Starting with tag: [TAG 2.0.0 cygnus@janrain.com**20071205215515] [use-time-instead-of-(gm)mktime dAniel hAhler **20071208234037 Use time() instead of (gm)mktime(), when used for getting the current time (called without arguments). According to "hunk ./Auth/OpenID/Nonce.php 99" gmmktime() for PHP4 is buggy and using mktime() makes no sense when called without args: just use time() then directly. ] [Typo in SReg docblock sam.alexander@vidoop.com**20071220222957] [Update admin scripts to run under Mac OS X Trevor Johns **20071229081729 The scripts in admin use several non-POSIX arguments which do not work on Mac OS X. See my original post to dev@openidenabled.com: message://%3C5902A542-C723-4F0A-8478-1F33C874D1B8@tjohns.net%3E http://lists.openidenabled.com/pipermail/dev/2007-December/000979.html This patch makes the following changes to fix this: - Changed $HERE in admin/runtests to avoid calling readlink. - Calls to xargs now use '-L 1' instead of '-l1'. - Calls to 'wc -L' were eliminated. ] [Fixed StoreTest to not fail on Mac OS X 10.5 Trevor Johns **20071229084113 Mac OS X 10.5 generates a value for $TMPDIR that looks something like this: /var/folders/uU/uXMNhbRIGkOhaxcg60xSGU+++TI/-Tmp-/ The '+++' is causing the DSN in Tests_Auth_OpenID_StoreTest::test_sqlitestore to become invalid. This invalid DSN causes the SQLite driver to attempt creating a file at a nonexistant path, resulting in a failed test. This is fixed by wrapping the value of $TMPDIR received by the system in a call to urlencode(). ] [Fixed typo and minor formatting changes for StoreTest. Trevor Johns **20071229214829 - Removed extra newline. - Changed comment in test_sqlitestore() to read 'sqlite' instead of 'postgres'. ] [Removed unused $http_response from Auth_Yadis_Manager Trevor Johns **20071229223813] [Fixed discovery failure due to case-sensitive comparison of 'Location:' header Trevor Johns **20071230015002 If an HTTP redirect was issued during discovery with a 'Location:' header that doesn't exactly match case (such as 'location:' or 'LOCATION:'), discovery would fail. This is incorrect behavior per RFC 2616, Section 4.2. This behavior is corrected by using a case insensitive compare when checking for HTTP redirects. ] [Store test: remove correct sqlite database file cygnus@janrain.com**20071231184207] [Remove PHP5ism (stripos()) cygnus@janrain.com**20071231191841] [Refactored HTML-parsing code to avoid PCRE limits on large matches cygnus@janrain.com**20080103000827] [Fixing documentation sam.alexander@vidoop.com**20080116174448] [Auth_OpenID_AX_FetchResponse::getExtensionArgs takes request by value, defaults to null cygnus@janrain.com**20080116184239] [ParanoidHTTPFetcher.php (supportsSSL): Updated to work under PHP 4. joel@pbwiki.com**20080124041253 The official documentation lies, curl_version() returns an array in PHP 5 and a string in PHP 4. ] [Fix reference-passing style for PHP 5 cygnus@janrain.com**20080129054357] [Fix IDP XRDS in example server: advertise correct type cygnus@janrain.com**20080204175339] [Fix user XRDS cygnus@janrain.com**20080204180559] [Failed DB connection is not a fail of test, typo in PG storage test me@arty.name**20080202183503] [Implementation of Memcached storage in PHP. This patch also includes supportsCleanup() function for OpenIDStore interface, as memcache doesn't allow me@arty.name**20080202194709 enumeration of all keys used (and cleans itself). Also included test for memcached storage and support for supportsCleanup() in test functions. ] [support-hmacsha256 harningt@gmail.com**20080202063443] [hmac-sha256-test harningt@gmail.com**20080202065307] [Enable (HMAC)SHA256 tests; why did we disable them? cygnus@janrain.com**20080204195723] [Pass instead of fail on failed memcached connection cygnus@janrain.com**20080204195735] [Whitespace cygnus@janrain.com**20080204195753] [Change output when skipping memcached tests: warnings upset buildbot cygnus@janrain.com**20080204195821] [Generalize Auth_OpenID_Association::sign() cygnus@janrain.com**20080204200901] [Add HMAC-SHA256 to plaintext consumer session assoc types cygnus@janrain.com**20080207211908] [Remove stale getAssocArgs cygnus@janrain.com**20080207212211] [Skip HMAC-SHA256 test if not supported cygnus@janrain.com**20080207214000] [Add conditional check for CURLOPT_NOSIGNAL (thanks: http://ols2000.myopenid.com/) cygnus@janrain.com**20080219234326] [Use