    protected $server, $version, $trustRoot, $aliases, $identifier_select = false

            , $ax = false, $sreg = false, $setup_url = null, $headers = array();

    static protected $ax_to_sreg = array(
        'namePerson/friendly'     => 'nickname',
        'contact/email'           => 'email',
        'namePerson'              => 'fullname',
        'birthDate'               => 'dob',
        'person/gender'           => 'gender',
        'contact/postalCode/home' => 'postcode',
        'contact/country/home'    => 'country',
        'pref/language'           => 'language',
        'pref/timezone'           => 'timezone',
        );

    function __construct($host)

    {
        $this->trustRoot = (strpos($host, '://') ? $host : 'http://' . $host);
        if ((!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off')
            || (isset($_SERVER['HTTP_X_FORWARDED_PROTO'])
            && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
        ) {
            $this->trustRoot = (strpos($host, '://') ? $host : 'https://' . $host);
        }

        if (($host_end = strpos($this->trustRoot, '/', 8)) !== false) {
            $this->trustRoot = substr($this->trustRoot, 0, $host_end);
        }

        $uri = rtrim(preg_replace('#((?<=\?)|&)openid\.[^&]+#', '', $_SERVER['REQUEST_URI']), '?');
        $this->returnUrl = $this->trustRoot . $uri;

        $this->data = ($_SERVER['REQUEST_METHOD'] === 'POST') ? $_POST : $_GET;

        if (!function_exists('curl_init') && !in_array('https', stream_get_wrappers())) {
            throw new ErrorException('You must have either https wrappers or curl enabled.');
        }
    }

    function __set($name, $value)

    {
        switch ($name) {
            case 'identity':
                if (strlen($value = trim((String) $value))) {
                    if (preg_match('#^xri:/*#i', $value, $m)) {

                        $value = substr($value, strlen($m[0]));
                    } elseif (!preg_match('/^(?:[=@+\$!\(]|https?:)/i', $value)) {
                        $value = "http://$value";
                    }
                    if (preg_match('#^https?://[^/]+$#i', $value, $m)) {
                        $value .= '/';
                    }
                }
                $this->$name = $this->claimed_id = $value;
                break;
            case 'trustRoot':
            case 'realm':
                $this->trustRoot = trim($value);
        }
    }

    function __get($name)

    {
        switch ($name) {
            case 'identity':
                # We return claimed_id instead of identity,

                # because the developer should see the claimed identifier,

                # i.e. what he set as identity, not the op-local identifier (which is what we verify)

                return $this->claimed_id;
            case 'trustRoot':
            case 'realm':
                return $this->trustRoot;
            case 'mode':
                return empty($this->data['openid_mode']) ? null : $this->data['openid_mode'];
        }
    }

    /**
     * Checks if the server specified in the url exists.
     *
     * @param $url url to check
     * @return true, if the server exists; false otherwise

     */
    function hostExists($url)

    {
        if (strpos($url, '/') === false) {
            $server = $url;
        } else {
            $server = @parse_url($url, PHP_URL_HOST);
        }

        if (!$server) {
            return false;
        }

        return !!gethostbynamel($server);
    }

    protected function request_curl($url, $method = 'GET', $params = array(), $update_claimed_id)
    {
        $params = http_build_query($params, '', '&');
        $curl = curl_init($url . ($method == 'GET' && $params ? '?' . $params : ''));
        curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($curl, CURLOPT_HEADER, false);
        curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($curl, CURLOPT_HTTPHEADER, array('Accept: application/xrds+xml, */*'));

        if ($this->verify_peer !== null) {
            curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, $this->verify_peer);
            if ($this->capath) {
                curl_setopt($curl, CURLOPT_CAPATH, $this->capath);
            }

            if ($this->cainfo) {
                curl_setopt($curl, CURLOPT_CAINFO, $this->cainfo);
            }
        }

        if ($method == 'POST') {
            curl_setopt($curl, CURLOPT_POST, true);
            curl_setopt($curl, CURLOPT_POSTFIELDS, $params);
        } elseif ($method == 'HEAD') {
            curl_setopt($curl, CURLOPT_HEADER, true);
            curl_setopt($curl, CURLOPT_NOBODY, true);
        } else {
            curl_setopt($curl, CURLOPT_HEADER, true);
            curl_setopt($curl, CURLOPT_HTTPGET, true);
        }
        $response = curl_exec($curl);

        if ($method == 'HEAD' && curl_getinfo($curl, CURLINFO_HTTP_CODE) == 405) {
            curl_setopt($curl, CURLOPT_HTTPGET, true);
            $response = curl_exec($curl);
            $response = substr($response, 0, strpos($response, "\r\n\r\n"));
        }

        if ($method == 'HEAD' || $method == 'GET') {
            $header_response = $response;

