1.14.17

Author: rsepulvedacl

docs/simplesamlphp-changelog.txt

@@ -6,6 +6,12 @@ SimpleSAMLphp changelog
 This document lists the changes between versions of SimpleSAMLphp.
 See the upgrade notes for specific information about upgrading.
 
+## Version 1.14.17
+
+Released 2017-10-25
+
+  * Resolved a security issue with the SAML 1.1 Service Provider. See [SSPSA 201710-01](https://simplesamlphp.org/security/201710-01).
+
 ## Version 1.14.16
 
 Released 2017-09-04

extra/simplesamlphp.spec

@@ -1,6 +1,6 @@
 %define name      simplesamlphp
 %define summary   SAML IDP/SP written in PHP
-%define version   1.14.16
+%define version   1.14.17
 %define release   11
 %define license   LGPL 2.1
 %define group     Networking/WWW

lib/SimpleSAML/Configuration.php

@@ -325,7 +325,7 @@ public function copyFromBase($instancename, $filename)
      */
     public function getVersion()
     {
-        return '1.14.16';
+        return '1.14.17';
     }
 
 

lib/SimpleSAML/XML/Validator.php

@@ -260,7 +260,7 @@ public function isNodeValidated($node) {
 		assert('$node instanceof DOMNode');
 
 		while($node !== NULL) {
-			if(in_array($node, $this->validNodes)) {
+			if(in_array($node, $this->validNodes, true)) {
 				return TRUE;
 			}
 

modules/ldap/lib/Auth/Process/AttributeAddFromLDAP.php

@@ -173,7 +173,7 @@ public function process(&$request) {
           $ldap = $this->getLdap();
         } catch (Exception $e) {
           // Added this warning in case $this->getLdap() fails
-          SimpleSAML\Logger::warning("AttributeAddFromLDAP: exception = " . $e);
+          SimpleSAML_Logger::warning("AttributeAddFromLDAP: exception = " . $e);
           return;
         }
         // search for matching entries

modules/saml/lib/Auth/Process/AttributeNameID.php

@@ -69,7 +69,7 @@ protected function getValue(array &$state)
         $value = $value[0];
 
         if (empty($value)) {
-            SimpleSAML\Logger::warning(
+            SimpleSAML_Logger::warning(
                 'Empty value in attribute '.var_export($this->attribute, true).
                 ' on user - not generating persistent NameID.'
             );

modules/saml/lib/Auth/Process/PersistentNameID.php

@@ -78,7 +78,7 @@ protected function getValue(array &$state)
         $uid = $uid[0];
 
         if (empty($uid)) {
-            SimpleSAML\Logger::warning(
+            SimpleSAML_Logger::warning(
                 'Empty value in attribute '.var_export($this->attribute, true).
                 ' on user - not generating persistent NameID.'
             );

modules/saml/lib/Auth/Process/SQLPersistentNameID.php

@@ -134,7 +134,7 @@ protected function getValue(array &$state)
         $uid = $uid[0];
 
         if (empty($uid)) {
-            SimpleSAML\Logger::warning(
+            SimpleSAML_Logger::warning(
                 'Empty value in attribute '.var_export($this->attribute, true).
                 ' on user - not generating persistent NameID.'
             );