Missing TLS certificate verification when built with ancient libsoup

nzjrs / osm-gps-map

A Gtk+ Widget for Displaying OpenStreetMap tiles LOOKING FOR A NEW MAINTAINER

http://nzjrs.github.com/osm-gps-map

GNU General Public License v2.0

135 stars 58 forks source link

Closed mcatanzaro closed 3 years ago

mcatanzaro commented 3 years ago

Hi, osm-gps-map-widget.c does not appear to be enabling TLS certificate verification on the SoupSessionAsync object it creates when built against libsoup older than 2.42. You have to do this manually when using the deprecated SoupSessionAsync.

I figure this should affect almost nobody in 2021, since libsoup 2.42 is old now, but I'm reporting it anyway because, well, the code is still there.

johnny-bit commented 3 years ago

Looks like the best bet would be to drop support for libsoup older than 2.42