Verify return_to URL correctly.

Fix bug with URLs when using HTTPS on port 80
Closes #2

processor.php

@@ -279,6 +279,13 @@
  function processPositiveResponse($valid) {
   Logger::log('Positive response: identity = %s, expected = %s', $_REQUEST['openid_identity'], $_SESSION['openid']['claimedId']);
 
+  if (!URLBuilder::isValidReturnToURL($_REQUEST['openid_return_to'])) {
+   Logger::log('Return_to check failed: %s, URL: %s', $_REQUEST['openid_return_to'], URLBuilder::getCurrentURL(true));
+   error('diffreturnto', 'The identity provider stated return URL was '
+                         . $_REQUEST['openid_return_to'] . ' but it actually seems to be '
+                         . URLBuilder::getCurrentURL());
+  }
+
   if ($_REQUEST['openid_identity'] != $_SESSION['openid']['claimedId'] && $_REQUEST['openid_identity'] != $_SESSION['openid']['opLocalId']) {
    if ($_SESSION['openid']['claimedId'] == 'http://specs.openid.net/auth/2.0/identifier_select') {
     $disc = new Discoverer($_REQUEST['openid_claimed_id'], false);

urlbuilder.inc.php

@@ -159,7 +159,43 @@
    return self::addArguments(false, $args);
   }
 
-  public static function getCurrentURL() {
+  public static function isValidReturnToURL($url) {
+   // 11.1: The URL scheme, authority, and path MUST be the same between the two URLs.
+   //       Any query parameters that are present in the "openid.return_to" URL MUST
+   //       also be present with the same values in the URL of the HTTP request the
+   //       RP received.
+
+   $actual = parse_url(self::getCurrentURL(true));
+   $return = parse_url($url);
+
+   foreach (array('scheme', 'host', 'port', 'user', 'pass', 'path') as $part) {
+    if ($part == 'port') {
+     if (!isset($actual['port'])) { $actual['port'] = $actual['scheme'] == 'https' ? 443 : 80; }
+     if (!isset($return['port'])) { $return['port'] = $return['scheme'] == 'https' ? 443 : 80; }
+    }
+
+    if (isset($actual[$part]) ^ isset($return[$part])) {
+     // Present in one but not the other
+     return false;
+    } else if (isset($actual[$part]) && $actual[$part] != $return[$part]) {
+     // Present in both but different
+     return false;
+    }
+   }
+
+   parse_str($actual['query'], $actualVars);
+   parse_str($return['query'], $returnVars);
+
+   foreach ($returnVars as $key => $value) {
+    if (!isset($actualVars[$key]) || $actualVars[$key] != $value) {
+     return false;
+    }
+   }
+ 
+   return true;
+  }
+
+  public static function getCurrentURL($raw = false) {
    $res = 'http';
 
    if (isset($_SERVER['HTTPS'])) {
@@ -168,14 +204,16 @@
 
    $res .= '://' . $_SERVER['SERVER_NAME'];
 
-   if ($_SERVER['SERVER_PORT'] != 80) {
+   if ($_SERVER['SERVER_PORT'] != (isset($_SERVER['HTTPS']) ? 443 : 80)) {
     $res .= ':' . $_SERVER['SERVER_PORT'];
    }
 
    $url = $_SERVER['REQUEST_URI'];
 
-   while (preg_match('/([\?&])openid[\._](.*?)=(.*?)(&|$)/', $url, $m)) {
-    $url = str_replace($m[0], $m[1], $url);
+   if (!$raw) {
+    while (preg_match('/([\?&])openid[\._](.*?)=(.*?)(&|$)/', $url, $m)) {
+     $url = str_replace($m[0], $m[1], $url);
+    }
    }
 
    $url = preg_replace('/\??&*$/', '', $url);