summaryrefslogtreecommitdiffabout
path: root/lib/basic_op.cc
Side-by-side diff
Diffstat (limited to 'lib/basic_op.cc') (more/less context) (show whitespace changes)
-rw-r--r--lib/basic_op.cc6
1 files changed, 6 insertions, 0 deletions
diff --git a/lib/basic_op.cc b/lib/basic_op.cc
index fa659ac..511b51a 100644
--- a/lib/basic_op.cc
+++ b/lib/basic_op.cc
@@ -131,61 +131,67 @@ namespace opkele {
void basic_OP::checkid_(const basic_openid_message& inm,
extension_t *ext) {
reset_vars();
string modestr = inm.get_field("mode");
if(modestr=="checkid_setup")
mode = mode_checkid_setup;
else if(modestr=="checkid_immediate")
mode = mode_checkid_immediate;
else
throw bad_input(OPKELE_CP_ "Invalid checkid_* mode");
try {
assoc = retrieve_assoc(invalidate_handle=inm.get_field("assoc_handle"));
invalidate_handle.clear();
}catch(failed_lookup&) { }
try {
openid2 = (inm.get_field("ns")==OIURI_OPENID20);
}catch(failed_lookup&) { openid2 = false; }
try {
return_to = inm.get_field("return_to");
}catch(failed_lookup&) { }
if(openid2) {
try {
realm = inm.get_field("realm");
+ if(realm.empty())
+ throw failed_lookup(OPKELE_CP_ "Empty realm doesn't count");
}catch(failed_lookup&) {
try {
realm = inm.get_field("trust_root");
+ if(realm.empty())
+ throw failed_lookup(OPKELE_CP_ "Empty trust_root doesn't count");
}catch(failed_lookup&) {
if(return_to.empty())
throw bad_input(OPKELE_CP_
"Both realm and return_to are unset");
realm = return_to;
}
}
}else{
try {
realm = inm.get_field("trust_root");
+ if(realm.empty())
+ throw failed_lookup(OPKELE_CP_ "Empty trust_root doesn't count");
}catch(failed_lookup&) {
if(return_to.empty())
throw bad_input(OPKELE_CP_
"Both realm and return_to are unset");
realm = return_to;
}
}
try {
identity = inm.get_field("identity");
try {
claimed_id = inm.get_field("claimed_id");
}catch(failed_lookup&) {
if(openid2)
throw bad_input(OPKELE_CP_
"claimed_id and identity must be either both present or both absent");
claimed_id = identity;
}
}catch(failed_lookup&) {
if(openid2 && inm.has_field("claimed_id"))
throw bad_input(OPKELE_CP_
"claimed_id and identity must be either both present or both absent");
}
verify_return_to();
if(ext) ext->op_checkid_hook(inm);