Fix CURLOPT_SSL_VERIFYHOST issue
libcurl's CURLOPT_SSL_VERIFYHOST option accepts only values 0 and 2. This fix is fail-secure in that SSL host verification will be enabled regardless of what a caller passes to Request::verifyHost($bool) unless $bool === false.
This commit is contained in:
@@ -416,7 +416,8 @@ class Request
|
||||
CURLOPT_HTTPHEADER => self::getFormattedHeaders($headers),
|
||||
CURLOPT_HEADER => true,
|
||||
CURLOPT_SSL_VERIFYPEER => self::$verifyPeer,
|
||||
CURLOPT_SSL_VERIFYHOST => self::$verifyHost,
|
||||
//CURLOPT_SSL_VERIFYHOST accepts only 0 (false) or 2 (true). Future versions of libcurl will treat values 1 and 2 as equals
|
||||
CURLOPT_SSL_VERIFYHOST => self::$verifyHost === false ? 0 : 2,
|
||||
// If an empty string, '', is set, a header containing all supported encoding types is sent
|
||||
CURLOPT_ENCODING => ''
|
||||
));
|
||||
|
||||
Reference in New Issue
Block a user