PATH_SEPARATOR in detect.php (thanks: http://jeroen.hellingman.myopenid.com/) cygnus@janrain.com**20080219234601] [Remove "warning" text from output of store tests cygnus@janrain.com**20080220213956] [TAG 2.0.1 cygnus@janrain.com**20080220220619] [Extend Yadis HTML discovery regex to support XHTML-style tags cygnus@janrain.com**20080313234248] [Handle null responses in Yadis.php cygnus@janrain.com**20080313234416] [Handle malformed HTTP headers in fetchers cygnus@janrain.com**20080313235746] [Swap XRDS and server urls in identity page code (thanks: lulurun@gmail.com) cygnus@janrain.com**20080520164823] [Use ENGINE=InnoDB instead of TYPE=InnoDB, which is deprecated in current versions of MySQL dag@janrain.com**20080520190622] [Example server: set response code in action_default cygnus@janrain.com**20080520200300] [Add Auth_OpenID::log() cygnus@janrain.com**20080520222854] [ParanoidHTTPFetcher: log error condition when returning null cygnus@janrain.com**20080520232602] [Actually use URINorm functionality for Auth_OpenID::normalizeURL cygnus@janrain.com**20080521001611] [whitespace cygnus@janrain.com**20080521001653] [Include more prominent link to Consumer file documentation in top-level docs cygnus@janrain.com**20080521002404] [Collapse allowedURL and isHTTPS checks into HTTPFetcher.canFetchURL cygnus@janrain.com**20080521003213] [Auth_OpenID::ensureDir: add terminal case when dirname returns its input cygnus@janrain.com**20080521163619] [Accept HTML when making YADIS discovery Artemy Tregubenko **20080512110236 Some http servers strictly follow http spec and do not send html reply when text/html isn't listed in Accept: header. Because of this YADIS discovery fails for these servers. This patch adds 'text/html' to Accept: header. ] [Yadis: add application/xhtml+xml to Accept header, include qualities Kevin Turner **20080521233731] [Add toHTML methods. Server.toFormMarkup passes through form attributes dag@janrain.com**20080523221444] [Send all fields in check_authentication, not just signed ones. (OpenID 2 compliance) dag@janrain.com**20080527001024] [Be explicit about implicit namespaces dag@janrain.com**20080527193427] [fix copyright notices to include 2008 http://mike.glover.myopenid.com**20080527221741] [Run a syntax check as part of runtests dag@janrain.com**20080527230402] [have auto-submitting html code hide the continue button chowells@janrain.com**20080527235106] [use the htmlMarkup method to get auto-submitting code, instead of doing it in the example consumer chowells@janrain.com**20080527235204] [variable name (typo), $argv to $args (loadSuite was always being passed a null parameter) sam.alexander@vidoop.com**20080321225922] [add_field_names_to_set_assoc_in_mysqlstore Wes Morgan **20080222230248] [examples/consumer: Return Consumer object by reference in getConsumer() cygnus@janrain.com**20080529212131] [README: Add /contribute/ URL cygnus@janrain.com**20080529212357] [Only fetch 1MB of data in Auth/Yadis/PlainHTTPFetcher.php dag@janrain.com**20080529181317] [Fetcher: add Range header: 0-1MB dag@janrain.com**20080529211244] [Add fetch response size limiting to libcurl fetcher dag@janrain.com**20080529211539] [Alter AX fromOpenIDRequest() to accept Auth_OpenID_AuthRequest object instead of Auth_OpenID_Message object so that it matches it's counterpart methods in SREG and PAPE extensions. sam.alexander@vidoop.com**20080321234133] [Auth/OpenID/AX: whitespace cygnus@janrain.com**20080529220108] [PAPE: use auth_time instead of auth_age dag@janrain.com**20080529224936] [PAPE: properly use "none" for empty auth policies list dag@janrain.com**20080529231028] [ParanoidHTTPFetcher: Fix string interpolation of max response size cygnus@janrain.com**20080529231659] ["and" -> "&&" cygnus@janrain.com**20080529231727] [extra parsehtml testcase: javascript in head dag@janrain.com**20080529232132] [Remove URL fragment in ServiceEndpoint->getDisplayIdentifier dag@janrain.com**20080530202050] [Don't explicitly set no-encryption session type with OpenID 1 requests dag@janrain.com**20080530214515] [Add version string to Auth/OpenID.php dag@janrain.com**20080530222051] [Set User-Agent string in fetchers. include various versions dag@janrain.com**20080530224859] [Update license strings to say Apache dag@janrain.com**20080530234359] [ParanoidHTTPFetcher: check to see if