            # If it's a GET request, we want to only parse the header part.

            if ($method == 'GET') {
                $header_response = substr($response, 0, strpos($response, "\r\n\r\n"));
            }

            $headers = array();
            foreach (explode("\n", $header_response) as $header) {
                $pos = strpos($header, ':');
                if ($pos !== false) {
                    $name = strtolower(trim(substr($header, 0, $pos)));
                    $headers[$name] = trim(substr($header, $pos + 1));
                }
            }

            if ($update_claimed_id) {
                # Updating claimed_id in case of redirections.

                $effective_url = curl_getinfo($curl, CURLINFO_EFFECTIVE_URL);
                if ($effective_url != $url) {
                    $this->identity = $this->claimed_id = $effective_url;
                }
            }

            if ($method == 'HEAD') {
                return $headers;
            } else {
                $this->headers = $headers;
            }
        }

        if (curl_errno($curl)) {
            throw new ErrorException(curl_error($curl), curl_errno($curl));
        }

        return $response;
    }

    protected function parse_header_array($array, $update_claimed_id)
    {
        $headers = array();
        foreach ($array as $header) {
            $pos = strpos($header, ':');
            if ($pos !== false) {
                $name = strtolower(trim(substr($header, 0, $pos)));
                $headers[$name] = trim(substr($header, $pos + 1));

                # Following possible redirections. The point is just to have

                # claimed_id change with them, because the redirections

                # are followed automatically.

                # We ignore redirections with relative paths.

                # If any known provider uses them, file a bug report.

                if ($name == 'location' && $update_claimed_id) {
                    if (strpos($headers[$name], 'http') === 0) {
                        $this->identity = $this->claimed_id = $headers[$name];
                    } elseif ($headers[$name][0] == '/') {
                        $parsed_url = parse_url($this->claimed_id);
                        $this->identity =
                        $this->claimed_id = $parsed_url['scheme'] . '://'
                                            . $parsed_url['host']
                                            . $headers[$name];
                    }
                }
            }
        }
        return $headers;
    }

    protected function request_streams($url, $method = 'GET', $params = array(), $update_claimed_id)
    {
        if (!$this->hostExists($url)) {
            throw new ErrorException("Could not connect to $url.", 404);
        }

        $params = http_build_query($params, '', '&');
        switch ($method) {
            case 'GET':
                $opts = array(
                    'http' => array(
                        'method' => 'GET',
                        'header' => 'Accept: application/xrds+xml, */*',
                        'ignore_errors' => true,
                    ), 'ssl' => array(
                        'CN_match' => parse_url($url, PHP_URL_HOST),
                    ),
                );
                $url = $url . ($params ? '?' . $params : '');
                break;
            case 'POST':
                $opts = array(
                    'http' => array(
                        'method' => 'POST',
                        'header'  => 'Content-type: application/x-www-form-urlencoded',
                        'content' => $params,
                        'ignore_errors' => true,
                    ), 'ssl' => array(
                        'CN_match' => parse_url($url, PHP_URL_HOST),
                    ),
                );
                break;
            case 'HEAD':
                # We want to send a HEAD request,

                # but since get_headers doesn't accept $context parameter,

                # we have to change the defaults.

                $default = stream_context_get_options(stream_context_get_default());
                stream_context_get_default(
                    array(
                        'http' => array(
                            'method' => 'HEAD',
                            'header' => 'Accept: application/xrds+xml, */*',
                            'ignore_errors' => true,
                        ), 'ssl' => array(
                            'CN_match' => parse_url($url, PHP_URL_HOST),
                        ),
                    )
                );

                $url = $url . ($params ? '?' . $params : '');
                $headers = get_headers($url);
                if (!$headers) {

                    return array();
                }

                if (intval(substr($headers[0], strlen('HTTP/1.1 '))) == 405) {
                    # The server doesn't support HEAD, so let's emulate it with

