cilogon /
service
| Conditions | 48 |
| Paths | 1272 |
| Total Lines | 360 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
| 1 | <?php |
||
| 374 | function verifyOIDCParams() |
||
| 375 | { |
||
| 376 | $retval = false; // Assume OIDC session info is not valid |
||
| 377 | |||
| 378 | // Combine the $_GET and $_POST arrays into a single array which can be |
||
| 379 | // stored in the 'clientparams' session variable as a JSON object. |
||
| 380 | $clientparams = array(); |
||
| 381 | foreach ($_GET as $key => $value) { |
||
| 382 | $clientparams[$key] = $value; |
||
| 383 | } |
||
| 384 | foreach ($_POST as $key => $value) { |
||
| 385 | $clientparams[$key] = $value; |
||
| 386 | } |
||
| 387 | |||
| 388 | // If the 'redirect_uri' parameter was passed in then let the 'real' |
||
| 389 | // OA4MP OIDC authz endpoint handle parse the request since it might be |
||
| 390 | // possible to return an error code to the client. |
||
| 391 | if (isset($clientparams['redirect_uri'])) { |
||
| 392 | $ch = curl_init(); |
||
| 393 | if ($ch !== false) { |
||
| 394 | $url = AUTHORIZE_URL; |
||
| 395 | if (count($_GET) > 0) { |
||
| 396 | $url .= (preg_match('/\?/', AUTHORIZE_URL) ? '&' : '?') . |
||
| 397 | http_build_query($_GET); |
||
| 398 | } |
||
| 399 | if (count($_POST) > 0) { |
||
| 400 | curl_setopt($ch, CURLOPT_POST, true); |
||
| 401 | curl_setopt($ch, CUROPT_POSTFIELDS, http_build_query($_POST)); |
||
| 402 | } |
||
| 403 | curl_setopt($ch, CURLOPT_URL, $url); |
||
| 404 | curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); |
||
| 405 | curl_setopt($ch, CURLOPT_TIMEOUT, 30); |
||
| 406 | curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false); // Catch redirects |
||
| 407 | $output = curl_exec($ch); |
||
| 408 | if (curl_errno($ch)) { // Send alert on curl errors |
||
| 409 | Util::sendErrorAlert( |
||
| 410 | 'cUrl Error', |
||
| 411 | 'cUrl Error = ' . curl_error($ch) . "\n" . |
||
| 412 | "URL Accessed = $url" . |
||
| 413 | "\n\n" . |
||
| 414 | 'clientparams = ' . print_r($clientparams, true) |
||
| 415 | ); |
||
| 416 | $clientparams = array(); |
||
| 417 | } else { |
||
| 418 | $info = curl_getinfo($ch); |
||
| 419 | if ($info !== false) { |
||
| 420 | if ( |
||
| 421 | (isset($info['http_code'])) && |
||
| 422 | ($info['http_code'] == 200) |
||
| 423 | ) { |
||
| 424 | // The OA4MP OIDC authz endpoint responded with 200 |
||
| 425 | // (success). The body of the message should be a |
||
| 426 | // JSON token containing the appropriate parameters |
||
| 427 | // such as the 'code'. |
||
| 428 | $json = json_decode($output, true); |
||
| 429 | if (isset($json['code'])) { |
||
| 430 | // Got 'code' - save to session and call |
||
| 431 | // dbService 'getClient' to get info about |
||
| 432 | // OIDC client to display to user |
||
| 433 | $clientparams['redirect_url'] = |
||
| 434 | $clientparams['redirect_uri'] . |
||
| 435 | (preg_match('/\?/', $clientparams['redirect_uri']) ? '&' : '?') . |
||
| 436 | http_build_query($json); |
||
| 437 | $clientparams['code'] = $json['code']; |
||
| 438 | $dbs = new DBService(); |
||
| 439 | if ( |
||
| 440 | ($dbs->getClient( |
