Fix for #663 and Test case

2 files changed, 20 insertions, 0 deletions

diff --git a/test/OAuth2/Controller/AuthorizeControllerTest.php b/test/OAuth2/Controller/AuthorizeControllerTest.php
index c2745d6..3bfc760 100644
--- a/test/OAuth2/Controller/AuthorizeControllerTest.php
+++ b/test/OAuth2/Controller/AuthorizeControllerTest.php
@@ -178,6 +178,22 @@ class AuthorizeControllerTest extends \PHPUnit_Framework_TestCase
         $this->assertEquals($response->getParameter('error_description'), 'The redirect URI provided is missing or does not match');
     }
 
+    public function testInvalidRedirectUriApprovedByBuggyRegisteredUri()
+    {
+        $server = $this->getTestServer();
+        $server->setConfig('require_exact_redirect_uri', false);
+        $request = new Request(array(
+            'client_id' => 'Test Client ID with Buggy Redirect Uri', // valid client id
+            'redirect_uri' => 'http://adobe.com', // invalid redirect URI
+            'response_type' => 'code',
+        ));
+        $server->handleAuthorizeRequest($request, $response = new Response(), true);
+
+        $this->assertEquals($response->getStatusCode(), 400);
+        $this->assertEquals($response->getParameter('error'), 'redirect_uri_mismatch');
+        $this->assertEquals($response->getParameter('error_description'), 'The redirect URI provided is missing or does not match');
+    }
+
     public function testNoRedirectUriWithMultipleRedirectUris()
     {
         $server = $this->getTestServer();
diff --git a/test/config/storage.json b/test/config/storage.json
index 2d43c07..a31d3bc 100644
--- a/test/config/storage.json
+++ b/test/config/storage.json
@@ -42,6 +42,10 @@
             "client_secret": "TestSecret2",
             "redirect_uri": "http://brentertainment.com"
         },
+        "Test Client ID with Buggy Redirect Uri": {
+            "client_secret": "TestSecret2",
+            "redirect_uri": "  http://brentertainment.com"
+        },
         "Test Client ID with Multiple Redirect Uris": {
             "client_secret": "TestSecret3",
             "redirect_uri": "http://brentertainment.com http://morehazards.com"