ALOWED Misspell

Author: pitbulk

README.md

@@ -1053,6 +1053,7 @@ Main class of OneLogin PHP Toolkit
  * `getErrors` - Returns if there were any error 
  * `getSSOurl` - Gets the SSO url.
  * `getSLOurl` - Gets the SLO url.
+ * `getLastRequestID` - The ID of the last Request SAML message generated.
  * `buildRequestSignature` - Generates the Signature for a SAML Request
  * `buildResponseSignature` - Generates the Signature for a SAML Response
  * `getSettings` - Returns the settings info

lib/Saml2/Constants.php

@@ -8,7 +8,7 @@
 class OneLogin_Saml2_Constants
 {
     // Value added to the current time in time condition validations
-    const ALOWED_CLOCK_DRIFT = 180;  // 3 min in seconds
+    const ALLOWED_CLOCK_DRIFT = 180;  // 3 min in seconds
 
     // NameID Formats
     const NAMEID_EMAIL_ADDRESS = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress';

lib/Saml2/Response.php

@@ -258,6 +258,9 @@ public function isValid($requestId = null)
             }
 
             if (!empty($signedElements)) {
+                if (count($signedElements) > 2) {
+                    throw new Exception("Too many Signatures found. SAML Response rejected");
+                }
                 $cert = $idpData['x509cert'];
                 $fingerprint = $idpData['certFingerprint'];
                 $fingerprintalg = $idpData['certFingerprintAlgorithm'];
@@ -513,10 +516,10 @@ public function validateTimestamps()
         for ($i = 0; $i < $timestampNodes->length; $i++) {
             $nbAttribute = $timestampNodes->item($i)->attributes->getNamedItem("NotBefore");
             $naAttribute = $timestampNodes->item($i)->attributes->getNamedItem("NotOnOrAfter");
-            if ($nbAttribute && OneLogin_SAML2_Utils::parseSAML2Time($nbAttribute->textContent) > time() + OneLogin_Saml2_Constants::ALOWED_CLOCK_DRIFT) {
+            if ($nbAttribute && OneLogin_SAML2_Utils::parseSAML2Time($nbAttribute->textContent) > time() + OneLogin_Saml2_Constants::ALLOWED_CLOCK_DRIFT) {
                 return false;
             }
-            if ($naAttribute && OneLogin_SAML2_Utils::parseSAML2Time($naAttribute->textContent) + OneLogin_Saml2_Constants::ALOWED_CLOCK_DRIFT <= time()) {
+            if ($naAttribute && OneLogin_SAML2_Utils::parseSAML2Time($naAttribute->textContent) + OneLogin_Saml2_Constants::ALLOWED_CLOCK_DRIFT <= time()) {
                 return false;
             }
         }