Oops. Switch to new API to separate locally maintained headers from safe ones.

diff --git a/fastcgi/shibauthorizer.cpp b/fastcgi/shibauthorizer.cpp
index 9f07de6..cf26edd 100644 (file)
--- a/fastcgi/shibauthorizer.cpp
+++ b/fastcgi/shibauthorizer.cpp
@@ -63,7 +63,6 @@ class ShibTargetFCGIAuth : public AbstractSPRequest
     FCGX_Request* m_req;\r
     int m_port;\r
     string m_scheme,m_hostname;\r
-    set<string> m_cleared_headers;\r
     multimap<string,string> m_response_headers;\r
 public:\r
     map<string,string> m_request_headers;\r
@@ -125,8 +124,7 @@ public:
             cerr << "shib: " << msg;\r
     }\r
     void clearHeader(const char* rawname, const char* cginame) {\r
-        // Need to save off the name to prevent access to the header later.\r
-        m_cleared_headers.insert(rawname);\r
+        // No need, since we use environment variables.\r
     }\r
     void setHeader(const char* name, const char* value) {\r
         if (value)\r
@@ -134,16 +132,12 @@ public:
         else\r
             m_request_headers.erase(name);\r
     }\r
-    virtual string getHeader(const char* name) const {\r
+    string getHeader(const char* name) const {\r
         // Look in the local map first.\r
         map<string,string>::const_iterator i = m_request_headers.find(name);\r
         if (i != m_request_headers.end())\r
             return i->second;\r
-        // If not in the local set, see if it's a "controlled" header by\r
-        // checking the cleared list.\r
-        if (m_cleared_headers.count(name) > 0)\r
-            return "";\r
-        // Nothing set locally and it's safe, so try the request.\r
+        // Nothing set locally and this isn't a "secure" call, so check the request.\r
         string hdr("HTTP_");\r
         for (; *name; ++name) {\r
             if (*name=='-')\r
@@ -154,6 +148,13 @@ public:
         char* s = FCGX_GetParam(hdr.c_str(), m_req->envp);\r
         return s ? s : "";\r
     }\r
+    string getSecureHeader(const char* name) const {\r
+        // Look in the local map only.\r
+        map<string,string>::const_iterator i = m_request_headers.find(name);\r
+        if (i != m_request_headers.end())\r
+            return i->second;\r
+        return "";\r
+    }\r
     void setRemoteUser(const char* user) {\r
         if (user)\r
             m_request_headers["REMOTE_USER"] = user;\r