Request validation fails if allow_url_fopen is disabled

[SDPrio]

Downloading certificate in RequestValidator->validateSignature uses file_get_contents and thus depends on allow_url_fopen to be enabled. For security reasons this is not the case on many servers. In these cases file_get_contents will fail and simply return an empty string. The validation will fail as well of course.

Can be fixed by using curl instead or as fallback:

if (ini_get('allow_url_fopen')) {
    $certData = @file_get_contents($request->signatureCertChainUrl);
} else {
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $request->signatureCertChainUrl);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $certData = curl_exec($ch);
    curl_close($ch);
} 

[maxbeckers]

Yes, you're right. But I would prefer to change it to guzzle, we have already in the project.

[SDPrio]

Great! Thank you very much!