authorize/index-functions.php ➔ printOIDCConsent()

Complexity

Conditions	10
Paths	128

Size

Total Lines

71

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
 * return, we read the database to get the OIDC client information
 * to display to the user. All client parameters (including the ones
 * passed in) are saved to the 'clientparams' PHP session variable,
 * which is encoded as a JSON token to preserve arrays. If there are
 * any errors, false is returned and an email is sent. In some cases
 * the session variable 'client_error_msg' is set so it can be
 * displayed by the printOIDCErrorPage() function.
 *
 * @return bool True if the various parameters related to the OIDC
 *         session are present. False otherwise.
 */
function verifyOIDCParams()
{
    $retval = false; // Assume OIDC session info is not valid

    // Combine the $_GET and $_POST arrays into a single array which can be
    // stored in the 'clientparams' session variable as a JSON object.
    $clientparams = array();
    foreach ($_GET as $key => $value) {
        $clientparams[$key] = $value;
    }
    foreach ($_POST as $key => $value) {
        $clientparams[$key] = $value;
    }

    // CIL-624 If X509 certs are disabled, check for 'getcert' scope.
    // If found, show an error message.
    $scope = Util::getGetVar('scope');
    if (
        (defined('DISABLE_X509')) &&
        (DISABLE_X509 === true) &&
        (preg_match('/edu.uiuc.ncsa.myproxy.getcert/', $scope))
    ) {
        Util::sendErrorAlert(
            'CILogon OIDC authz endpoint error',
            'The CILogon OIDC authorization endpoint received a request ' .
            'including the "edu.ncsa.uiuc.myproxy.getcert" scope, ' .
            'but the server is configured with DISABLE_X509 to prevent ' .
            'downloading certificates. ' .
            "\n\n" .
            'clientparams = ' . print_r($clientparams, true) .
            "\n"
        );
        Util::setSessionVar(
            'client_error_msg',
            'The CILogon Service is currently configured to prevent ' .
            'downloading X.509 certificates, but the incoming request ' .
            'included the "edu.ncsa.uiuc.myproxy.getcert" scope. ' .
            'CILogon system administrators have been notified.'
        );
        $clientparams = array();

    // If the 'redirect_uri' parameter was passed in then let the 'real'
    // OA4MP OIDC authz endpoint handle parse the request since it might be
    // possible to return an error code to the client.
    } elseif (isset($clientparams['redirect_uri'])) {
        $ch = curl_init();
        if ($ch !== false) {
            $url = OAUTH2_CREATE_TRANSACTION_URL;
            if (count($_GET) > 0) {
                // CIL-658 Look for double-encoded spaces in 'scope'
                if (strlen($scope) > 0) {
                    $_GET['scope'] = preg_replace('/(\+|%2B)/', ' ', $scope);
                }
                $url .= (preg_match('/\?/', $url) ? '&' : '?') .
                    http_build_query($_GET);
            }
            if (count($_POST) > 0) {
                curl_setopt($ch, CURLOPT_POST, true);
                curl_setopt($ch, CUROPT_POSTFIELDS, http_build_query($_POST));
            }
            curl_setopt($ch, CURLOPT_URL, $url);