Skip to content

Commit 613eb19

Browse files
committed
Security: Fix SQL injection vulnerability by escaping assoc_handle in openid login
1 parent 6502707 commit 613eb19

File tree

2 files changed

+15
-8
lines changed

2 files changed

+15
-8
lines changed

main/auth/openid/login.php

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -298,10 +298,17 @@ function openid_verify_assertion($op_endpoint, $response) {
298298

299299
//TODO
300300
$openid_association = Database::get_main_table(TABLE_MAIN_OPENID_ASSOCIATION);
301-
$sql = sprintf("SELECT * FROM $openid_association WHERE assoc_handle = '%s'", $response['openid.assoc_handle']);
302-
$res = Database::query($sql);
303-
$association = Database::fetch_object($res);
304-
if ($association && isset($association->session_type)) {
301+
$association = Database::select(
302+
'*',
303+
$openid_association,
304+
[
305+
'where' => [
306+
'assoc_handle = ?' => [$response['openid.assoc_handle']],
307+
]
308+
],
309+
'first'
310+
);
311+
if ($association && isset($association['session_type'])) {
305312
$keys_to_sign = explode(',', $response['openid.signed']);
306313
$self_sig = _openid_signature($association, $response, $keys_to_sign);
307314
if ($self_sig == $response['openid.sig']) {

main/auth/openid/openid.lib.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -201,14 +201,14 @@ function _openid_meta_httpequiv($equiv, $html) {
201201

202202
/**
203203
* Sign certain keys in a message
204-
* @param $association - object loaded from openid_association or openid_server_association table
204+
* @param $association - array loaded from openid_association or openid_server_association table
205205
* - important fields are ->assoc_type and ->mac_key
206206
* @param $message_array - array of entire message about to be sent
207207
* @param $keys_to_sign - keys in the message to include in signature (without
208208
* 'openid.' appended)
209209
*/
210-
function _openid_signature($association, $message_array, $keys_to_sign) {
211-
$signature = '';
210+
function _openid_signature(array $association, $message_array, $keys_to_sign): string
211+
{
212212
$sign_data = array();
213213

214214
foreach ($keys_to_sign as $key) {
@@ -218,7 +218,7 @@ function _openid_signature($association, $message_array, $keys_to_sign) {
218218
}
219219

220220
$message = _openid_create_message($sign_data);
221-
$secret = base64_decode($association->mac_key);
221+
$secret = base64_decode($association['mac_key']);
222222
$signature = _openid_hmac($secret, $message);
223223

224224
return base64_encode($signature);

0 commit comments

Comments
 (0)