Changeset 34639

Timestamp:

09/27/2015 09:37:00 PM (11 years ago)

Author:

johnbillion

Message:

Don't set CURLOPT_CAINFO when sslverify is false when sending HTTP API requests through cURL. This avoids sending redundant information to cURL, and avoids a bug in Apple's SecureTransport library which causes a request to fail when a CA bundle is set but certificate verification is disabled.

This fixes issues with local HTTPS requests (eg. WP Cron) on OS X where cURL is using SecureTransport instead of OpenSSL.

Fixes #33978

Location:

trunk

Files:

• src/wp-includes/class-wp-http-curl.php (modified) (1 diff)
• tests/phpunit/tests/http/base.php (modified) (3 diffs)

trunk/src/wp-includes/class-wp-http-curl.php

@@ -134 +134 @@
                 curl_setopt( $handle, CURLOPT_SSL_VERIFYHOST, ( $ssl_verify === true ) ? 2 : false );
                 curl_setopt( $handle, CURLOPT_SSL_VERIFYPEER, $ssl_verify );
-                curl_setopt( $handle, CURLOPT_CAINFO, $r['sslcertificates'] );
+
+                if ( $ssl_verify ) {
+                        curl_setopt( $handle, CURLOPT_CAINFO, $r['sslcertificates'] );
+                }
+
                 curl_setopt( $handle, CURLOPT_USERAGENT, $r['user-agent'] );
 

trunk/tests/phpunit/tests/http/base.php

@@ -16 +16 @@
         var $fileStreamUrl = 'http://s.w.org/screenshots/3.9/dashboard.png';
 
+        protected $http_request_args;
+
         function setUp() {
 
@@ -41 +43 @@
                 }
                 parent::tearDown();
+        }
+
+        function filter_http_request_args( array $args ) {
+                $this->http_request_args = $args;
+                return $args;
         }
 
@@ -284 +291 @@
 
         /**
+         * Test HTTP requests where SSL verification is disabled but the CA bundle is still populated
+         *
+         * @ticket 33978
+         */
+        function test_https_url_without_ssl_verification() {
+                $url = 'https://wordpress.org/';
+                $args = array(
+                        'sslverify' => false,
+                );
+
+                add_filter( 'http_request_args', array( $this, 'filter_http_request_args' ) );
+
+                $res = wp_remote_head( $url, $args );
+
+                remove_filter( 'http_request_args', array( $this, 'filter_http_request_args' ) );
+
+                $this->assertNotEmpty( $this->http_request_args['sslcertificates'] );
+                $this->assertNotWPError( $res );
+        }
+
+        /**
          * Test HTTP Redirects with multiple Location headers specified
          *