Skip to content

OneLogin's SAML PHP Toolkit v4.4.0

Choose a tag to compare

View all tags
@pitbulk pitbulk released this 04 Nov 18:24
· 330 commits to master since this release
4.4.0
92c5826
  • Update xmlseclibs requirement to ^4.0.1. See GHSA-m5mw-mr39-66vp and other security vulnerabilities discovered on August.
  • Require PHP >= 8.0 (xmlseclibs 4 requirement)
  • Add security.allowRSA15KeyTransport setting (default false) to opt in to RSA-1.5 key transport for legacy IdPs with xmlseclibs 4
  • Add security.allowCBCEncryption setting (default true) to reject CBC data encryption (only AES-GCM is accepted) on received EncryptedAssertion and EncryptedID elements
  • Fix HTTP-Redirect signature validation for non RSA-SHA1 SigAlg with xmlseclibs 4 (castKey)
  • Fix fatal error when the decrypted key of an EncryptedID has an unexpected size with xmlseclibs 4
  • Encrypted NameIDs are now always generated with RSA-OAEP-MGF1P key transport (RSA-1.5 is rejected by default by xmlseclibs 4 receivers)
  • Support http://www.w3.org/2009/xmlenc11#rsa-oaep key transport on EncryptedID
  • In strict mode with wantMessagesSigned, verify the signature of a Response with an EncryptedAssertion before decrypting it (if it is not signed or the signature is invalid the assertion is not decrypted and isValid() reports the cause). The EncryptedID of a LogoutRequest is decrypted after its signature is verified
  • Add extra check at validateSign to confirm the signature covers the element it is attached to.
  • Report every decryption failure with the same error (ValidationError::DECRYPTION_FAILED), so a CBC padding error can not be told apart from a parsing error
  • Use stricts === and !== comparisons
  • PHP 8.5 Compatibility
  • Github Actions: Update Checkout to v4. Remove mcrypt install
  • #648 Fix empty responseUrl bypassing SLO URL fallback
  • Added clarification on reverse-proxy scenario (Path Prefix)
  • Update error message for missing InResponseTo
  • #637 Fix incorrect @phpstan-return annotation on processSLO method
  • Fix bug on setSchemasPath method from Auth class. Also see #635
  • #631 Allow to require Destination
  • Force phpunit > 9.6.32 due CVE-2026-24765
  • Update PHP Codesniffer due vulnerability to 3.13.6
Assets 2
Loading