validate the openid url as well. We won't change it if it's bogus, but we won't use...

diff --git a/mod/settings.php b/mod/settings.php
index 079c835b5af621b75e9259090767f40709e91de6..eb27de06efc255aa8383750bcf71983b8d3f002d 100644 (file)
--- a/mod/settings.php
+++ b/mod/settings.php
@@ -117,7 +117,8 @@ function settings_post(&$a) {
        // If openid has changed or if there's an openid but no openidserver, try and discover it.
 
        if($openid != $a->user['openid'] || (strlen($openid) && (! strlen($openidserver)))) {
-               if(strlen($openid)) {
+               $tmp_str = $openid;
+               if(strlen($tmp_str) && validate_url($tmp_str)) {
                        logger('updating openidserver');
                        require_once('library/openid.php');
                        $open_id_obj = new LightOpenID;