Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix your security! #6

Open
DavidFromNL opened this issue Apr 9, 2015 · 0 comments
Open

Fix your security! #6

DavidFromNL opened this issue Apr 9, 2015 · 0 comments

Comments

@DavidFromNL
Copy link

Please never never never ever use this line on a live website:
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);

If that line is needed in order to make a script work, fix it, instead of breaking security!! If your key doesn't fit your front door anymore, you fix the lock, you don't leave the door open all day. Just like that, you should fix the security on this issue as well.

It is very simple:

  • Get a copy of a up-to-date ca certificates bundle. You can get this from any modern Linux distribution, as well as from Mozilla and from the WordPress installation package.
  • Put the file in your directory
  • Refer to it using curl_setopt( $ch, CURLOPT_CAINFO, "insert-filename-here');
    A good example is included in WordPresses wp-includes/class-http.php line 1411.

(Also, curl connects perfectly from my server. If you get yourself a up-to-date webserver, this wouldn't be an issue in the first place.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant