authorize/index-functions.php ➔ getErrorStatusText()

Complexity

Conditions	18
Paths	40

Size

Total Lines

61

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
function getErrorStatusText($output, $clientparams)
{
    $errtxt = '';

    // CIL-575 Check the $output for a "status=..." line and convert
    // the error number to an error message defined in CILogon\Service\Util.
    if (preg_match('/status=(\d+)/', $output, $matches)) {
        $errnum = $matches[1];
        $errstr = array_search($errnum, DBService::$STATUS);
        $errtxt = @DBService::$STATUS_TEXT[$errstr];
    }

    // CIL-831 The OA4MP code returns a STATUS_INTERNAL_ERROR when there is
    // weirdness in the incoming client parameters. Look for some special
    // error conditions and set the error text appropriately.
    if ($errstr == 'STATUS_INTERNAL_ERROR') {

The variable $errstr does not seem to be defined for all execution paths leading up to this point.

        $params = [
            'redirect_uri',
            'scope',
            'response_type',
            'client_id',
            'prompt',
            'response_mode',
        ];
        foreach ($params as $value) {
            $$value = @$clientparams[$value];
        }

        if (empty($scope)) {

The variable $scope seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

            $errtxt = "Missing or empty 'scope' parameter.";
        } elseif (empty($client_id)) {

The variable $client_id seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

            $errtxt = "Missing or empty 'client_id' parameter.";
        } elseif (empty($response_type)) {

The variable $response_type seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

            $errtxt = "Missing or empty 'response_type' parameter.";
        } elseif (preg_match('/[\+%"\']/', $scope)) {
            $errtxt = "Invalid characters found in 'scope' parameter, may be URL encoded twice.";
        } elseif (preg_match('/[A-Z]/', $scope)) {
            $errtxt = "Upper case characters found in 'scope' parameter.";
        } elseif ($response_type != 'code') {
            $errtxt = "Unsupported 'response_type' parameter. Only 'code' is supported.";
        } elseif ((!empty($prompt)) && ($prompt != 'login') && ($prompt != 'select_account')) {

The variable $prompt seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

            $errtxt = "Unsupported 'prompt' parameter. Only 'login' and 'select_account' are supported.";
        } elseif (
            (!empty($response_mode)) &&

The variable $response_mode seems to never exist, and therefore empty should always return true. Did you maybe rename this variable?

            ($response_mode != 'query') &&
            ($response_mode != 'fragment') &&
            ($response_mode != 'form_post')
        ) {
            $errtxt = "Unsupported 'response_mode' parameter.";
        }
    }

    // CIL-697 The OA4MP code should eventually return an
    // "error_description=..." field that can give detailed error text to
    // replace the default text associated with STATUS_INTERNAL_ERROR.
    if (preg_match('/error_description=([^\r\n]+)/', $output, $matches)) {
        $errtxt = $matches[1];
    }

    return $errtxt;
}