From 5c4a23bdbd6d4be20f89518bc4c656815ae058bc Mon Sep 17 00:00:00 2001 From: Nicolae Iotu Date: Sun, 26 Nov 2023 04:36:03 +0000 Subject: [PATCH 1/2] Skip hostname checks if CURLRequest options 'verify' is set to false. When CURLRequest options 'verify' is set to false, some CURLOPT_SSL_... options should be disabled in such a way as to allow requests to pass through in case the destination is for example on private networks. --- system/HTTP/CURLRequest.php | 4 ++++ tests/system/HTTP/CURLRequestTest.php | 3 +++ 2 files changed, 7 insertions(+) diff --git a/system/HTTP/CURLRequest.php b/system/HTTP/CURLRequest.php index 3be8214d42b4..cd47642d6e19 100644 --- a/system/HTTP/CURLRequest.php +++ b/system/HTTP/CURLRequest.php @@ -495,6 +495,10 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) $curlOptions[CURLOPT_SSL_VERIFYPEER] = 1; } elseif (is_bool($config['verify'])) { $curlOptions[CURLOPT_SSL_VERIFYPEER] = $config['verify']; + + if ($config['verify'] === FALSE) { + $curlOptions[CURLOPT_SSL_VERIFYHOST] = 0; + } } } diff --git a/tests/system/HTTP/CURLRequestTest.php b/tests/system/HTTP/CURLRequestTest.php index c1ac77765a44..d8f083cb6e4b 100644 --- a/tests/system/HTTP/CURLRequestTest.php +++ b/tests/system/HTTP/CURLRequestTest.php @@ -502,6 +502,9 @@ public function testSSLVerification() $this->assertArrayHasKey(CURLOPT_SSL_VERIFYPEER, $options); $this->assertSame(1, $options[CURLOPT_SSL_VERIFYPEER]); + + $this->assertArrayHasKey(CURLOPT_SSL_VERIFYHOST, $options); + $this->assertSame(2, $options[CURLOPT_SSL_VERIFYHOST]); } public function testSSLWithBadKey() From d70b40ae0df82916fc8e804ae3c238782fc0de4c Mon Sep 17 00:00:00 2001 From: Nicolae Iotu Date: Sun, 26 Nov 2023 04:36:03 +0000 Subject: [PATCH 2/2] Skip hostname checks if CURLRequest options 'verify' is set to false. When CURLRequest options 'verify' is set to false, some CURLOPT_SSL_... options should be disabled in such a way as to allow requests to pass through in case the destination is for example on private networks. --- system/HTTP/CURLRequest.php | 4 ++++ tests/system/HTTP/CURLRequestTest.php | 3 +++ 2 files changed, 7 insertions(+) diff --git a/system/HTTP/CURLRequest.php b/system/HTTP/CURLRequest.php index 3be8214d42b4..cd47642d6e19 100644 --- a/system/HTTP/CURLRequest.php +++ b/system/HTTP/CURLRequest.php @@ -495,6 +495,10 @@ protected function setCURLOptions(array $curlOptions = [], array $config = []) $curlOptions[CURLOPT_SSL_VERIFYPEER] = 1; } elseif (is_bool($config['verify'])) { $curlOptions[CURLOPT_SSL_VERIFYPEER] = $config['verify']; + + if ($config['verify'] === FALSE) { + $curlOptions[CURLOPT_SSL_VERIFYHOST] = 0; + } } } diff --git a/tests/system/HTTP/CURLRequestTest.php b/tests/system/HTTP/CURLRequestTest.php index c1ac77765a44..d8f083cb6e4b 100644 --- a/tests/system/HTTP/CURLRequestTest.php +++ b/tests/system/HTTP/CURLRequestTest.php @@ -502,6 +502,9 @@ public function testSSLVerification() $this->assertArrayHasKey(CURLOPT_SSL_VERIFYPEER, $options); $this->assertSame(1, $options[CURLOPT_SSL_VERIFYPEER]); + + $this->assertArrayHasKey(CURLOPT_SSL_VERIFYHOST, $options); + $this->assertSame(2, $options[CURLOPT_SSL_VERIFYHOST]); } public function testSSLWithBadKey()