fix: Prevent error page to display arbitrary error messages

fix: Prevent error page to display arbitrary error messages

Signed-off-by: Carl Schwan <carlschwan@kde.org>

[skip ci]

Author: CarlSchwan

lib/AppInfo/Application.php

@@ -10,6 +10,7 @@
 namespace OCA\User_SAML\AppInfo;
 
 use OC\Security\CSRF\CsrfTokenManager;
+use OC\User\DisabledUserException;
 use OC\User\LoginException;
 use OC_User;
 use OCA\DAV\Events\SabrePluginAddEvent;
@@ -128,12 +129,14 @@ public function boot(IBootContext $context): void {
 						if ($request->getPathInfo() === '/apps/user_saml/saml/error') {
 							return;
 						}
+						/** @psalm-suppress UndefinedClass */
 						$targetUrl = $urlGenerator->linkToRouteAbsolute(
 							'user_saml.SAML.genericError',
 							[
-								'message' => $e->getMessage()
+								'reason' => $e instanceof DisabledUserException ? 'userDisabled' : 'authFailed',
 							]
 						);
+						$logger->error('Login failure', ['exception' => $e]);
 						header('Location: ' . $targetUrl);
 						exit();
 					}
@@ -151,7 +154,7 @@ public function boot(IBootContext $context): void {
 						$targetUrl = $urlGenerator->linkToRouteAbsolute(
 							'user_saml.SAML.genericError',
 							[
-								'message' => $l10n->t('This user account is disabled, please contact your administrator.')
+								'reason' => 'userDisabled',
 							]
 						);
 						header('Location: ' . $targetUrl);