| Subject: | consumer delegate verification bug |
hi
found bug in Consumer.pm Line: 743
delegate and real_ident should be compared to ident_nofragment due to:
# OpenID 2.0 wants us to exclude the fragment part of the URL when doing
equality check
fix:
# if openid.delegate was used, check that it was done correctly
if ($a_ident_nofragment ne $real_ident_nofragment) {
my $a_ident_nofragment = $a_ident;
$a_ident_nofragment =~ s/\#.*$//;
unless ($delegate eq $a_ident) {
$error->("bogus_delegation");
next;
}
}
=>
# if openid.delegate was used, check that it was done correctly
if ($a_ident_nofragment ne $real_ident_nofragment &&
$a_ident_nofragment ne $delegate) {
$error->("bogus_delegation");
next;
}