This also required adding an additional argument to
SimpleSAML\Utils\Crypto::loadPrivateKey to ease in testing. Without
this additional argument, SimpleSAML_Configuration::getBaseDir eventually
gets called to determine the private key location.  This doesn't work
well with vfsstream. This argument shouldn't cause too much trouble, and
seems cohesive enough with the function's purpose.

The reason was the lack of conversion to integer for each character of the strings before applying the XOR operator to them. The operator returns always an empty string when applied to two characters, and applying a binary-wise OR between 0 and an empty string, yields 0. Therefore, $diff is always 0, and the function returns true for every two strings with same length, regardless of their contents.

This reverts commit b1b0d0ef.

This reverts commit c441f9c9.

It looks like mb_substr() doesn’t cope well with NULL as the third parameter in PHP 5.3.

This way we we allow those writing themes to use twig extensions, filters, or anything they may need.

IVs must be random and one-time (never reused). Additionally, by deriving it from the key, the key length was effectively reduced to 128 bits.

This allows custom themes to inject data for all templates by simply adding a new hook.

Add a check to the constructor of the new redis store to check if predis/predis is available, and throw a critical configuration error if not.

It actually needs a DOMNode, so it has been renamed to isDOMNodeOfType().

Additionally, some superfluous asserts() have been removed, and SimpleSAML\Utils\XML::getDOMChildren() has also changed its signature, as it should also receive a DOMNode, not a DOMElement.

If something fails, an exception would be thrown, instead of “false” being returned.

Also, at this point we are sure that the return value will be a string, because the call to fetch() does not set the third parameter ($getHeaders) to true.

Use it when constant-time comparisons are needed to avoid side-channel attacks.

To put it differently, to avoid OSX machines being identified as windows boxes, “darwin” should be evaluated *before* “win”.

Make the language parameter name available to the templates, and remove that parameter from the queryParams entry in the template data.

This allows us to focus on the “real” parameters, ignoring language selection routines. It also allows us to build our own language bar the way we want it, not only with links.

This allows us to build the language switching links even when we have query parameters that would otherwise get lost.

The exception was never raised because $stats will be array(false) on failure instead of just false.

If a standard port is specified, then ignore it. Otherwise, include the port in the check so that non-standard ports must be whitelisted explicitly.

Formatting, namespaces, phpdoc.

This resolves #476.

Minor format and exception message fixes, plus add information about the different communication channels we have today.