> I thus suggest we simply ban 1 as a value in an upcoming release. This will fource users to use 2 instead and when copying such code back to older libcurl-using code that will improve the code running there as well!

You can't force users to use 2, since if they are not reading the documents, they might also ignore the return code (I'm not sure which mistake is worse ;-).

> See my attached patch that does exactly this. As this *will* cause one or two legitimate users get an error I'm very interested in further feedback.

I suggest turning on the bit 'data->set.ssl.verifyhost' in case we got '1' as argument (yet return the error code) to keep the code secure.

> The PHP guys discussed doing the change in there end, in this discussion:
> http://thread.gmane.org/gmane.comp.php.devel/76531/focus=76546
> ... but I saw nobody agreeing to that.

Even if they will agree to do the change, it will take time till their users (which version?) will upgrade, so in the meanwhile we will have curl-php users that will still use TRUE (==1) as an argument to 'CURLOPT_SSL_VERIFYHOST'.

Yehezkel Horowitz

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2012-10-28