                    # a GET.

                    $args = func_get_args();
                    $args[1] = 'GET';
                    call_user_func_array(array($this, 'request_streams'), $args);
                    return $this->headers;
                }

                $headers = $this->parse_header_array($headers, $update_claimed_id);

                # And restore them.

                stream_context_get_default($default);
                return $headers;
        }

        if ($this->verify_peer) {
            $opts['ssl'] += array(
function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}
                'verify_peer' => true,
                'capath'      => $this->capath,
                'cafile'      => $this->cainfo,
            );
        }

        $context = stream_context_create($opts);
        $data = file_get_contents($url, false, $context);
        # This is a hack for providers who don't support HEAD requests.

        # It just creates the headers array for the last request in $this->headers.

        if (isset($http_response_header)) {
            $this->headers = $this->parse_header_array($http_response_header, $update_claimed_id);
        }

        return $data;
    }

    protected function request($url, $method = 'GET', $params = array(), $update_claimed_id = false)
    {
        if (function_exists('curl_init')
            && (!in_array('https', stream_get_wrappers()) || !ini_get('safe_mode') && !ini_get('open_basedir'))
        ) {
            return $this->request_curl($url, $method, $params, $update_claimed_id);
        }
        return $this->request_streams($url, $method, $params, $update_claimed_id);
    }

    protected function build_url($url, $parts)
    {
        if (isset($url['query'], $parts['query'])) {
            $parts['query'] = $url['query'] . '&' . $parts['query'];
        }

        $url = $parts + $url;
        $url = $url['scheme'] . '://'
                . (empty($url['username']) ? ''
                 :(empty($url['password']) ? "{$url['username']}@"
                 :"{$url['username']}:{$url['password']}@"))
                . $url['host']
                . (empty($url['port']) ? '' : ":{$url['port']}")
                . (empty($url['path']) ? '' : $url['path'])
                . (empty($url['query']) ? '' : "?{$url['query']}")
                . (empty($url['fragment']) ? '' : "#{$url['fragment']}");
        return $url;
    }

    /**
     * Helper function used to scan for <meta>/<link> tags and extract information
     * from them
     */
    protected function htmlTag($content, $tag, $attrName, $attrValue, $valueName)
    {
        preg_match_all("#<{$tag}[^>]*$attrName=['\"].*?$attrValue.*?['\"][^>]*$valueName=['\"](.+?)['\"][^>]*/?>#i", $content, $matches1);
        preg_match_all("#<{$tag}[^>]*$valueName=['\"](.+?)['\"][^>]*$attrName=['\"].*?$attrValue.*?['\"][^>]*/?>#i", $content, $matches2);

        $result = array_merge($matches1[1], $matches2[1]);
        return empty($result) ? false : $result[0];
    }

    /**
     * Performs Yadis and HTML discovery. Normally not used.
     * @param $url Identity URL.
     * @return String OP Endpoint (i.e. OpenID provider address).
     * @throws ErrorException
     */
    function discover($url)

    {
        if (!$url) {
            throw new ErrorException('No identity supplied.');
        }
        # Use xri.net proxy to resolve i-name identities

        if (!preg_match('#^https?:#', $url)) {
            $url = "https://xri.net/$url";
        }

        # We save the original url in case of Yadis discovery failure.

        # It can happen when we'll be lead to an XRDS document

        # which does not have any OpenID2 services.

        $originalUrl = $url;

        # A flag to disable yadis discovery in case of failure in headers.

        $yadis = true;

        # We'll jump a maximum of 5 times, to avoid endless redirections.

        for ($i = 0; $i < 5; $i++) {
            if ($yadis) {
                $headers = $this->request($url, 'HEAD', array(), true);

                $next = false;
                if (isset($headers['x-xrds-location'])) {
                    $url = $this->build_url(parse_url($url), parse_url(trim($headers['x-xrds-location'])));
                    $next = true;
                }

                if (isset($headers['content-type'])
                    && (strpos($headers['content-type'], 'application/xrds+xml') !== false
                        || strpos($headers['content-type'], 'text/xml') !== false)
                ) {
                    # Apparently, some providers return XRDS documents as text/html.

