CRM-11160 - Set CURLOPT_SSL_VERIFYHOST based the system's general "verifySSL" option

[totten]

We currently set Curl's VERIFYPEER option based on the CiviCRM setting, "verifySSL." This patch carries that forward to also set the VERIFYHOST option.

Per email discussion, it would be great if @deepak-srivastava and @eileenmcnaughton could test a couple of the payment processors that are affected by this.

---

• CRM-11160:
  http://issues.civicrm.org/jira/browse/CRM-11160

[totten]

Note: In manual testing, I didn't do a full setup with each of the payment processors. Instead, I copied most of the curl_*() statements and checked to see which SSL errors arose under which conditions. (The results were as expected.)

For testing a valid SSL URL, 'https://civicrm.org/README.txt' was OK; for testing an invalid SSL URL, 'https://www-prod.civicrm.osuosl.org/README.txt' was interesting because the cert was valid but its hostname was mismatched.

[mc0e]

I think we also need a warning to the site administrator if the SSL settings are not secure. There are good reasons why you might want to disregard the SSL issues during testing, but without a warning it's easy to forget about this when going to production, and also it's likely that most admins will not perceive a problem unless something is failing or telling them there's a problem.

[xurizaemon]

Is there a reason we'd ever want to set CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER to FALSE for these payment processors? Unless there's a need to test a payment processor which serves with invalid SSL, I say we leave these locked in a sensible config. That should eliminate the situation @mc0e suggested above too?

In my experience most test processors either spring for valid SSL or test on plain HTTP.

https://github.com/totten/civicrm-core/blob/17c04b52f3d0079795426a5e7a3444b92a3dedbc/CRM/Core/Payment/PayPalImpl.php and https://github.com/totten/civicrm-core/blob/17c04b52f3d0079795426a5e7a3444b92a3dedbc/CRM/Core/Payment/Google.php shouldn't retain the "turning off server & peer verification" comment