search

tebexio / BuycraftPM

MIT License
23 stars 25 forks source link

Possibility of MITM due to CURLOPT_SSL_VERIFYPEER disabled #48

Closed Muqsit closed 1 year ago

Muqsit commented 4 years ago

As explained in this comment on php.net, setting CURLOPT_SSL_VERIFYPEER to false stops cURL from verifying the peer's certificate. An approach to deal with SSL certificates not being installed in the machine by default would be providing a CA certificate along with the plugin.

References to CURLOPT_SSL_VERIFYPEER => false:

  1. https://github.com/tebexio/BuycraftPM/blob/b6c6bbef49eda9927275522b16c2f8a491c5dc74/src/Buycraft/PocketMine/PluginApi.php#L78
  2. https://github.com/tebexio/BuycraftPM/blob/b6c6bbef49eda9927275522b16c2f8a491c5dc74/src/Buycraft/PocketMine/PluginApi.php#L119
  3. https://github.com/tebexio/BuycraftPM/blob/e3582893c058fea833c0be335e3f798943960c01/src/Buycraft/PocketMine/Util/ReportUtil.php#L91