From 34f4fb42fcd2ca12e1abe8d283ccc6d2e9c3f714 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: May 26 2016 13:24:41 +0000
Subject: [PATCH 1/2] openidc: Use urlencode to generate return URL


This will make sure that all arguments are url encoded and safe
for returning the client to the RP.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

---

diff --git a/ipsilon/providers/openidc/auth.py b/ipsilon/providers/openidc/auth.py
index fc2af0a..5d10470 100644
--- a/ipsilon/providers/openidc/auth.py
+++ b/ipsilon/providers/openidc/auth.py
@@ -19,6 +19,7 @@ import hashlib
 import requests
 import time
 import json
+import urllib
 from urlparse import urlparse
 
 URLROOT = 'openidc'
@@ -98,7 +99,6 @@ class AuthenticateRequest(ProviderPageBase):
         # Build a response-string, which is sent with either query, form
         # or fragment responses
         if response_mode in ['query', 'fragment']:
-            data = ['%s=%s' % (key, contents[key]) for key in contents.keys()]
 
             separator = '?'
             if response_mode == 'fragment':
@@ -108,7 +108,7 @@ class AuthenticateRequest(ProviderPageBase):
             else:
                 url += '&'
 
-            url += '&'.join(data)
+            url += urllib.urlencode(contents)
 
         if response_mode in ['query', 'fragment', 'none']:
             raise cherrypy.HTTPRedirect(url)

From 79459c2285c58c81aa7aed1f897c3f448ef36242 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: May 26 2016 13:24:41 +0000
Subject: [PATCH 2/2] openidc: Uncomment the autocommit in form response mode


Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/templates/openidc/form_response.html b/templates/openidc/form_response.html
index b70dfb9..15b9750 100644
--- a/templates/openidc/form_response.html
+++ b/templates/openidc/form_response.html
@@ -17,7 +17,6 @@
 </div>
 
 <script type="text/javascript">
-  // TODO: Uncomment this, this is used for testing
-  //document.getElementById('openidc_response_form').submit();
+  document.getElementById('openidc_response_form').submit();
 </script>
 {% endblock %}