Merge pull request #266 from dialogik/patch-1

Set trusted.url.domains default to array()

config-templates/config.php

@@ -834,6 +834,6 @@ $config = array(
      * Example:
      *   'trusted.url.domains' => array('sp.example.com', 'app.example.com'),
      */
-    'trusted.url.domains' => null,
+    'trusted.url.domains' => array(),
 
 );

docs/simplesamlphp-upgrade-notes-1.14.txt

@@ -179,3 +179,5 @@ The following modules will no longer be shipped with the next version of SimpleS
     * `openidProvider`
     * `saml2debug`
     * `themefeidernd`
+
+The default value for trusted.url.domains in the config template has been changed from NULL to an empty array(), this sets a higher grade of default security. Resetting to NULL will re-allow untrusted routing.