||
| 441 | $clientparams['client_id'] |
||
| 442 | )) && (!($dbs->status & 1)) |
||
| 443 | ) { |
||
| 444 | // STATUS_OK is even |
||
| 445 | $status = $dbs->status; |
||
| 446 | $clientparams['clientstatus'] = $status; |
||
| 447 | // STATUS_OK* codes are even-numbered |
||
| 448 | if (!($status & 1)) { |
||
| 449 | $clientparams['client_name'] = |
||
| 450 | $dbs->client_name; |
||
| 451 | $clientparams['client_home_uri'] = |
||
| 452 | $dbs->client_home_uri; |
||
| 453 | $clientparams['client_callback_uris'] = |
||
| 454 | $dbs->client_callback_uris; |
||
| 455 | } else { // dbservice error |
||
| 456 | $errstr = 'Unknown error.'; |
||
| 457 | if (!is_null($dbs->status)) { |
||
| 458 | $errstr = array_search( |
||
| 459 | $dbs->status, |
||
| 460 | DBService::$STATUS |
||
| 461 | ); |
||
| 462 | } |
||
| 463 | Util::sendErrorAlert( |
||
| 464 | 'dbService Error', |
||
| 465 | 'Error calling dbservice ' . |
||
| 466 | 'action "getClient" in ' . |
||
| 467 | 'verifyOIDCParams() method. ' . |
||
| 468 | $errstr |
||
| 469 | ); |
||
| 470 | $clientparams = array(); |
||
| 471 | } |
||
| 472 | } else { |
||
| 473 | Util::sendErrorAlert( |
||
| 474 | 'dbService Error', |
||
| 475 | 'Error calling dbservice ' . |
||
| 476 | 'action "getClient" in ' . |
||
| 477 | 'verifyOIDCParams() method.' |
||
| 478 | ); |
||
| 479 | $clientparams = array(); |
||
| 480 | } |
||
| 481 | } else { |
||
| 482 | // Either the output returned was not a valid |
||
| 483 | // JSON token, or there was no 'code' found in |
||
| 484 | // the returned JSON token. |
||
| 485 | // CIL-575 Check for a "status=..." line in the |
||
| 486 | // returned $output to print a useful error |
||
| 487 | // message to the user (and in the error email). |
||
| 488 | $errortxt = ''; |
||
| 489 | if ( |
||
| 490 | preg_match( |
||
| 491 | '/status=(\d+)/', |
||
| 492 | $output, |
||
| 493 | $matches |
||
| 494 | ) |
||
| 495 | ) { |
||
| 496 | $errornum = $matches[1]; |
||
| 497 | $errstr = array_search( |
||
| 498 | $errornum, |
||
| 499 | DBService::$STATUS |
||
| 500 | ); |
||
| 501 | $errortxt = @DBService::$STATUS_TEXT[$errstr]; |
||
| 502 | } |
||
| 503 | |||
| 504 | Util::sendErrorAlert( |
||
| 505 | 'OA4MP OIDC authz endpoint error', |
||
| 506 | (!empty($errortxt) ? $errortxt : |
||
| 507 | 'The OA4MP OIDC authorization endpoint ' . |
||
| 508 | 'returned an HTTP response 200, but either ' . |
||
| 509 | 'the output was not a valid JSON token, or ' . |
||
| 510 | 'there was no "code" in the JSON token. ' . |
||
| 511 | ((strlen($output) > 0) ? |
||
| 512 | "\n\nReturned output =\n$output" : '')) . |
||
| 513 | "\n\n" . |
||
| 514 | 'curl_getinfo = ' . print_r($info, true) . "\n\n" . |
||
| 515 | 'clientparams = ' . print_r($clientparams, true) . |
||
| 516 | "\n" |
||
| 517 | ); |
||
| 518 | Util::setSessionVar( |
||
| 519 | 'client_error_msg', |
||
| 520 | 'There was an unrecoverable error during the transaction. ' . |
||
| 521 | 'CILogon system administrators have been notified. ' . |
||
| 522 | (!empty($errortxt) ? "<p><b>Error message: $errortxt</b><p>" : '') |
||
| 523 | ); |
||
| 524 | $clientparams = array(); |
||
