Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63626
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain strojny.net from 46.4.40.248 cause and error)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
In-Reply-To: <CAB75mSX-cMqZPTfv2vc8fakD_pr31qPR+kO5_O=zYiVoy4xH2w@mail.gmail.com>
Date: Thu, 25 Oct 2012 16:59:22 +0200
Cc: internals@lists.php.net
Content-Transfer-Encoding: quoted-printable
Message-ID: <B05C5271-ACA1-4553-B05A-8C027925BAD6@strojny.net>
References: <CAB75mSX-cMqZPTfv2vc8fakD_pr31qPR+kO5_O=zYiVoy4xH2w@mail.gmail.com>
To: JJ <jawed@php.net>
Subject: Re: [PHP-DEV] Changing the default value of "true" for CURLOPT_SSL_VERIFYHOST
From: lars@strojny.net (Lars Strojny)

Hi,

Am 25.10.2012 um 07:03 schrieb JJ <jawed@php.net>:
[...]
> My solution was to check the type for CURLOPT_SSL_VERIFYHOST: if it is
> boolean and true, the opt value for libcurl is set to 2L.
>=20
> I understand that engineers should have the proper option value to
> begin with but weighing the impact of this (MITM attacks) against
> doing what they probably meant anyways is worth the presumption.
>=20
> Please discuss and adjust the patch if necessary.

Good find. I would suggest to not actually change the behavior but throw =
a warning when a boolean is passed and advise the user to either pass =
int(1) explicitly or use int(2). Link to the manual in the warning and =
be good.

cu,
Lars=