Jasig/phpCAS — Issue #24: Problem with URL encoded logoutRequest
Author: dlineate
Created: 2012-02-02 19:01:38+00:00
State: open

My rubycas-server (1.0.1) is sending logout requests where SAML formated field delivered in the logoutRequest parameter is urlencoded. This prevents phpCAS from parsing the SAML.

I'm not sure if rubycas is supposed to encode this field or not, but fixing in phpCAS is fairly easy.
My understanding is that urldecoding an unencoded string should be harmless.

Here is a simple proof-of-concept patch that fixes the problem for me.

```
Index: CAS/Client.php
===================================================================
--- CAS/Client.php (revision 948)
+++ CAS/Client.php (working copy)
@@ -1320,7 +1320,8 @@
phpCAS::trace("phpCAS can't handle logout requests if it does not manage the session.");
}
phpCAS::trace("Logout requested");
- phpCAS::trace("SAML REQUEST: ".$_POST['logoutRequest']);
+ $decoded_logout_rq = urldecode($_POST['logoutRequest']);
+ phpCAS::trace("SAML REQUEST: ".$decoded_logout_rq);
if ($check_client) {
if (!$allowed_clients) {
$allowed_clients = array( $this->getServerHostname() );
@@ -1348,7 +1349,7 @@
phpCAS::trace("No access control set");
}
// Extract the ticket from the SAML Request
- preg_match("|(.*)|", $_POST['logoutRequest'], $tick, PREG_OFFSET_CAPTURE, 3);
+ preg_match("|(.*)|", $decoded_logout_rq, $tick, PREG_OFFSET_CAPTURE, 3);
$wrappedSamlSessionIndex = preg_replace('||','',$tick[0][0]);
$ticket2logout = preg_replace('||','',$wrappedSamlSessionIndex);
phpCAS::trace("Ticket to logout: ".$ticket2logout);
```