| 525 | } |
||
| 526 | } elseif ( |
||
| 527 | (isset($info['http_code'])) && |
||
| 528 | ($info['http_code'] == 302) |
||
| 529 | ) { |
||
| 530 | // The OA4MP OIDC authz endpoint responded with 302 |
||
| 531 | // (redirect) which indicates an OIDC error was |
||
| 532 | // detected. We need to check the response for an |
||
| 533 | // 'error' and simply redirect error to OIDC client. |
||
| 534 | $redirect_url = ''; |
||
| 535 | if (isset($info['redirect_url'])) { |
||
| 536 | $redirect_url = $info['redirect_url']; |
||
| 537 | $clientparmas['redirect_url'] = $redirect_url; |
||
| 538 | // CIL-407 - In case of two question marks '?' |
||
| 539 | // in redirect_url (caused by OIDC authz endpoint |
||
| 540 | // blindly appending "?error=..."), change all |
||
| 541 | // but the first '?' to '&'. |
||
| 542 | // https://stackoverflow.com/a/37150213 |
||
| 543 | if (substr_count($redirect_url, '?') > 1) { |
||
| 544 | $arr = explode('?', $redirect_url, 2); |
||
| 545 | $arr[1] = str_replace('?', '&', $arr[1]); |
||
| 546 | $redirect_url = implode('?', $arr); |
||
| 547 | } |
||
| 548 | } |
||
| 549 | // Get components of redirect_url - need 'query' |
||
| 550 | $comps = parse_url($redirect_url); |
||
| 551 | if ($comps !== false) { |
||
| 552 | // Look for 'error' in query |
||
| 553 | $query = ''; |
||
| 554 | if (isset($comps['query'])) { |
||
| 555 | $query = $comps['query']; |
||
| 556 | $query = html_entity_decode($query); |
||
| 557 | } |
||
| 558 | $queries = explode('&', $query); |
||
| 559 | $params = array(); |
||
| 560 | foreach ($queries as $value) { |
||
| 561 | $x = explode('=', $value); |
||
| 562 | $params[$x[0]] = $x[1]; |
||
| 563 | } |
||
| 564 | if (isset($params['error'])) { |
||
| 565 | // Got 'error' - simply return to OIDC client |
||
| 566 | $clientparams = array(); |
||
| 567 | Util::unsetAllUserSessionVars(); |
||
| 568 | header("Location: $redirect_url"); |
||
| 569 | exit; // No further processing necessary |
||
| 570 | } else { // Weird params - Should never get here! |
||
| 571 | Util::sendErrorAlert( |
||
| 572 | 'OA4MP OIDC 302 Error', |
||
| 573 | 'The OA4MP OIDC authz endpoint ' . |
||
| 574 | 'returned a 302 redirect (error) ' . |
||
| 575 | 'response, but there was no "error" ' . |
||
| 576 | "query parameter.\n\n" . |
||
| 577 | "redirect_url = $redirect_url\n\n" . |
||
| 578 | 'clientparams = ' . |
||
| 579 | print_r($clientparams, true) . |
||
| 580 | "\n" |
||
| 581 | ); |
||
| 582 | $clientparams = array(); |
||
| 583 | } |
||
| 584 | } else { // parse_url($redirect_url) gave error |
||
| 585 | Util::sendErrorAlert( |
||
| 586 | 'parse_url(redirect_url) error', |
||
| 587 | 'There was an error when attempting to ' . |
||
| 588 | 'parse the redirect_url. This should never ' . |
||
| 589 | "happen.\n\n" . |
||
| 590 | "redirect_url = $redirect_url\n\n" . |
||
| 591 | 'clientparams = ' . print_r($clientparams, true) . |
||
| 592 | "\n" |
||
| 593 | ); |
||
| 594 | $clientparams = array(); |
||
| 595 | } |
||
| 596 | } else { |
||
| 597 | // An HTTP return code other than 200 (success) or |
||
| 598 | // 302 (redirect) means that the OA4MP OIDC authz |
||
