When Clean URLs are enabled, I get PHP error:

Notice: Undefined index: QUERY_STRING in _openid_response() (line 561 of .../modules/openid/openid.inc).

when opening any "OpenID Identities" page like my.site/user/<n>/openid.

The code in question in openid.inc (version 7.8) is:

560:  if (isset($_SERVER['REQUEST_METHOD'])) {
561:    $data = _openid_get_params($_SERVER['QUERY_STRING']);

This happens on a shared hosting account with:
Apache/1.3.26, PHP Version 5.2.11, CGI mode

but not on my local xampp with:
Apache/2.2.17 (Win32), PHP Version 5.3.5, mod_php

Best regards,
Peter

CommentFileSizeAuthor
#8 openid-query-string-2.patch4.02 KBc960657
#1 openid-query-string-D7-1.patch946 bytesc960657
#1 openid-query-string-1.patch966 bytesc960657

Comments

c960657’s picture

c960657 commented
Status: Active » Needs review
StatusFileSize
new openid-query-string-1.patch966 bytes
new openid-query-string-D7-1.patch946 bytes

Patches for D7 and D8. Do they fix your problem?

The patches change the logic in _openid_response() a little to make it more in line with section 4.1.2 of the OpenID spec:
“When a message is sent as a POST, OpenID parameters MUST only be sent in, and extracted from, the POST body. ”
So it seems that the proper behaviour is to use either POST or GET variables, but not both as we do today.

Status: Needs review » Needs work

The last submitted patch, openid-query-string-1.patch, failed testing.

c960657’s picture

c960657 commented
Version: 7.8 » 8.x-dev
Status: Needs work » Needs review
c960657’s picture

c960657 commented

#1: openid-query-string-1.patch queued for re-testing.

Peter Arius’s picture

Peter Arius commented

Thanks, Christian, for the patch. I tried the D7 patch on both servers and it works for me.

sun’s picture

sun
Primary language German
Location Karlsruhe
commented
Issue tags: +Needs tests

Looks good, but let's add a test for this.

wojtha’s picture

wojtha commented

Different but related issue: #1295096: With Clean URLs enabled: Undefined index: QUERY_STRING in _openid_response() (line 561 of .../modules/openid/openid.inc)

c960657’s picture

c960657 commented
StatusFileSize
new openid-query-string-2.patch4.02 KB

I finally got around to adding a test for this.

It took me a while to figure out. I was using openid_redirect() in openid_test.module to do a POST redirect back to the Relying Party, but this failed, because the embedded call to drupal_get_form('openid_redirect_form') tried to processes the current request - a POST request from the Relying Party to the OpenID Provider - and ended up doing a HTTP redirect in drupal_redirect_form(). I got around this issue by removing the form_id and form_build_id hidden fields from the form - without these, FAPI will not process the form (and as an added bonus, we avoid sending these Drupal-internal fields to OpenID Providers).

BTW this issue is sort of the counterpart of #965718: Users using Livejournal OpenID are unable to authenticate. This issue is about accepting both GET and POST in the Relying Party (i.e. Drupal) when the user is redirected from the Drupal site to the OpenID Provider, and #965718 is about using either GET or POST when the user is redirected the other way, i.e. from the Drupal site to the OpenID Provider.

c960657’s picture

c960657 commented
Issue tags: -Needs tests

Removing tag.

swentel’s picture

swentel commented
Version: 8.x-dev » 7.x-dev

Gone in D8

Status: Needs review » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.