curl_version returns an array or not. Kevin Turner **20080531010407] [Fix selectTests in TestDriver.php dag@janrain.com**20080602194554] [TestDriver.php: make global_include_once tell you about failures dag@janrain.com**20080602194834] [TestDriver.php: factor instantiating a test suite from a class name into its own function dag@janrain.com**20080602195148] [Move Memcached store to contrib since it's not owned by JanRain dag@janrain.com**20080602200224] [Make the MemcachedStore tests run on record dag@janrain.com**20080602200602] [Add --extra-tests option to texttest.php dag@janrain.com**20080602200843] [Consumer._verifyDiscoveryResults: fall back to OpenID 1.0 type if 1.1 endpoint cannot be found dag@janrain.com**20080602231952] [normalize return_to before checking dag@janrain.com**20080603000447] [Move MemcachedStore back from contrib, update license and copyright dag@janrain.com**20080603190933] [Fix PHP tags cygnus@janrain.com**20080603204019] [Add NOT NULL constraints to SQL stores dag@janrain.com**20080603211014] ['fix' regexp looking for bad constant capitalization to allow NULL in strings dag@janrain.com**20080603211632] [AX::FetchResponse::fromSuccessResponse - return null when there's no ax args dag@janrain.com**20080603233340] [Add AX FetchResponse tests, fix bugs dag@janrain.com**20080603233351] [server..Decoder.defaultDecoder: more readable error message Kevin Turner **20080603234613] [rename return_to to current_url in Consumer.complete dag@janrain.com**20080603234210] [Add comment for Consumer::Response describing display_identifier and identity_url dag@janrain.com**20080603235026] [Message->getArg & friends return FailureResponse on error dag@janrain.com**20080604221408] [#224: Tests_Auth_OpenID_CheckID: more test cases for missing trust_root/realm Kevin Turner **20080604221037] [Auth_OpenID_Decoder::decode: make sure Auth_OpenID_ServerError has an Auth_OpenID_Message after encountering invalid OpenID namespace Kevin Turner **20080604222832] [Auth_OpenID_CheckIDRequest::fromMessage: return Auth_OpenID_ServerError if claimed_id is provided without identity Kevin Turner **20080604224548] [Fix trust root test runner and then all failing tests that were exposed chowells@janrain.com**20080604221310] [Port the v2 plaintext encryption test from python chowells@janrain.com**20080604224003] [Test Server.php fix the error message if test_nomode fails chowells@janrain.com**20080604224904] [Fix #220: Use return_to from request when generating form markup in Server.php chowells@janrain.com**20080604231214] [fix typo in test data dag@janrain.com**20080604224249] [Add an extra parsehtml testcase - no close script tag dag@janrain.com**20080604231505] [#189 Add optional form_tag_attrs arg to Auth_OpenID_ServerResponse->toFormMarkup chowells@janrain.com**20080604232903] [Auth_OpenID_Decoder::decode: Check for Auth_OpenID_FailureResponse when getting OpenID message mode Kevin Turner **20080604234042] [Auth_OpenID_Decoder::defaultDecoder: Check for Auth_OpenID_FailureResponse when getting OpenID message mode Kevin Turner **20080604234258] [Add HTTP case to trustroot test cases Kevin Turner **20080604234505] [#229 Server.php: test hasReturnTo() when message=null chowells@janrain.com**20080604235251] [Add an explicit test for doubled-up ports for PHP 4.3 where the URL parsing is different chowells@janrain.com**20080605001024] [Silence session_start warnings that are output for older builds of PHP 4.3 so the build passes chowells@janrain.com**20080605002447] [#204 MalformedTrustRoot returned by the library now gets passed the OpenID Message object instead of null chowells@janrain.com**20080605011159] [handle empty string for trustroot the same as missing dag@janrain.com**20080605184528] [TestDriver.php: load "_other" tests regardless of primary test class type cygnus@janrain.com**20080605180034] [Fix Auth_OpenID_getAllowedReturnURLs, Auth_Yadis_DiscoveryResult::usedYadisLocation, add Auth_Yadis_getServiceEndpoints, tests cygnus@janrain.com**20080605192241] [Auth_OpenID_getAllowedReturnURLs: use fetcher parameter in call to getServiceEndpoints cygnus@janrain.com**20080605201621] [Auth_Yadis_Yadis::discover: Correctly test for null fetcher parameter cygnus@janrain.com**20080605203402] [Plain http fetcher: allow for absent "path" key in parsed URL array cygnus@janrain.com**20080605203931] [add test