From: Scott Cantor <cantor.2@osu.edu>
Date: Mon, 13 Nov 2017 13:56:53 -0500
Subject: Security fix from V2.6.1 (SSPCPP-763)

(cherry picked from commit b66cceb0e992c351ad5e2c665229ede82f261b16)

Dynamic MetadataProvider fails to install security filters
============================================================
The Shibboleth Service Provider software includes a MetadataProvider
plugin with the plugin type "Dynamic" to obtain metadata on demand
from a query server, in place of the more typical mode of downloading
aggregates separately containing all of the metadata to load.

All the plugin types rely on MetadataFilter plugins to perform critical
security checks such as signature verification, enforcement of validity
periods, and other checks specific to deployments.

Due to a coding error, the "Dynamic" plugin fails to configure itself
with the filters provided to it and thus omits whatever checks they are
intended to perform, which will typically leave deployments vulnerable
to active attacks involving the substitution of metadata if the network
path to the query service is compromised.

Credits
=========
Rod Widdowson, Steading System Software LLP

URL for the full Security Advisory:
http://shibboleth.internet2.edu/secadv/secadv_20171115.txt
---
 shibsp/metadata/DynamicMetadataProvider.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/shibsp/metadata/DynamicMetadataProvider.cpp b/shibsp/metadata/DynamicMetadataProvider.cpp
index 8853acb..d416a00 100644
--- a/shibsp/metadata/DynamicMetadataProvider.cpp
+++ b/shibsp/metadata/DynamicMetadataProvider.cpp
@@ -95,7 +95,7 @@ namespace shibsp {
 };
 
 DynamicMetadataProvider::DynamicMetadataProvider(const DOMElement* e)
-    : saml2md::DynamicMetadataProvider(e),
+    : saml2md::DynamicMetadataProvider(e), MetadataProvider(e),
         m_verifyHost(XMLHelper::getAttrBool(e, true, verifyHost)),
         m_ignoreTransport(XMLHelper::getAttrBool(e, false, ignoreTransport)),
         m_encoded(true), m_trust(nullptr)
