Check destination against the getSelfURLNoQuery as well on LogoutRequest and LogoutResponse as we do on Response

Author: pitbulk

src/Saml2/LogoutRequest.php

@@ -393,11 +393,15 @@ public function isValid($retrieveParametersFromServer = false)
                 // Check destination
                 if ($dom->documentElement->hasAttribute('Destination')) {
                     $destination = $dom->documentElement->getAttribute('Destination');
-                    if (!empty($destination) && strpos($destination, $currentURL) === false) {
-                        throw new ValidationError(
-                            "The LogoutRequest was received at $currentURL instead of $destination",
-                            ValidationError::WRONG_DESTINATION
-                        );
+                    if (!empty($destination) && strpos($destination, $currentURL) !== 0) {
+                        $currentURLNoRouted = Utils::getSelfURLNoQuery();
+
+                        if (strpos($destination, $currentURLNoRouted) !== 0) {
+                            throw new ValidationError(
+                                "The LogoutRequest was received at $currentURL instead of $destination",
+                                ValidationError::WRONG_DESTINATION
+                            );
+                        }
                     }
                 }
 

src/Saml2/LogoutResponse.php

@@ -188,11 +188,15 @@ public function isValid($requestId = null, $retrieveParametersFromServer = false
                 // Check destination
                 if ($this->document->documentElement->hasAttribute('Destination')) {
                     $destination = $this->document->documentElement->getAttribute('Destination');
-                    if (!empty($destination) && strpos($destination, $currentURL) === false) {
-                        throw new ValidationError(
-                            "The LogoutResponse was received at $currentURL instead of $destination",
-                            ValidationError::WRONG_DESTINATION
-                        );
+                    if (!empty($destination) && strpos($destination, $currentURL) !== 0) {
+                        $currentURLNoRouted = Utils::getSelfURLNoQuery();
+
+                        if (strpos($destination, $currentURLNoRouted) !== 0) {
+                            throw new ValidationError(
+                                "The LogoutResponse was received at $currentURL instead of $destination",
+                                ValidationError::WRONG_DESTINATION
+                            );
+                        }
                     }
                 }