authorize/index-functions.php ➔ getErrorStatusText()

Complexity

Conditions	23
Paths	38

Size

Total Lines

74

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
function getErrorStatusText($output, $clientparams)
{
    $errstr = '';
    $errtxt = '';

    // CIL-575 Check the $output for a "status=..." line and convert
    // the error number to an error message defined in CILogon\Service\Util.
    if (preg_match('/status=(\d+)/', $output, $matches)) {
        $errnum = $matches[1];
        $errstr = array_search($errnum, DBService::$STATUS);
        $errtxt = @DBService::$STATUS_TEXT[$errstr];
    }

    // CIL-831 The OA4MP code returns a STATUS_INTERNAL_ERROR when there is
    // weirdness in the incoming client parameters. Look for some special
    // error conditions and set the error text appropriately.
    if (
        (strlen($errstr) == 0) ||
        ($errstr == 'STATUS_INTERNAL_ERROR') ||
        ($errstr == 'STATUS_CREATE_TRANSACTION_FAILED') ||
        ($errstr == 'STATUS_MISSING_PARAMETER_ERROR')
    ) {
        $params = [
            'redirect_uri',
            'scope',
            'response_type',
            'client_id',
            'prompt',
            'response_mode',
        ];
        foreach ($params as $value) {
            $$value = @$clientparams[$value];
        }

        if (empty($scope)) {

The variable $scope seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

            $errtxt = "Missing or empty scope parameter.";
        } elseif (empty($client_id)) {

The variable $client_id seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

            $errtxt = "Missing or empty client_id parameter.";
        } elseif (empty($response_type)) {

The variable $response_type seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

            $errtxt = "Missing or empty response_type parameter.";
        } elseif (preg_match('/[\+%"\']/', $scope)) {
            $errtxt = "Invalid characters found in scope parameter, may be URL encoded twice.";
        } elseif (preg_match('/[A-Z]/', $scope)) {
            $errtxt = "Upper case characters found in scope parameter.";
        } elseif ($response_type != 'code') {
            $errtxt = "Unsupported response_type parameter. Only code is supported.";
        } elseif ((!empty($prompt)) && ($prompt != 'login') && ($prompt != 'select_account')) {

The variable $prompt seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

            $errtxt = "Unsupported prompt parameter. Only login and select_account are supported.";
        } elseif (
            (!empty($response_mode)) &&

The variable $response_mode seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

            ($response_mode != 'query') &&
            ($response_mode != 'fragment') &&
            ($response_mode != 'form_post')
        ) {
            $errtxt = "Unsupported response_mode parameter.";
        }

        // CIL-697 The OA4MP code should eventually return an
        // "error_description=..." field that can give detailed error text to
        // replace the default text associated with STATUS_INTERNAL_ERROR.
        // CIL-909 Use the error_description field only if $errtxt is still
        // empty, OR if the $errstr was STATUS_CREATE_TRANSACTION_FAILED
        // (i.e., "Failed to initialize OIDC flow.").
        if (
            ((strlen($errtxt) == 0) ||
             ($errstr == 'STATUS_CREATE_TRANSACTION_FAILED')) &&
            (preg_match('/error_description=([^\r\n]+)/', $output, $matches))
        ) {
            $errtxt = urldecode($matches[1]);
        }
    }

    return $errtxt;
}