                    # While it is against the spec, allowing this here shouldn't break

                    # compatibility with anything.

                    # ---

                    # Found an XRDS document, now let's find the server, and optionally delegate.

                    $content = $this->request($url, 'GET');

                    preg_match_all('#<Service.*?>(.*?)</Service>#s', $content, $m);

                    foreach ($m[1] as $content) {
                        $content = ' ' . $content; # The space is added, so that strpos doesn't return 0.


                        # OpenID 2

                        $ns = preg_quote('http://specs.openid.net/auth/2.0/', '#');
                        if (preg_match('#<Type>\s*' . $ns . '(server|signon)\s*</Type>#s', $content, $type)) {
                            if ($type[1] == 'server') {
                                $this->identifier_select = true;
                            }

                            preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
                            preg_match('#<(Local|Canonical)ID>(.*)</\1ID>#', $content, $delegate);
                            if (empty($server)) {
                                return false;
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
                            }
                            # Does the server advertise support for either AX or SREG?

                            $this->ax   = (bool) strpos($content, '<Type>http://openid.net/srv/ax/1.0</Type>');
                            $this->sreg = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
                                       || strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');

                            $server = $server[1];
                            if (isset($delegate[2])) {
                                $this->identity = trim($delegate[2]);
                            }
                            $this->version = 2;

                            $this->server = $server;
                            return $server;
                        }

                        # OpenID 1.1

                        $ns = preg_quote('http://openid.net/signon/1.1', '#');
                        if (preg_match('#<Type>\s*' . $ns . '\s*</Type>#s', $content)) {

                            preg_match('#<URI.*?>(.*)</URI>#', $content, $server);
                            preg_match('#<.*?Delegate>(.*)</.*?Delegate>#', $content, $delegate);
                            if (empty($server)) {
                                return false;
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
                            }
                            # AX can be used only with OpenID 2.0, so checking only SREG

                            $this->sreg = strpos($content, '<Type>http://openid.net/sreg/1.0</Type>')
                                       || strpos($content, '<Type>http://openid.net/extensions/sreg/1.1</Type>');

                            $server = $server[1];
                            if (isset($delegate[1])) {
                                $this->identity = $delegate[1];
                            }
                            $this->version = 1;

                            $this->server = $server;
                            return $server;
                        }
                    }

                    $next = true;
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}
                    $yadis = false;
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}
                    $url = $originalUrl;
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}
                    $content = null;
$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}
                    break;
                }
                if ($next) {
                    continue;
                }

                # There are no relevant information in headers, so we search the body.

                $content = $this->request($url, 'GET', array(), true);

                if (isset($this->headers['x-xrds-location'])) {
                    $url = $this->build_url(parse_url($url), parse_url(trim($this->headers['x-xrds-location'])));
                    continue;
                }

                $location = $this->htmlTag($content, 'meta', 'http-equiv', 'X-XRDS-Location', 'content');
                if ($location) {
                    $url = $this->build_url(parse_url($url), parse_url($location));
                    continue;
                }
            }

            if (!$content) {
function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}
                $content = $this->request($url, 'GET');
            }

            # At this point, the YADIS Discovery has failed, so we'll switch

            # to openid2 HTML discovery, then fallback to openid 1.1 discovery.

            $server   = $this->htmlTag($content, 'link', 'rel', 'openid2.provider', 'href');
            $delegate = $this->htmlTag($content, 'link', 'rel', 'openid2.local_id', 'href');
            $this->version = 2;

            if (!$server) {
                # The same with openid 1.1

                $server   = $this->htmlTag($content, 'link', 'rel', 'openid.server', 'href');
                $delegate = $this->htmlTag($content, 'link', 'rel', 'openid.delegate', 'href');
                $this->version = 1;
            }

            if ($server) {
                # We found an OpenID2 OP Endpoint

                if ($delegate) {
                    # We have also found an OP-Local ID.

                    $this->identity = $delegate;
                }
                $this->server = $server;
                return $server;
            }

            throw new ErrorException("No OpenID Server found at $url", 404);
        }
        throw new ErrorException('Endless redirection!', 500);
    }

    protected function sregParams()
    {
        $params = array();
        # We always use SREG 1.1, even if the server is advertising only support for 1.0.

