Permalink
Browse files

Merge branch 'v0.61'

  • Loading branch information...
2 parents 4d03bf8 + 904cc33 commit 64e2330b45fb722204a0ecf4a4cfe6a5e206e3d7 @themattharris committed Jan 17, 2012
Showing with 14 additions and 13 deletions.
  1. +5 −1 README.md
  2. +1 −1 examples/verify_ssl.php
  3. +7 −8 tmhOAuth.php
  4. +1 −3 tmhUtilities.php
View
@@ -23,7 +23,7 @@ of PHP is lower than this you should ask your hosting provider for an update.
## A note about security and SSL
-Version 0.60 hardens the security of the library and defaults `verify_ssl` to `true`.
+Version 0.60 hardens the security of the library and defaults `curl_ssl_verifypeer` to `true`.
As some hosting providers do not provide the most current certificate root file
it is now included in this repository. If the version is out of date OR you prefer
to download the certificate roots yourself, you can get them
@@ -48,6 +48,10 @@ you should now define them as `'key' => 'value'` pairs.
## Change History
+### 0.61 - 16 January 2012
+- Removed trailing ?> from tmhOAuth.php and tmhUtilities.php to meet the Zend Framework's coding practices. Props: reedy
+- Fixed bug where CURLOPT_SSL_VERIFYHOST was defaulted to true when it should have been defaulted to 2. Props: kevinsmcarthur
+
### 0.60 - 29 December 2011
- Changed any use of implode to the preferred format of implode($glue, $pieces). Props: reedy
- Moved oauth_verifier to the authorization header as shown in example of RFC 5849. Props: spacenick
View
@@ -30,7 +30,7 @@
$tmhOAuth = new tmhOAuth(array(
'curl_ssl_verifypeer' => true,
- 'curl_ssl_verifyhost' => true,
+ 'curl_ssl_verifyhost' => 2,
));
View
@@ -7,12 +7,12 @@
* REST requests. OAuth authentication is sent using the an Authorization Header.
*
* @author themattharris
- * @version 0.60
+ * @version 0.61
*
- * 29 December 2011
+ * 16 January 2012
*/
class tmhOAuth {
- const VERSION = 0.60;
+ const VERSION = 0.61;
/**
* Creates a new tmhOAuth object
@@ -52,8 +52,9 @@ function __construct($config) {
'curl_connecttimeout' => 30,
'curl_timeout' => 10,
- // for security these should always be set to true.
- 'curl_ssl_verifyhost' => true,
+ // for security this should always be set to 2.
+ 'curl_ssl_verifyhost' => 2,
+ // for security this should always be set to true.
'curl_ssl_verifypeer' => true,
// you can get the latest cacert.pem from here http://curl.haxx.se/ca/cacert.pem
@@ -652,6 +653,4 @@ private function curlit() {
$this->response['errno'] = $errno;
return $code;
}
-}
-
-?>
+}
View
@@ -246,6 +246,4 @@ function endswith($haystack, $needle) {
return substr_compare($haystack, $needle, -$needlelen) === 0;
}
-}
-
-?>
+}

0 comments on commit 64e2330

Please sign in to comment.