git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2460 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2446 44740490-163a-0410-bde0-09ae8108e29a

If someone is able to perform a session fixation attack on the
openidProvider host, he can then make users execute scripts in that
domain.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2445 44740490-163a-0410-bde0-09ae8108e29a

Can be exploited by a malicious openid provider to execute scripts
on the host using openid.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2444 44740490-163a-0410-bde0-09ae8108e29a

Failure to escape the user id can be exploited by a malicious IdP
to run scripts in the domain of the oauth host. There is also a
failure to escape data in from the OAuth registry.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2443 44740490-163a-0410-bde0-09ae8108e29a

metaedit fails to validate the userid. If a malicious user is able to
make another user log in as that user id, he will be able to run scripts
in the domain of the site.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2442 44740490-163a-0410-bde0-09ae8108e29a

Can be exploited if the site is configured to fetch metadata from an
untrusted source.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2441 44740490-163a-0410-bde0-09ae8108e29a

Can be exploited if the site is configured to fetch metadata from an
untrusted source.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2440 44740490-163a-0410-bde0-09ae8108e29a

Can be exploited if the site is configured to fetch metadata from an
untrusted source.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2439 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2438 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2437 44740490-163a-0410-bde0-09ae8108e29a

Fixes a potential cross-site scripting vulnerability on the error page.
Fortuitously, a different bug prevents us from ever reaching this page,
so this bug cannot be exploited.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2436 44740490-163a-0410-bde0-09ae8108e29a

If the InfoCard module is enabled, it can be used to perform cross-site
scripting attacks on the site where it is installed.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2435 44740490-163a-0410-bde0-09ae8108e29a

If simpleSAMLphp is configured with a attribute hook that creates
attribute values containing associative arrays, and is displaying
attributes from an untrusted IdP, it can lead to cross-site scripting.

(Note that the feature allowing for attribute values with associative
arrays is believed to be unused, and will be removed in a future
release.)

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2434 44740490-163a-0410-bde0-09ae8108e29a

Two possibilities:
- Users attributes from an untrusted source.
- Metadata from an untrusted source.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2433 44740490-163a-0410-bde0-09ae8108e29a

If the users email-address comes from an untrusted source, it can be
used to inject arbitrary HTML into the error pages.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2432 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2431 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2430 44740490-163a-0410-bde0-09ae8108e29a

In r2423, I committed an incomplete fix. This is the proper fix.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2429 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2428 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2427 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2426 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2425 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2424 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2423 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2422 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2421 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2420 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2419 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2418 44740490-163a-0410-bde0-09ae8108e29a

This patch lays the groundwork for removing the MemcacheStore class later.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2417 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2416 44740490-163a-0410-bde0-09ae8108e29a

- frontpage.php
- openid-about.php
- openid-sites.php
- openid-trust.php

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2415 44740490-163a-0410-bde0-09ae8108e29a

Patch by Patrick Honing from issue 322.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2414 44740490-163a-0410-bde0-09ae8108e29a

Patch by Patrick Honing from issue 322.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2413 44740490-163a-0410-bde0-09ae8108e29a

The parameters were only used from the core:LanguageAdaptor class, which
has been switched over to the get/setLanguageCookie functions.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2412 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2411 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2410 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2409 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2408 44740490-163a-0410-bde0-09ae8108e29a