        # That's because it's fully backwards compatibile with 1.0, and some providers

        # advertise 1.0 even if they accept only 1.1. One such provider is myopenid.com

        $params['openid.ns.sreg'] = 'http://openid.net/extensions/sreg/1.1';
        if ($this->required) {

            $params['openid.sreg.required'] = array();
            foreach ($this->required as $required) {
                if (!isset(self::$ax_to_sreg[$required])) {
                    continue;
                }
                $params['openid.sreg.required'][] = self::$ax_to_sreg[$required];
            }
            $params['openid.sreg.required'] = implode(',', $params['openid.sreg.required']);
        }

        if ($this->optional) {

            $params['openid.sreg.optional'] = array();
            foreach ($this->optional as $optional) {
                if (!isset(self::$ax_to_sreg[$optional])) {
                    continue;
                }
                $params['openid.sreg.optional'][] = self::$ax_to_sreg[$optional];
            }
            $params['openid.sreg.optional'] = implode(',', $params['openid.sreg.optional']);
        }
        return $params;
    }

    protected function axParams()
    {
        $params = array();
        if ($this->required || $this->optional) {

            $params['openid.ns.ax'] = 'http://openid.net/srv/ax/1.0';
            $params['openid.ax.mode'] = 'fetch_request';
            $this->aliases = array();
            $counts   = array();
            $required = array();
            $optional = array();
            foreach (array('required', 'optional') as $type) {
                foreach ($this->$type as $alias => $field) {
                    if (is_int($alias)) {
                        $alias = strtr($field, '/', '_');
                    }
                    $this->aliases[$alias] = 'http://axschema.org/' . $field;
                    if (empty($counts[$alias])) {
                        $counts[$alias] = 0;
                    }
                    $counts[$alias] += 1;
                    ${$type}[] = $alias;
                }
            }
            foreach ($this->aliases as $alias => $ns) {
                $params['openid.ax.type.' . $alias] = $ns;
            }
            foreach ($counts as $alias => $count) {
                if ($count == 1) {
                    continue;
                }
                $params['openid.ax.count.' . $alias] = $count;
            }

            # Don't send empty ax.requied and ax.if_available.

            # Google and possibly other providers refuse to support ax when one of these is empty.

            if ($required) {

                $params['openid.ax.required'] = implode(',', $required);
            }
            if ($optional) {

                $params['openid.ax.if_available'] = implode(',', $optional);
            }
        }
        return $params;
    }

    protected function authUrl_v1($immediate)
    {
        $returnUrl = $this->returnUrl;
        # If we have an openid.delegate that is different from our claimed id,

        # we need to somehow preserve the claimed id between requests.

        # The simplest way is to just send it along with the return_to url.

        if ($this->identity != $this->claimed_id) {
            $returnUrl .= (strpos($returnUrl, '?') ? '&' : '?') . 'openid.claimed_id=' . $this->claimed_id;
        }

        $params = array(
            'openid.return_to'  => $returnUrl,
            'openid.mode'       => $immediate ? 'checkid_immediate' : 'checkid_setup',
            'openid.identity'   => $this->identity,
            'openid.trust_root' => $this->trustRoot,
            ) + $this->sregParams();

        return $this->build_url(parse_url($this->server)
                                , array('query' => http_build_query($params, '', '&')));
    }

    protected function authUrl_v2($immediate)
    {
        $params = array(
            'openid.ns'          => 'http://specs.openid.net/auth/2.0',
            'openid.mode'        => $immediate ? 'checkid_immediate' : 'checkid_setup',
            'openid.return_to'   => $this->returnUrl,
            'openid.realm'       => $this->trustRoot,
        );
        if ($this->ax) {
            $params += $this->axParams();
        }
        if ($this->sreg) {
            $params += $this->sregParams();
        }
        if (!$this->ax && !$this->sreg) {
            # If OP doesn't advertise either SREG, nor AX, let's send them both

            # in worst case we don't get anything in return.

            $params += $this->axParams() + $this->sregParams();
        }

        if ($this->identifier_select) {
            $params['openid.identity'] = $params['openid.claimed_id']
                    = 'http://specs.openid.net/auth/2.0/identifier_select';
        } else {
            $params['openid.identity'] = $this->identity;
            $params['openid.claimed_id'] = $this->claimed_id;
        }

        return $this->build_url(parse_url($this->server)
                                , array('query' => http_build_query($params, '', '&')));
    }

