toggl-php-sdk icon indicating copy to clipboard operation
toggl-php-sdk copied to clipboard

Fix your security!

Open DavidFromNL opened this issue 10 years ago • 0 comments

Please never never never ever use this line on a live website: curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);

If that line is needed in order to make a script work, fix it, instead of breaking security!! If your key doesn't fit your front door anymore, you fix the lock, you don't leave the door open all day. Just like that, you should fix the security on this issue as well.

It is very simple:

  • Get a copy of a up-to-date ca certificates bundle. You can get this from any modern Linux distribution, as well as from Mozilla and from the WordPress installation package.
  • Put the file in your directory
  • Refer to it using curl_setopt( $ch, CURLOPT_CAINFO, "insert-filename-here'); A good example is included in WordPresses wp-includes/class-http.php line 1411.

(Also, curl connects perfectly from my server. If you get yourself a up-to-date webserver, this wouldn't be an issue in the first place.)

DavidFromNL avatar Apr 09 '15 11:04 DavidFromNL