Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63696
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAB75mSVg10VURjFmOhNQk87CqVP9FOQmcSzzgfMUTEb6S7WvxQ@mail.gmail.com>
References: <CAB75mSX-cMqZPTfv2vc8fakD_pr31qPR+kO5_O=zYiVoy4xH2w@mail.gmail.com>
	<CAL+t6cF=e_55=v9bZVy7Tv=V3M4CUQLueu=b5Efa+MD0ewG_qA@mail.gmail.com>
	<CAB75mSVg10VURjFmOhNQk87CqVP9FOQmcSzzgfMUTEb6S7WvxQ@mail.gmail.com>
Date: Sun, 28 Oct 2012 17:41:58 -0700
Message-ID: <CADNQb0UFoKViurdNKBEa7TSqgtbfo_14eCMLQAWFjAB6M8+-Sg@mail.gmail.com>
To: JJ <jawed@php.net>
Cc: Sherif Ramadan <theanomaly.is@gmail.com>, internals@lists.php.net
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Changing the default value of "true" for CURLOPT_SSL_VERIFYHOST
From: hannes.magnusson@gmail.com (Hannes Magnusson)

On Wed, Oct 24, 2012 at 10:46 PM, JJ <jawed@php.net> wrote:
> On Wed, Oct 24, 2012 at 10:34 PM, Sherif Ramadan
> <theanomaly.is@gmail.com> wrote:
>> I understand there are people out there that don't read the
>> documentation and aren't aware of the difference between
>> curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); and curl_setopt($ch,
>> CURLOPT_SSL_VERIFYHOST, true); but still... I don't think this is a
>> good idea either.
>
> I highly doubt code that sets CURLOPT_SSL_VERIFYHOST => true meant to
> imply CURLOPT_SSL_VERIFYHOST => 1...which essentially bypasses host
> verification.
>
> According to libcurl, CURLOPT_SSL_VERIFYHOST => 1 is "not ordinarily a
> useful setting".


The curl stream wrapper sets this option to 1 when using the
curl_verify_ssl_host context option.
I imagine that should be fixed too then?

-Hannes