From 2ff3957c3b49d8ed27e84f5aa9ee72c2eb24c684 Mon Sep 17 00:00:00 2001
From: "Cathy J. Fitzpatrick" <cathy@cathyjf.com>
Date: Sun, 10 Feb 2013 20:08:31 -0700
Subject: [PATCH] Don't sign assertions for invalid usernames

---
 action.php | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/action.php b/action.php
index f96baa9ee..5653cad5c 100644
--- a/action.php
+++ b/action.php
@@ -109,8 +109,15 @@ foreach ($reqs as $reqData) {
 		$challengekeyid = !isset($reqData['challengekeyid']) ? -1 : intval($reqData['challengekeyid']);
 		$challenge = !isset($reqData['challenge']) ? '' : $reqData['challenge'];
 		header('Content-type: text/plain; charset=utf-8');
-		if (empty($reqData['userid'])) $userid = $curuser['userid'];
-		else $userid = $users->userid($reqData['userid']);
+		if (empty($reqData['userid'])) {
+			$userid = $curuser['userid'];
+			if ($userid === 'guest') {
+				// Special error message for this case.
+				die(';');
+			}
+		} else {
+			$userid = $users->userid($reqData['userid']);
+		}
 		$serverhostname = htmlspecialchars($serverhostname);	// Protect against theoretical IE6 XSS
 		die($users->getAssertion($userid, $serverhostname, null, $challengekeyid, $challenge));
 		break;