Ticket #8702: 8702.4.diff

wp-includes/cron.php

@@ -201 +201 @@
 
         update_option( 'doing_cron', $local_time + 30 );
 
-        wp_remote_post($cron_url, array('timeout' => 0.01, 'blocking' => false));
+        wp_remote_post($cron_url, array('timeout' => 0.01, 'blocking' => false, 'sslverify' => apply_filters('https_local_ssl_verify', true)));
 }
 
 /**

wp-includes/http.php

@@ -234 +234 @@
                         } else if ( true === WP_Http_Curl::test() && apply_filters('use_curl_transport', true) ) {
                                 $working_transport['curl'] = new WP_Http_Curl();
                                 $blocking_transport[] = &$working_transport['curl'];
-                        } else if ( true === WP_Http_Streams::test() && apply_filters('use_streams_transport', true) ) {
+                        } else if ( true === WP_Http_Streams::test() && apply_filters('use_streams_transport', true) && ( isset($args['ssl']) && !$args['ssl'] ) ) {
                                 $working_transport['streams'] = new WP_Http_Streams();
                                 $blocking_transport[] = &$working_transport['streams'];
-                        } else if ( true === WP_Http_Fopen::test() && apply_filters('use_fopen_transport', true) ) {
+                        } else if ( true === WP_Http_Fopen::test() && apply_filters('use_fopen_transport', true) && ( isset($args['ssl']) && !$args['ssl'] ) ) {
                                 $working_transport['fopen'] = new WP_Http_Fopen();
                                 $blocking_transport[] = &$working_transport['fopen'];
-                        } else if ( true === WP_Http_Fsockopen::test() && apply_filters('use_fsockopen_transport', true) ) {
+                        } else if ( true === WP_Http_Fsockopen::test() && apply_filters('use_fsockopen_transport', true) && ( isset($args['ssl']) && !$args['ssl'] ) ) {
                                 $working_transport['fsockopen'] = new WP_Http_Fsockopen();
                                 $blocking_transport[] = &$working_transport['fsockopen'];
                         }
@@ -282 +282 @@
                         if ( true === WP_Http_ExtHttp::test() && apply_filters('use_http_extension_transport', true) ) {
                                 $working_transport['exthttp'] = new WP_Http_ExtHttp();
                                 $blocking_transport[] = &$working_transport['exthttp'];
-                        } else if ( true === WP_Http_Streams::test() && apply_filters('use_streams_transport', true) ) {
+                        } else if ( true === WP_Http_Curl::test() && apply_filters('use_curl_transport', true) ) {
+                                $working_transport['curl'] = new WP_Http_Curl();
+                                $blocking_transport[] = &$working_transport['curl'];
+                        } else if ( true === WP_Http_Streams::test() && apply_filters('use_streams_transport', true) && ( isset($args['ssl']) && !$args['ssl'] ) ) {
                                 $working_transport['streams'] = new WP_Http_Streams();
                                 $blocking_transport[] = &$working_transport['streams'];
-                        } else if ( true === WP_Http_Fsockopen::test() && apply_filters('use_fsockopen_transport', true) ) {
+                        } else if ( true === WP_Http_Fsockopen::test() && apply_filters('use_fsockopen_transport', true) && ( isset($args['ssl']) && !$args['ssl'] ) ) {
                                 $working_transport['fsockopen'] = new WP_Http_Fsockopen();
                                 $blocking_transport[] = &$working_transport['fsockopen'];
                         }
 
-                        foreach ( array('streams', 'fsockopen', 'exthttp') as $transport ) {
+                        foreach ( array('curl', 'streams', 'fsockopen', 'exthttp') as $transport ) {
                                 if ( isset($working_transport[$transport]) )
                                         $nonblocking_transport[] = &$working_transport[$transport];
                         }
@@ -358 +361 @@
                         'timeout' => apply_filters( 'http_request_timeout', 5),
                         'redirection' => apply_filters( 'http_request_redirection_count', 5),
                         'httpversion' => apply_filters( 'http_request_version', '1.0'),
-                        'user-agent' => apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version ),
+                        'user-agent' => apply_filters( 'http_headers_useragent', 'WordPress/' . $wp_version . '; ' . get_bloginfo( 'url' )  ),
                         'blocking' => true,
                         'headers' => array(),
                         'body' => null,
                         'compress' => false,
-                        'decompress' => true
+                        'decompress' => true,
+                        'sslverify' => true
                 );
 
