Changeset 34639

Timestamp:

09/27/2015 09:37:00 PM (9 years ago)

Author:

johnbillion

Message:

Don't set CURLOPT_CAINFO when sslverify is false when sending HTTP API requests through cURL. This avoids sending redundant information to cURL, and avoids a bug in Apple's SecureTransport library which causes a request to fail when a CA bundle is set but certificate verification is disabled.

This fixes issues with local HTTPS requests (eg. WP Cron) on OS X where cURL is using SecureTransport instead of OpenSSL.

Fixes #33978

Location:

trunk

Files:

• src/wp-includes/class-wp-http-curl.php (modified) (1 diff)
• tests/phpunit/tests/http/base.php (modified) (3 diffs)

trunk/src/wp-includes/class-wp-http-curl.php

@@ -134 +134 @@
         curl_setopt( $handle, CURLOPT_SSL_VERIFYHOST, ( $ssl_verify === true ) ? 2 : false );
         curl_setopt( $handle, CURLOPT_SSL_VERIFYPEER, $ssl_verify );
-        curl_setopt( $handle, CURLOPT_CAINFO, $r['sslcertificates'] );
+
+        if ( $ssl_verify ) {
+            curl_setopt( $handle, CURLOPT_CAINFO, $r['sslcertificates'] );
+        }
+
         curl_setopt( $handle, CURLOPT_USERAGENT, $r['user-agent'] );
 

trunk/tests/phpunit/tests/http/base.php

@@ -16 +16 @@
     var $fileStreamUrl = 'http://s.w.org/screenshots/3.9/dashboard.png';
 
+    protected $http_request_args;
+
     function setUp() {
 
@@ -41 +43 @@
         }
         parent::tearDown();
+    }
+
+    function filter_http_request_args( array $args ) {
+        $this->http_request_args = $args;
+        return $args;
     }
 
@@ -284 +291 @@
 
     /**
+     * Test HTTP requests where SSL verification is disabled but the CA bundle is still populated
+     *
+     * @ticket 33978
+     */
+    function test_https_url_without_ssl_verification() {
+        $url = 'https://wordpress.org/';
+        $args = array(
+            'sslverify' => false,
+        );
+
+        add_filter( 'http_request_args', array( $this, 'filter_http_request_args' ) );
+
+        $res = wp_remote_head( $url, $args );
+
+        remove_filter( 'http_request_args', array( $this, 'filter_http_request_args' ) );
+
+        $this->assertNotEmpty( $this->http_request_args['sslcertificates'] );
+        $this->assertNotWPError( $res );
+    }
+
+    /**
      * Test HTTP Redirects with multiple Location headers specified
      *