| 599 | // endpoint tried to handle an unrecoverable error, |
||
| 600 | // possibly by outputting HTML. If so, then we |
||
| 601 | // ignore it and output our own error message to the |
||
| 602 | // user. |
||
| 603 | Util::sendErrorAlert( |
||
| 604 | 'OA4MP OIDC authz endpoint error', |
||
| 605 | 'The OA4MP OIDC authorization endpoint returned ' . |
||
| 606 | 'an HTTP response other than 200 or 302. ' . |
||
| 607 | ((strlen($output) > 0) ? |
||
| 608 | "\n\nReturned output =\n$output" : '') . |
||
| 609 | "\n\n" . |
||
| 610 | 'curl_getinfo = ' . print_r($info, true) . "\n\n" . |
||
| 611 | 'clientparams = ' . print_r($clientparams, true) . |
||
| 612 | "\n" |
||
| 613 | ); |
||
| 614 | // CIL-423 Better end-user error output for errors. |
||
| 615 | // Scan output for ServletException message. |
||
| 616 | $errstr = ''; |
||
| 617 | if ( |
||
| 618 | preg_match( |
||
| 619 | '/javax.servlet.ServletException:\s?(.*)/', |
||
| 620 | $output, |
||
| 621 | $matches |
||
| 622 | ) |
||
| 623 | ) { |
||
| 624 | $output = ''; |
||
| 625 | $errstr = ' |
||
| 626 | <div> |
||
| 627 | <p>Error Message: <b>' . |
||
| 628 | $matches[1] . '</b>.</p> |
||
| 629 | <ul> |
||
| 630 | <li>Did you <b>register</b> your OAuth2/OIDC client? If not, go |
||
| 631 | <b><a target="_blank" href="https://' . |
||
| 632 | Util::getHN() |
||
| 633 | . '/oauth2/register">here</a></b> to do so.</li> |
||
| 634 | <li>Did you receive confirmation that your OAuth2/OIDC client |
||
| 635 | was <b>approved</b>? If not, please wait up to 48 hours for an |
||
| 636 | approval email from CILogon administrators.</li> |
||
| 637 | <li>Did you configure your OAuth2/OIDC client with the |
||
| 638 | registered <b>client ID and secret</b>?</li> |
||
| 639 | </ul> |
||
| 640 | </div>'; |
||
| 641 | } |
||
| 642 | Util::setSessionVar( |
||
| 643 | 'client_error_msg', |
||
| 644 | 'There was an unrecoverable error during the transaction. ' . |
||
| 645 | 'CILogon system administrators have been notified.' . |
||
| 646 | ((strlen($errstr) > 0) ? $errstr : '') . |
||
| 647 | ((strlen($output) > 0) ? |
||
| 648 | '<br/><pre>' . |
||
| 649 | preg_replace('/\+/', ' ', $output) . |
||
| 650 | '</pre>' : '') |
||
| 651 | ); |
||
| 652 | $clientparams = array(); |
||
| 653 | } |
||
| 654 | } else { // curl_getinfo() returned false - should not happen |
||
| 655 | Util::sendErrorAlert( |
||
| 656 | 'curl_getinfo error', |
||
| 657 | 'When attempting to talk to the OA4MP OIDC ' . |
||
| 658 | 'authorization endpoint, curl_getinfo() returned ' . |
||
| 659 | "false. This should never happen.\n\n" . |
||
| 660 | 'clientparams = ' . print_r($clientparams, true) . "\n" |
||
| 661 | ); |
||
| 662 | $clientparams = array(); |
||
| 663 | } |
||
| 664 | } |
||
| 665 | curl_close($ch); |
||
| 666 | } else { // curl_init() returned false - should not happen |
||
| 667 | Util::sendErrorAlert( |
||
| 668 | 'curl_init error', |
||
| 669 | 'When attempting to talk to the OA4MP OIDC authorization ' . |
||
| 670 | 'endpoint, curl_init() returned false. This should never ' . |
||
| 671 | "happen.\n\n" . |
||
| 672 | 'clientparams = ' . print_r($clientparams, true) . "\n" |
