saml: Verify destination of logout messages to SP.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2505 44740490-163a-0410-bde0-09ae8108e29a

modules/saml/www/sp/saml2-logout.php

@@ -37,6 +37,11 @@ $spMetadata = $source->getMetadata();
 
 sspmod_saml_Message::validateMessage($idpMetadata, $spMetadata, $message);
 
+$destination = $message->getDestination();
+if ($destination !== NULL && $destination !== SimpleSAML_Utilities::selfURLNoQuery()) {
+	throw new SimpleSAML_Error_Exception('Destination in logout message is wrong.');
+}
+
 if ($message instanceof SAML2_LogoutResponse) {
 
 	$relayState = $message->getRelayState();