本家でのセキュリティ報告SSL 3.0の脆弱性（POODLE攻撃）の対策で、SSL3.0の利用を行わないように修正しました。

Signed-off-by: kimono <maeda@obitastar.co.jp>
zencart-ja · Nov 14, 2014 · aee45be · aee45be
1 parent 2063a3a
commit aee45be
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/includes/modules/payment/authorizenet_aim.php b/includes/modules/payment/authorizenet_aim.php
@@ -573,7 +573,7 @@ function _sendRequest($submit_data) {
     curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
     curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
     curl_setopt($ch, CURLOPT_TIMEOUT, 15);
-    curl_setopt($ch, CURLOPT_SSLVERSION, 3);
+//    curl_setopt($ch, CURLOPT_SSLVERSION, 3);
     curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); /* compatibility for SSL communications on some Windows servers (IIS 5.0+) */
     if (CURL_PROXY_REQUIRED == 'True') {
       $this->proxy_tunnel_flag = (defined('CURL_PROXY_TUNNEL_FLAG') && strtoupper(CURL_PROXY_TUNNEL_FLAG) == 'FALSE') ? false : true;

diff --git a/includes/modules/payment/authorizenet_echeck.php b/includes/modules/payment/authorizenet_echeck.php
@@ -583,7 +583,7 @@ function _sendRequest($submit_data) {
     curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
     curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
     curl_setopt($ch, CURLOPT_TIMEOUT, 15);
-    curl_setopt($ch, CURLOPT_SSLVERSION, 3);
+//    curl_setopt($ch, CURLOPT_SSLVERSION, 3);
     curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); /* compatibility for SSL communications on some Windows servers (IIS 5.0+) */
     if (CURL_PROXY_REQUIRED == 'True') {
       $this->proxy_tunnel_flag = (defined('CURL_PROXY_TUNNEL_FLAG') && strtoupper(CURL_PROXY_TUNNEL_FLAG) == 'FALSE') ? false : true;

diff --git a/includes/modules/payment/linkpoint_api/class.linkpoint_api.php b/includes/modules/payment/linkpoint_api/class.linkpoint_api.php
@@ -307,7 +307,7 @@ function curl_process($data)
       curl_setopt ($ch, CURLOPT_CAINFO, $key);
       curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, false);
       curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, false);
-      curl_setopt ($ch, CURLOPT_SSLVERSION, 3);
+//      curl_setopt ($ch, CURLOPT_SSLVERSION, 3);
 			curl_setopt ($ch, CURLOPT_RETURNTRANSFER, true);
 
 

diff --git a/includes/modules/payment/paypal/paypal_curl.php b/includes/modules/payment/paypal/paypal_curl.php
@@ -56,7 +56,7 @@ class paypal_curl extends base {
                             CURLOPT_FOLLOWLOCATION => FALSE,
                             CURLOPT_SSL_VERIFYPEER => FALSE,
                             CURLOPT_SSL_VERIFYHOST => 2,
-                            CURLOPT_SSLVERSION => 3,
+//                            CURLOPT_SSLVERSION => 3,
                             CURLOPT_FORBID_REUSE => TRUE,
                             CURLOPT_FRESH_CONNECT => TRUE,
                             CURLOPT_POST => TRUE,