||
| 673 | ); |
||
| 674 | $clientparams = array(); |
||
| 675 | } |
||
| 676 | |||
| 677 | // If redirect_uri was not passed in, but one of the other required OIDC |
||
| 678 | // parameters WAS passed in, then assume that this was an attempt by an |
||
| 679 | // OIDC client to use the authz endpoint, and display an error message |
||
| 680 | // that at least one parameter (redirect_uri) was missing from the |
||
| 681 | // request. Note that since we don't have a redirect_uri, we cannot |
||
| 682 | // return code flow back to the OIDC client. |
||
| 683 | } elseif ( |
||
| 684 | (isset($clientparams['scope'])) || |
||
| 685 | (isset($clientparams['response_type'])) || |
||
| 686 | (isset($clientparams['client_id'])) |
||
| 687 | ) { |
||
| 688 | Util::sendErrorAlert( |
||
| 689 | 'CILogon OIDC authz endpoint error', |
||
| 690 | 'The CILogon OIDC authorization endpoint received a request ' . |
||
| 691 | 'from an OIDC client, but at least one of the required ' . |
||
| 692 | 'parameters (redirect_uri) was missing. ' . |
||
| 693 | "\n\n" . |
||
| 694 | 'clientparams = ' . print_r($clientparams, true) . |
||
| 695 | "\n" |
||
| 696 | ); |
||
| 697 | Util::setSessionVar( |
||
| 698 | 'client_error_msg', |
||
| 699 | 'It appears that an OpenID Connect client attempted to ' . |
||
| 700 | 'initiate a session with the CILogon Service, but at least ' . |
||
| 701 | 'one of the requried parameters was missing. CILogon ' . |
||
| 702 | 'system administrators have been notified.' |
||
| 703 | ); |
||
| 704 | $clientparams = array(); |
||
| 705 | |||
| 706 | // If none of the required OIDC authz endpoint parameters were passed |
||
| 707 | // in, then this might be a later step in the authz process. So check |
||
| 708 | // the session variable array 'clientparams' for the required |
||
| 709 | // information. |
||
| 710 | } else { |
||
| 711 | $clientparams = json_decode(Util::getSessionVar('clientparams'), true); |
||
| 712 | } |
||
| 713 | |||
| 714 | // Now check to verify all variables have data |
||
| 715 | if ( |
||
| 716 | (isset($clientparams['redirect_uri'])) && |
||
| 717 | (isset($clientparams['scope'])) && |
||
| 718 | (isset($clientparams['response_type'])) && |
||
| 719 | (isset($clientparams['client_id'])) && |
||
| 720 | (isset($clientparams['code'])) && |
||
| 721 | (isset($clientparams['client_name'])) && |
||
| 722 | (isset($clientparams['client_home_uri'])) && |
||
| 723 | (isset($clientparams['client_callback_uris'])) && |
||
| 724 | (isset($clientparams['redirect_url'])) && |
||
| 725 | (isset($clientparams['clientstatus'])) && |
||
| 726 | (!($clientparams['clientstatus'] & 1)) |
||
| 727 | ) { // STATUS_OK* are even |
||
| 728 | $retval = true; |
||
| 729 | Util::setSessionVar('clientparams', json_encode($clientparams)); |
||
| 730 | } |
||
| 731 | |||
| 732 | return $retval; |
||
| 733 | } |
||
| 734 |
Loading history...
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVarassignment in line 1 and the$higherassignment in line 2 are dead. The first because$myVaris never used and the second because$higheris always overwritten for every possible time line.