X-Git-Url: http://source.bookstackapp.com/bookstack/blobdiff_plain/c76d12d1ded72b5bf74a51fdb1647f87bb935edc..refs/pull/5725/head:/app/Access/Oidc/OidcProviderSettings.php

diff --git a/app/Access/Oidc/OidcProviderSettings.php b/app/Access/Oidc/OidcProviderSettings.php
index 49ccab6f0..71c3b5734 100644
--- a/app/Access/Oidc/OidcProviderSettings.php
+++ b/app/Access/Oidc/OidcProviderSettings.php
@@ -18,7 +18,6 @@ class OidcProviderSettings
     public string $issuer;
     public string $clientId;
     public string $clientSecret;
-    public ?string $redirectUri;
     public ?string $authorizationEndpoint;
     public ?string $tokenEndpoint;
     public ?string $endSessionEndpoint;
@@ -38,7 +37,7 @@ class OidcProviderSettings
     /**
      * Apply an array of settings to populate setting properties within this class.
      */
-    protected function applySettingsFromArray(array $settingsArray)
+    protected function applySettingsFromArray(array $settingsArray): void
     {
         foreach ($settingsArray as $key => $value) {
             if (property_exists($this, $key)) {
@@ -52,9 +51,9 @@ class OidcProviderSettings
      *
      * @throws InvalidArgumentException
      */
-    protected function validateInitial()
+    protected function validateInitial(): void
     {
-        $required = ['clientId', 'clientSecret', 'redirectUri', 'issuer'];
+        $required = ['clientId', 'clientSecret', 'issuer'];
         foreach ($required as $prop) {
             if (empty($this->$prop)) {
                 throw new InvalidArgumentException("Missing required configuration \"{$prop}\" value");
@@ -74,12 +73,20 @@ class OidcProviderSettings
     public function validate(): void
     {
         $this->validateInitial();
+
         $required = ['keys', 'tokenEndpoint', 'authorizationEndpoint'];
         foreach ($required as $prop) {
             if (empty($this->$prop)) {
                 throw new InvalidArgumentException("Missing required configuration \"{$prop}\" value");
             }
         }
+
+        $endpointProperties = ['tokenEndpoint', 'authorizationEndpoint', 'userinfoEndpoint'];
+        foreach ($endpointProperties as $prop) {
+            if (is_string($this->$prop) && !str_starts_with($this->$prop, 'https://')) {
+                throw new InvalidArgumentException("Endpoint value for \"{$prop}\" must start with https://");
+            }
+        }
     }
 
     /**
@@ -87,7 +94,7 @@ class OidcProviderSettings
      *
      * @throws OidcIssuerDiscoveryException
      */
-    public function discoverFromIssuer(ClientInterface $httpClient, Repository $cache, int $cacheMinutes)
+    public function discoverFromIssuer(ClientInterface $httpClient, Repository $cache, int $cacheMinutes): void
     {
         try {
             $cacheKey = 'oidc-discovery::' . $this->issuer;
@@ -180,9 +187,9 @@ class OidcProviderSettings
     /**
      * Get the settings needed by an OAuth provider, as a key=>value array.
      */
-    public function arrayForProvider(): array
+    public function arrayForOAuthProvider(): array
     {
-        $settingKeys = ['clientId', 'clientSecret', 'redirectUri', 'authorizationEndpoint', 'tokenEndpoint', 'userinfoEndpoint'];
+        $settingKeys = ['clientId', 'clientSecret', 'authorizationEndpoint', 'tokenEndpoint', 'userinfoEndpoint'];
         $settings = [];
         foreach ($settingKeys as $setting) {
             $settings[$setting] = $this->$setting;