Merge pull request #12 from cakoose/master

HTTPS security fixes: Use TLS instead of SSL v3; actually verify server certificate.

Author: jimdoescode

libraries/Dropbox.php

@@ -477,9 +477,11 @@ private function _connect($url, $header, $request, $postdata = false, $destinati
     {
         $ch = curl_init($url);
         curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC ) ;
-        curl_setopt($ch, CURLOPT_SSLVERSION,3);
-        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
+        curl_setopt($ch, CURLOPT_SSLVERSION, 1); // Require TLS
+        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
         curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
+        curl_setopt($ch, CURLOPT_CAINFO, __DIR__."/certs/trusted-certs.crt");
+        curl_setopt($ch, CURLOPT_CAPATH, __DIR__."/certs/");
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
         curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $request);
         curl_setopt($ch, CURLOPT_HTTPHEADER, explode(self::LINE_END, $header));