Thank you very much for your report!
getSystemUrl() shall always end with a slash, so the bug must be in getSystemUrl().
Unfortunately, I could only reproduce the bug if the base config setting EXPLICIT_ABSOLUTE_SYSTEM_URL is used.
Otherwise it seems to be impossible because the code says $res .= '/'
Is it possible that you are using EXPLICIT_ABSOLUTE_SYSTEM_URL? In that case, SVN revision 494 should fix your problem.
Thank you for your suggestions, too.
(1) To support multiple OAuth providers was already in the TODO list. I have added the URLs to the TODO entry.
(2) I think it is technically impossible to encrypt the API credentials, because the PHP script oauth.php needs to read the values.
Where should the encryption key be located?
There seem to be only 3 possibilities I can think of:
- The key is the base config SERVER_SECRET
- The key is stored in a file in the file system
- The key is stored in the database
All 3 possibilities will not be secure, because if an attacker can read config.inc.php , then they also know SERVER_SECRET, and they also have the credentials for the database, so they can get the encryption key easily.
Or is there a different possibility? Please let me know.
|