curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);

This line in commerce_paypal_api_request() disables peer verification, which allows man-in-the-middle attacks between sites running this module and PayPal's servers. See #1794680: HTTPS certificate verification and e.g. http://stackoverflow.com/questions/14914330/security-consequences-of-dis... for more information.

Comments

guguss’s picture

guguss commented

For information, we had the same discussion for Payleap #1931768: CURLOPT_SSL_VERIFYPEER should not be disabled.

rszrama’s picture

rszrama commented
Priority: Critical » Major
Status: Active » Fixed

My solution here is two-fold based on other research (see also #1931760-2: CURLOPT_SSL_VERIFYPEER should not be disabled):

  1. In two places, commerce_paypal_api_request() and commerce_payflow_api_request(), I explicitly set CURLOPT_SSL_VERIFYPEER to 1.
  2. I look for a variable, commerce_paypal_cacert, which should contain the absolute path to a CA certificate bundle file if set and use that to set the CURLOPT_CAINFO setting of the cURL request if found. This allows users to workaround system limitations if necessary to properly verify peers without overcomplicating the user interface for the majority of users who won't need a workaround..

Commit: http://drupalcode.org/project/commerce_paypal.git/commitdiff/79fabf1

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.