fix: get the prompt config value in a safer way

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

Author: julien-nc

lib/Controller/LoginController.php

@@ -272,7 +272,7 @@ public function login(int $providerId, ?string $redirectUrl = null) {
 			'nonce' => $nonce,
 		];
 
-		if ($oidcConfig['prompt']) {
+		if (isset($oidcConfig['prompt']) && is_string($oidcConfig['prompt'])) {
 			$data['prompt'] = $oidcConfig['prompt'];
 		}
 

lib/Service/TokenService.php

@@ -269,9 +269,10 @@ public function getExchangedToken(string $targetAudience, array $extraScopes = [
 				'audience' => $targetAudience,
 				'scope' => $scope,
 			];
-			if ($this->config->getSystemValue('user_oidc.prompt') !== '') {
+			$oidcConfig = $this->config->getSystemValue('user_oidc', []);
+			if (isset($oidcConfig['prompt']) && is_string($oidcConfig['prompt'])) {
 				// none, consent, login and internal for oauth2 passport server
-				$tokenEndpointParams['prompt'] = $this->config->getSystemValue('user_oidc.prompt');
+				$tokenEndpointParams['prompt'] = $oidcConfig['prompt'];
 			}
 			// more in https://www.keycloak.org/securing-apps/token-exchange
 			$body = $this->clientService->post(