Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63613
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAB75mSVg10VURjFmOhNQk87CqVP9FOQmcSzzgfMUTEb6S7WvxQ@mail.gmail.com>
References: <CAB75mSX-cMqZPTfv2vc8fakD_pr31qPR+kO5_O=zYiVoy4xH2w@mail.gmail.com>
	<CAL+t6cF=e_55=v9bZVy7Tv=V3M4CUQLueu=b5Efa+MD0ewG_qA@mail.gmail.com>
	<CAB75mSVg10VURjFmOhNQk87CqVP9FOQmcSzzgfMUTEb6S7WvxQ@mail.gmail.com>
Date: Thu, 25 Oct 2012 02:21:00 -0400
Message-ID: <CAL+t6cEDORaPR5pauqDLL7vUxmL7=MiKQyD4YaLvsLXOg_kSRg@mail.gmail.com>
To: JJ <jawed@php.net>
Cc: internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Changing the default value of "true" for CURLOPT_SSL_VERIFYHOST
From: theanomaly.is@gmail.com (Sherif Ramadan)

On Thu, Oct 25, 2012 at 1:46 AM, JJ <jawed@php.net> wrote:
> On Wed, Oct 24, 2012 at 10:34 PM, Sherif Ramadan
> <theanomaly.is@gmail.com> wrote:
>> I understand there are people out there that don't read the
>> documentation and aren't aware of the difference between
>> curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); and curl_setopt($ch,
>> CURLOPT_SSL_VERIFYHOST, true); but still... I don't think this is a
>> good idea either.
>
> I highly doubt code that sets CURLOPT_SSL_VERIFYHOST => true meant to
> imply CURLOPT_SSL_VERIFYHOST => 1...which essentially bypasses host
> verification.

That's not our place to start guessing what the user did or did not
intend. The fact remains that a cast of a boolean true to int is in
fact 1. The fact also remains that CURLOPT_SSL_VERIFYHOST expects an
int as per the documented behavior. The fact additionally remains that
no user would expect var_dump((int) true) to return int(2).

>
> According to libcurl, CURLOPT_SSL_VERIFYHOST => 1 is "not ordinarily a
> useful setting".
>

Again, you're confusing users who don't read documentation and/or
don't understand it with users who may have fully read documentation
and understood it perfectly well and ever intention of setting
CURLOPT_SSL_VERIFYHOST to 1.

I understand your intentions here are good, but we should not be
magically trying to guess what the user wants. We should document the
behavior clearly and this solution makes documentation completely
unclear. Nowhere in the PHP manual do we say "we might break the
promise of a boolean cast to int and make it int(2) instead of
int(1)".

> - JJ