empty trust_root is no trust root.

work around some thoughtful and considerate RPs that take the pain of sending
the trust_root parameter, but do not go into as much trouble as setting it to
anything but an empty string.

Signed-off-by: Michael Krelin <hacker@klever.net>

1 files changed, 6 insertions, 0 deletions

diff --git a/lib/basic_op.cc b/lib/basic_op.cc
index fa659ac..511b51a 100644
--- a/lib/basic_op.cc
+++ b/lib/basic_op.cc
@@ -139,45 +139,51 @@ namespace opkele {
             mode = mode_checkid_immediate;
         else
             throw bad_input(OPKELE_CP_ "Invalid checkid_* mode");
         try {
             assoc = retrieve_assoc(invalidate_handle=inm.get_field("assoc_handle"));
             invalidate_handle.clear();
         }catch(failed_lookup&) { }
         try {
             openid2 = (inm.get_field("ns")==OIURI_OPENID20);
         }catch(failed_lookup&) { openid2 = false; }
         try {
             return_to = inm.get_field("return_to");
         }catch(failed_lookup&) { }
         if(openid2) {
             try {
                 realm = inm.get_field("realm");
+                if(realm.empty())
+                    throw failed_lookup(OPKELE_CP_ "Empty realm doesn't count");
             }catch(failed_lookup&) {
                 try {
                     realm = inm.get_field("trust_root");
+                    if(realm.empty())
+                        throw failed_lookup(OPKELE_CP_ "Empty trust_root doesn't count");
                 }catch(failed_lookup&) {
                     if(return_to.empty())
                         throw bad_input(OPKELE_CP_
                                 "Both realm and return_to are unset");
                     realm = return_to;
                 }
             }
         }else{
             try {
                 realm = inm.get_field("trust_root");
+                if(realm.empty())
+                    throw failed_lookup(OPKELE_CP_ "Empty trust_root doesn't count");
             }catch(failed_lookup&) {
                 if(return_to.empty())
                     throw bad_input(OPKELE_CP_
                             "Both realm and return_to are unset");
                 realm = return_to;
             }
         }
         try {
             identity = inm.get_field("identity");
             try {
                 claimed_id = inm.get_field("claimed_id");
             }catch(failed_lookup&) {
                 if(openid2)
                     throw bad_input(OPKELE_CP_
                             "claimed_id and identity must be either both present or both absent");
                 claimed_id = identity;