public-mirrors
/
composer
mirror of https://github.com/composer/composer
1
0
Fork 0
Code

Reuse new TlsHelper for CA validation, refs #4798

pull/4775/head
Jordi Boggiano 2016-01-25 19:17:56 +00:00
parent 1ea810d40b
commit bdb97e7527
1 changed files with 13 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/Composer/Util/RemoteFilesystem.php
View File

@ -383,6 +383,7 @@ class RemoteFilesystem
} }
} }
// Handle SSL cert match issues
if (false === $result && false !== strpos($errorMessage, 'Peer certificate') && PHP_VERSION_ID < 50600) { if (false === $result && false !== strpos($errorMessage, 'Peer certificate') && PHP_VERSION_ID < 50600) {
// Certificate name error, PHP doesn't support subjectAltName on PHP < 5.6 // Certificate name error, PHP doesn't support subjectAltName on PHP < 5.6
// The procedure to handle sAN for older PHP's is: // The procedure to handle sAN for older PHP's is:
@ -421,9 +422,11 @@ class RemoteFilesystem
$result = $this->get($this->originUrl, $this->fileUrl, $additionalOptions, $this->fileName, $this->progress); $result = $this->get($this->originUrl, $this->fileUrl, $additionalOptions, $this->fileName, $this->progress);
$authHelper = new AuthHelper($this->io, $this->config); if (false !== $this->storeAuth) {
$authHelper->storeAuth($this->originUrl, $this->storeAuth); $authHelper = new AuthHelper($this->io, $this->config);
$this->storeAuth = false; $authHelper->storeAuth($this->originUrl, $this->storeAuth);
$this->storeAuth = false;
}
return $result; return $result;
} }
@ -734,7 +737,7 @@ class RemoteFilesystem
'DHE-DSS-AES256-SHA', 'DHE-DSS-AES256-SHA',
'DHE-RSA-AES256-SHA', 'DHE-RSA-AES256-SHA',
'AES128-GCM-SHA256', 'AES128-GCM-SHA256',
'AES256-GCM-SHA384', 'AES256-GCM-SHA384',
'ECDHE-RSA-RC4-SHA', 'ECDHE-RSA-RC4-SHA',
'ECDHE-ECDSA-RC4-SHA', 'ECDHE-ECDSA-RC4-SHA',
'AES128', 'AES128',
@ -916,11 +919,12 @@ class RemoteFilesystem
// assume the CA is valid if php is vulnerable to // assume the CA is valid if php is vulnerable to
// https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html // https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html
if ( if (!TlsHelper::isOpensslParseSafe()) {
PHP_VERSION_ID <= 50327 $this->io->writeError(sprintf(
|| (PHP_VERSION_ID >= 50400 && PHP_VERSION_ID < 50422) '<error>Your version of PHP, %s, is affected by CVE-2013-6420 and cannot safely perform certificate validation, we strongly suggest you upgrade.</error>',
|| (PHP_VERSION_ID >= 50500 && PHP_VERSION_ID < 50506) PHP_VERSION
) { ));
return $files[$filename] = !empty($contents); return $files[$filename] = !empty($contents);
} }