SAML2:SSOService - Remove "magic" quotes from parameters.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@115 44740490-163a-0410-bde0-09ae8108e29a

lib/SimpleSAML/Bindings/SAML20/HTTPRedirect.php

@@ -95,7 +95,24 @@ class SimpleSAML_Bindings_SAML20_HTTPRedirect {
 			throw new Exception('SAMLRequest parameter not set in paramter (on SAML 2.0 HTTP Redirect binding endpoint)');
 		}
 		$rawRequest = 	$get["SAMLRequest"];
-		$relaystate = isset($get["RelayState"]) ? $get["RelayState"] : null;
+		/* We don't need to remove any magic quotes from the
+		 * SAMLRequest parameter since this parameter is guaranteed
+		 * to be base64-encoded.
+		 */
+
+		/* Check if the service provider has included a RelayState
+		 * parameter with the request. This parameter should be
+		 * included in the response to the SP after authentication.
+		 */
+		if(array_key_exists('RelayState', $get)) {
+			$relaystate = $get['RelayState'];
+			/* Remove any magic quotes that php may have added. */
+			if(get_magic_quotes_gpc()) {
+				$relaystate = stripslashes($relaystate);
+			}
+		} else {
+			$relaystate = NULL;
+		}
 		
 		$samlRequestXML = gzinflate(base64_decode( $rawRequest ));
          

www/saml2/idp/SSOService.php

@@ -63,6 +63,11 @@ if (isset($_GET['SAMLRequest'])) {
 	try {
 
 		$requestid = $_GET['RequestID'];
+		/* Remove any "magic" quotes that php may have added. */
+		if(get_magic_quotes_gpc()) {
+			$requestid = stripslashes($requestid);
+		}
+
 		$session = SimpleSAML_Session::getInstance();
 		$authnrequest = $session->getAuthnRequest($requestid);