    /**
     * Returns authentication url. Usually, you want to redirect your user to it.
     * @return String The authentication url.
     * @param String $select_identifier Whether to request OP to select identity for an user in OpenID 2. Does not affect OpenID 1.
/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}
     * @throws ErrorException
     */
    function authUrl($immediate = false)

    {
        if ($this->setup_url && !$immediate) {
            return $this->setup_url;
        }
        if (!$this->server) {
            $this->discover($this->identity);
        }

        if ($this->version == 2) {
            return $this->authUrl_v2($immediate);
        }
        return $this->authUrl_v1($immediate);
    }

    /**
     * Performs OpenID verification with the OP.
     * @return Bool Whether the verification was successful.
     * @throws ErrorException
     */
    function validate()

    {
        # If the request was using immediate mode, a failure may be reported

        # by presenting user_setup_url (for 1.1) or reporting

        # mode 'setup_needed' (for 2.0). Also catching all modes other than

        # id_res, in order to avoid throwing errors.

        if (isset($this->data['openid_user_setup_url'])) {
            $this->setup_url = $this->data['openid_user_setup_url'];
            return false;
        }
        if ($this->mode != 'id_res') {
<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}
            return false;
        }

        $this->claimed_id = isset($this->data['openid_claimed_id']) ? $this->data['openid_claimed_id'] : $this->data['openid_identity'];
        $params = array(
            'openid.assoc_handle' => $this->data['openid_assoc_handle'],
            'openid.signed'       => $this->data['openid_signed'],
            'openid.sig'          => $this->data['openid_sig'],
            );

        if (isset($this->data['openid_ns'])) {
            # We're dealing with an OpenID 2.0 server, so let's set an ns

            # Even though we should know location of the endpoint,

            # we still need to verify it by discovery, so $server is not set here

            $params['openid.ns'] = 'http://specs.openid.net/auth/2.0';
        } elseif (isset($this->data['openid_claimed_id'])
            && $this->data['openid_claimed_id'] != $this->data['openid_identity']
        ) {
            # If it's an OpenID 1 provider, and we've got claimed_id,

            # we have to append it to the returnUrl, like authUrl_v1 does.

            $this->returnUrl .= (strpos($this->returnUrl, '?') ? '&' : '?')
                                .  'openid.claimed_id=' . $this->claimed_id;
        }

        if ($this->data['openid_return_to'] != $this->returnUrl) {
            # The return_to url must match the url of current request.

            # I'm assuing that noone will set the returnUrl to something that doesn't make sense.

            return false;
        }

        $server = $this->discover($this->claimed_id);

        foreach (explode(',', $this->data['openid_signed']) as $item) {
            # Checking whether magic_quotes_gpc is turned on, because

            # the function may fail if it is. For example, when fetching

            # AX namePerson, it might containg an apostrophe, which will be escaped.

            # In such case, validation would fail, since we'd send different data than OP

            # wants to verify. stripslashes() should solve that problem, but we can't

            # use it when magic_quotes is off.

            $value = $this->data['openid_' . str_replace('.', '_', $item)];
            $params['openid.' . $item] = function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc() ? stripslashes($value) : $value;

        }

        $params['openid.mode'] = 'check_authentication';

        $response = $this->request($server, 'POST', $params);

        return preg_match('/is_valid\s*:\s*true/i', $response);
    }

    protected function getAxAttributes()
    {
        $alias = null;
        if (isset($this->data['openid_ns_ax'])
            && $this->data['openid_ns_ax'] != 'http://openid.net/srv/ax/1.0'
        ) { # It's the most likely case, so we'll check it before

            $alias = 'ax';
        } else {
            # 'ax' prefix is either undefined, or points to another extension,

            # so we search for another prefix

            foreach ($this->data as $key => $val) {
                if (substr($key, 0, strlen('openid_ns_')) == 'openid_ns_'
                    && $val == 'http://openid.net/srv/ax/1.0'
                ) {
                    $alias = substr($key, strlen('openid_ns_'));
                    break;
                }
            }
        }
        if (!$alias) {
''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
            # An alias for AX schema has not been found,

            # so there is no AX data in the OP's response

            return array();
        }

        $attributes = array();
        foreach (explode(',', $this->data['openid_signed']) as $key) {
            $keyMatch = $alias . '.value.';
            if (substr($key, 0, strlen($keyMatch)) != $keyMatch) {
                continue;
            }
            $key = substr($key, strlen($keyMatch));
            if (!isset($this->data['openid_' . $alias . '_type_' . $key])) {
                # OP is breaking the spec by returning a field without

