FIX: Fixed filtering of ACRs in Disco.php (#160)

- wrong conditions in loop caused the filtering not to work at all

(cherry picked from commit 5fcb7c7)

Author: Dominik František Bučík

CHANGELOG.md

@@ -1,7 +1,9 @@
 # Change Log
 All notable changes to this project will be documented in this file.
- 
+
 ## [Unreleased]
+#### Fixed
+- Fixed removal of filtered authnContextClassRefs in disco
 
 ## [v5.1.0]
 #### Added
@@ -371,6 +373,7 @@ when storing one Perun attribute to more SAML attribute
 ## [v1.0.0]
 
 [Unreleased]: https://github.com/CESNET/perun-simplesamlphp-module/tree/master
+[v5.1.0]: https://github.com/CESNET/perun-simplesamlphp-module/tree/v5.1.0
 [v5.0.0]: https://github.com/CESNET/perun-simplesamlphp-module/tree/v5.0.0
 [v4.1.1]: https://github.com/CESNET/perun-simplesamlphp-module/tree/v4.1.1
 [v4.1.0]: https://github.com/CESNET/perun-simplesamlphp-module/tree/v4.1.0

lib/Disco.php

@@ -123,6 +123,7 @@ public function __construct(
                     if (isset($state['IdPMetadata']['entityid'])) {
                         $this->proxyIdpEntityId = $state['IdPMetadata']['entityid'];
                     }
+                    State::saveState($state, self::SAML_SP_SSO);
                 }
                 $e = explode("=", $returnURL)[0];
                 $newReturnURL = $e . "=" . urlencode($id);
@@ -457,11 +458,17 @@ public function removeAuthContextClassRefWithPrefixes(&$state)
         unset($state[self::SAML_REQUESTED_AUTHN_CONTEXT][self::STATE_AUTHN_CONTEXT_CLASS_REF]);
         $filteredAcrs = [];
         foreach ($this->originalAuthnContextClassRef as $acr) {
+            $acr = trim($acr);
+            $retain = true;
             foreach ($prefixes as $prefix) {
-                if (!(substr($acr, 0, strlen($prefix)) === $prefix)) {
-                    array_push($filteredAcrs, $acr);
+                if (substr($acr, 0, strlen($prefix)) === $prefix) {
+                    $retain = false;
+                    break;
                 }
             }
+            if ($retain) {
+                array_push($filteredAcrs, $acr);
+            }
         }
         if (!empty($filteredAcrs)) {
             $state[self::SAML_REQUESTED_AUTHN_CONTEXT][self::STATE_AUTHN_CONTEXT_CLASS_REF] = $filteredAcrs;