Skip to content

Commit 2d7abfd

Browse files
author
epriestley
committed
Use HTTPS, not HTTP, in install scripts
Summary: Via HackerOne. A researcher correctly reports that our install scripts use `HTTP`, not `HTTPS`, to fetch resources and execute them as `root`, which is a potentially significant vulnerability. Instead, use `HTTPS`. Test Plan: Verified that these URIs function correctly over `HTTPS`. Reviewers: chad Reviewed By: chad Differential Revision: https://secure.phabricator.com/D16958
1 parent d1838fa commit 2d7abfd

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

scripts/install/install_rhel-derivs.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ then
6767
if [ $? -ne 0 ]; then
6868
echo "It doesn't look like you have the EPEL repo enabled. We are to add it"
6969
echo "for you, so that we can install git."
70-
$SUDO rpm -Uvh http://download.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm
70+
$SUDO rpm -Uvh https://download.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm
7171
fi
7272
YUMCOMMAND="$SUDO yum install httpd git php53 php53-cli php53-mysql php53-process php53-devel php53-gd gcc wget make pcre-devel mysql-server"
7373
else
@@ -92,7 +92,7 @@ then
9292
# Now that we've ensured all the devel packages required for pecl/apc are there, let's
9393
# set up PEAR, and install apc.
9494
echo "Attempting to install PEAR"
95-
wget http://pear.php.net/go-pear.phar
95+
wget https://pear.php.net/go-pear.phar
9696
$SUDO php go-pear.phar && $SUDO pecl install apc
9797
fi
9898

0 commit comments

Comments
 (0)