                # associated ns. This shouldn't happen, but it's better

                # to check, than cause an E_NOTICE.

                continue;
            }
            $value = $this->data['openid_' . $alias . '_value_' . $key];
            $key = substr($this->data['openid_' . $alias . '_type_' . $key],
                            strlen('http://axschema.org/'));

            $attributes[$key] = $value;
        }
        return $attributes;
    }

    protected function getSregAttributes()
    {
        $attributes = array();
        $sreg_to_ax = array_flip(self::$ax_to_sreg);
        foreach (explode(',', $this->data['openid_signed']) as $key) {
            $keyMatch = 'sreg.';
            if (substr($key, 0, strlen($keyMatch)) != $keyMatch) {
                continue;
            }
            $key = substr($key, strlen($keyMatch));
            if (!isset($sreg_to_ax[$key])) {
                # The field name isn't part of the SREG spec, so we ignore it.

                continue;
            }
            $attributes[$sreg_to_ax[$key]] = $this->data['openid_sreg_' . $key];
        }
        return $attributes;
    }

    /**
     * Gets AX/SREG attributes provided by OP. should be used only after successful validaton.
     * Note that it does not guarantee that any of the required/optional parameters will be present,
     * or that there will be no other attributes besides those specified.
     * In other words. OP may provide whatever information it wants to.
     *     * SREG names will be mapped to AX names.
     *     * @return Array Array of attributes with keys being the AX schema names, e.g. 'contact/email'
     * @see http://www.axschema.org/types/
     */
    function getAttributes()

    {
        if (isset($this->data['openid_ns'])
            && $this->data['openid_ns'] == 'http://specs.openid.net/auth/2.0'
        ) { # OpenID 2.0

            # We search for both AX and SREG attributes, with AX taking precedence.

            return $this->getAxAttributes() + $this->getSregAttributes();
        }
        return $this->getSregAttributes();
    }
}



Issues (501)

Security Analysis not enabled

classes/openid.php (115 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Available Fixes

Available Fixes

1			<?php
2			/**
3			* This class provides a simple interface for OpenID (1.1 and 2.0) authentication.
4			* Supports Yadis discovery.
5			* The authentication process is stateless/dumb.
6			*
7			* Usage:
8			* Sign-on with OpenID is a two step process:
9			* Step one is authentication with the provider:
10			* <code>
11			* $openid = new LightOpenID('my-host.example.org');
12			* $openid->identity = 'ID supplied by user';
13			* header('Location: ' . $openid->authUrl());
14			* </code>
15			* The provider then sends various parameters via GET, one of them is openid_mode.
16			* Step two is verification:
17			* <code>
18			* $openid = new LightOpenID('my-host.example.org');
19			* if ($openid->mode) {
20			* echo $openid->validate() ? 'Logged in.' : 'Failed';
21			* }
22			* </code>
23			*
24			* Change the 'my-host.example.org' to your domain name. Do NOT use $_SERVER['HTTP_HOST']
25			* for that, unless you know what you are doing.
26			*
27			* Optionally, you can set $returnUrl and $realm (or $trustRoot, which is an alias).
28			* The default values for those are:
29			* $openid->realm = (!empty($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'];
30			* $openid->returnUrl = $openid->realm . $_SERVER['REQUEST_URI'];
31			* If you don't know their meaning, refer to any openid tutorial, or specification. Or just guess.
32			*
33			* AX and SREG extensions are supported.
34			* To use them, specify $openid->required and/or $openid->optional before calling $openid->authUrl().
35			* These are arrays, with values being AX schema paths (the 'path' part of the URL).
36			* For example:
37			* $openid->required = array('namePerson/friendly', 'contact/email');
38			* $openid->optional = array('namePerson/first');
39			* If the server supports only SREG or OpenID 1.1, these are automaticaly
40			* mapped to SREG names, so that user doesn't have to know anything about the server.

Cyberbyte-Studios / CyberWorks

Issues (501)

Security Analysis not enabled

classes/openid.php (115 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Available Fixes

Available Fixes

Duplication Side-by-Side

Filter issues like