for Auth_Yadis_getCanonicalId with subsegments cygnus@janrain.com**20080605210016] [Deprecate Auth_OpenID_CheckIDRequest::namespace and stop using == Auth_OpenID_OPENID1_NS anywhere in server Kevin Turner **20080605224640] [add CHANGES-2.1.0 cygnus@janrain.com**20080605230958] [Update CHANGES-2.1.0 cygnus@janrain.com**20080605234902] [Change Auth_OpenID_VERSION to 2.1.0 cygnus@janrain.com**20080605235803] [Auth_OpenID_AuthRequest: simplify message construction Kevin Turner **20080605225039] [message: allow two values for OPENID1_NS Kevin Turner **20080606004023 message: allow two values for OPENID1_NS Also: * fix op_endpoint bug in Server.php * always treat OpenID 1 namespace as implicit in messages we create ] [demo RP: escape response information prior to output cygnus@janrain.com**20080606182611] [demo RP: indentation cygnus@janrain.com**20080606182652] [Do not send namespace aliases for extensions with OpenID 1 messages that we create cygnus@janrain.com**20080606213933 This makes the library compatible with the 1.x series of this library, since it did not handle arbitrary query keys with dots in them (PHP mangles . to _) ] [Add examples/discover.php tool cygnus@janrain.com**20080606224356] [TAG 2.1.0 cygnus@janrain.com**20080606224951] [examples/discover: import consumer/common.php to set include_path cygnus@janrain.com**20080606230345] [Auth_OpenID_urinorm: fail to parse URIs with non-ASCII characters cygnus@janrain.com**20080611182036] [Add test cases for trust roots with non-ASCII characters in path or hostname cygnus@janrain.com**20080611182127] [Accept response code 206 from fetcher results. Fixes #260 Kevin Turner **20080611221805] [Accept response code 206 from fetcher results (part 2). Fixes #260 Kevin Turner **20080611222216] [etxrd.getCanonicalID: case-insensitive comparsions, patch from =wil Kevin Turner **20080613181446 1. There should only be a single CanonicalID in each XRD (in the latest XRI resolution spec), so I made it use the first CID found instead of the last. 2. Use case-insensitive comparison when comparing CanonicalIDs. ] [Rename files and tests related to HMACSHA1 and HMACSHA256 http://j3h.us/**20080620220810] [Test and fix HMAC-SHA256 http://j3h.us/**20080620224043] [Fix Consumer's OpenID 1 checkid_immediate failure handling (thanks to Evan Prodromou) http://j3h.us/**20080620224649] [Do not attempt HMAC-SHA256 tests if HMAC-SHA256 is not supported http://j3h.us/**20080620225609] [fix accept header will@willnorris.com**20080623231533] [ParanoidHTTPFetcher-strpos-instead-of-preg_match-and-code-improvements dAniel hAhler **20080622141537 ParanoidHTTPFetcher: - Fix corner case in get() and post() for headers without any value (e.g. 'Expires:') - Use strpos() instead of preg_match() when looking for ":" (and look for ": " now instead) ] [remove Auth_OpenID::quoteMInimal. Resolves #262. Kevin Turner **20080625185331] [Updated TLD list in TrustRoot.php Kevin Turner **20080625202419] [Added a script that helps to update the valid TLD list for trust root matching Kevin Turner **20080625202647] [Make the detect script work with 206 responses from the fetcher Kevin Turner **20080625214806] [Update version to 2.1.1 Kevin Turner **20080627224222] [TAG 2.1.1 Kevin Turner **20080627224317] [Demo server: remove stale HMACSHA1.php include Kevin Turner **20080708221715] [Provide the user_setup_url in the Auth_OpenID_SetupNeededResponse even in OpenID 2 chowells@janrain.com**20080710231823] [If we're generating user_setup_urls, let's at least do it correctly chowells@janrain.com**20080711215208] [Update version to 2.1.2 Kevin Turner **20080909191025] [TAG 2.1.2 Kevin Turner **20080909191058] [Don't use Range header for ID page requests dag@janrain.com**20081031232300] [getAliasedArg() returns OpenID namespace when $aliased_key is 'ns' sam.alexander@vidoop.com**20081107202412 This fixes an rather cryptic error when using stateless mode via the DumbStore. The 'ns' key can not be found in the alias/namespace mapping (its stored as the "Null Namespace"), it must be returned explicitly. The inability to find the key in the mapping results in a "Server Denied check_authentication" error, but the error is caused before any callback to the server is made. This also brings the PHP lib more in line with the ruby and python libs. ] [Message: indentation cygnus@janrain.com**20081107203915]