search

jimdoescode / CodeIgniter-Dropbox-API-Library

This library is written for the CodeIgniter PHP framework and is meant to interact with the Dropbox API
http://jimdoescode.blogspot.com/2011/07/codeigniter-dropbox-api.html
154 stars 56 forks source link

HTTPS security fixes: Use TLS instead of SSL v3; actually verify server certificate. #12

Closed cakoose closed 9 years ago

cakoose commented 10 years ago

SSLv3 has known security vulnerabilities. Dropbox is going to disable SSLv3 soon, so switch to TLS.

cakoose commented 10 years ago

I don't really know anything about CodeIgniter and am not currently set up to test this change. I believe it's a relatively safe change, but I'd appreciate it if you could test it out.

cakoose commented 10 years ago

@jimdoescode: Is there a chance this will get merged soon? Dropbox is going to disable SSLv3 in a week or so.

jimdoescode commented 10 years ago

Sorry, for some reason I no longer get emails for pull requests from this project.

Where does the certificate come from? I'm a little hesitant to include a certificate if it's not provided by Dropbox.

cakoose commented 10 years ago

Oh, good point.

This certificate list should match up exactly with the one in the official Dropbox SDKs. For example, here's the one in the official PHP SDK: https://github.com/dropbox/dropbox-sdk-php/blob/master/lib/Dropbox/certs/trusted-certs.crt

jimdoescode commented 10 years ago

Oh gotcha. I'll test this out over the weekend and merge. Thanks for the heads up!

ryne-andal commented 9 years ago

I've confirmed this pull request works.

jimdoescode commented 9 years ago

Thanks brotha @ryne-andal