diff options
| -rwxr-xr-x | auth.cgi | 2 | ||||
| -rw-r--r-- | template/en/default/global/user-error.html.tmpl | 5 |
2 files changed, 7 insertions, 0 deletions
@@ -40,6 +40,8 @@ trick_taint($callback); trick_taint($description); my $callback_uri = URI->new($callback); +$callback_uri->scheme =~ /^https?$/ + or ThrowUserError('auth_delegation_illegal_protocol', { protocol => $callback_uri->scheme }); my $callback_base = $callback_uri->clone; $callback_base->query(undef); diff --git a/template/en/default/global/user-error.html.tmpl b/template/en/default/global/user-error.html.tmpl index 998aed4fe..8c0cc8b7a 100644 --- a/template/en/default/global/user-error.html.tmpl +++ b/template/en/default/global/user-error.html.tmpl @@ -122,6 +122,11 @@ This site does not have auth delegation enabled. Please contact an administrator if you require this functionality. + [% ELSIF error == "auth_delegation_illegal_protocol" %] + [% title = "Invalid Protocol" %] + The callback URI uses an illegal protocol: <em>[% protocol FILTER html %]</em>. + Only <em>http</em> and <em>https</em> are allowed. + [% ELSIF error == "auth_delegation_missing_callback" %] [% title = "Auth delegation impossible without callback URI" %] It looks like auth delegation was attempted, but no callback URI was passed. |