                 $r = wp_parse_args( $args, $defaults );
                 $r = apply_filters( 'http_request_args', $r, $url );
 
+                $arrURL = parse_url($url);
+
+                // Determine if this is a https call and pass that on to the transport functions
+                // so that we can blacklist the transports that do not support ssl verification
+                if ( $arrURL['scheme'] == 'https' || $arrURL['scheme'] == 'ssl' )
+                        $r['ssl'] = true;
+                else
+                        $r['ssl'] = false;
+
                 if ( is_null( $r['headers'] ) )
                         $r['headers'] = array();
 
@@ -1060 +1073 @@
                         'redirect' => $r['redirection'],
                         'useragent' => $r['user-agent'],
                         'headers' => $r['headers'],
+                        'ssl' => array( 
+                                'verifypeer' => apply_filters('https_ssl_verify', $r['sslverify']),
+                                'verifyhost' => apply_filters('https_ssl_verify', $r['sslverify'])
+                        )
                 );
 
                 if ( !defined('WP_DEBUG') || ( defined('WP_DEBUG') && false === WP_DEBUG ) ) //Emits warning level notices for max redirects and timeouts
@@ -1153 +1170 @@
                         $r['timeout'] = 1;
 
                 $handle = curl_init();
+
                 curl_setopt( $handle, CURLOPT_URL, $url);
+                curl_setopt( $handle, CURLOPT_RETURNTRANSFER, true );
+                curl_setopt( $handle, CURLOPT_SSL_VERIFYHOST, apply_filters('https_ssl_verify', $r['sslverify']) );
+                curl_setopt( $handle, CURLOPT_SSL_VERIFYPEER, apply_filters('https_ssl_verify', $r['sslverify']) );
+                curl_setopt( $handle, CURLOPT_USERAGENT, $r['user-agent'] );
+                curl_setopt( $handle, CURLOPT_CONNECTTIMEOUT, $r['timeout'] );
+                curl_setopt( $handle, CURLOPT_TIMEOUT, $r['timeout'] );
+                curl_setopt( $handle, CURLOPT_MAXREDIRS, $r['redirection'] );
 
-                // The cURL extension requires that the option be set for the HEAD to
-                // work properly.
-                if ( 'HEAD' === $r['method'] ) {
-                        curl_setopt( $handle, CURLOPT_NOBODY, true );
+                switch ( $r['method'] ) {
+                        case 'HEAD':
+                                curl_setopt( $handle, CURLOPT_NOBODY, true );
+                                break;
+                        case 'POST':
+                                curl_setopt( $handle, CURLOPT_POST, true );
+                                curl_setopt( $handle, CURLOPT_POSTFIELDS, $r['body'] );
+                                break;
                 }
 
-                if ( true === $r['blocking'] ) {
+                if ( true === $r['blocking'] )
                         curl_setopt( $handle, CURLOPT_HEADER, true );
-                        curl_setopt( $handle, CURLOPT_RETURNTRANSFER, 1 );
-                } else {
+                else
                         curl_setopt( $handle, CURLOPT_HEADER, false );
-                        curl_setopt( $handle, CURLOPT_NOBODY, true );
-                        curl_setopt( $handle, CURLOPT_RETURNTRANSFER, 0 );
-                }
 
-                curl_setopt( $handle, CURLOPT_USERAGENT, $r['user-agent'] );
-                curl_setopt( $handle, CURLOPT_CONNECTTIMEOUT, 1 );
-                curl_setopt( $handle, CURLOPT_TIMEOUT, $r['timeout'] );
-                curl_setopt( $handle, CURLOPT_MAXREDIRS, $r['redirection'] );
-
                 // The option doesn't work with safe mode or when open_basedir is set.
                 if ( !ini_get('safe_mode') && !ini_get('open_basedir') )
                         curl_setopt( $handle, CURLOPT_FOLLOWLOCATION, true );