browscap.org now supports HTTPS. This patch changes the Browscap URLs from HTTP to HTTPS. I tested it.

HTTPS should be more secure. HTTP is vulnerable to man-in-the-middle attacks. It seems unlikely, but an attacker could inject malicious Browscap data to exploit a vulnerability in the INI parser, or exploit some other vulnerability.

I also changed some URLs in the README.txt to HTTPS.

CommentFileSizeAuthor
#6 browscap-6.x-2.x-switch_urls_to_https-2573711-6.patch1.73 KBaohrvetpv
browscap-7.x-2.x-switch_urls_to_https.patch2.04 KBaohrvetpv

Comments

AohRveTPV created an issue. See original summary.

  • greggles committed 4790e89 on 7.x-2.x authored by AohRveTPV 
    Issue #2573711 by AohRveTPV: Switch URLs to HTTPS where possible
greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Version: 7.x-2.x-dev » 6.x-2.x-dev
Status: Needs review » Patch (to be ported)

Commited to 7.x-2.x. Thanks!

aohrvetpv’s picture

aohrvetpv commented

Thanks, I am porting to D6. drupal_http_request() apparently doesn't validate HTTPS certificates :(, so this change wouldn't protect much against MITM. But this change is probably still a step in the right direction.

aohrvetpv’s picture

aohrvetpv commented

Changed a few links on the project page to HTTPS for consistency with the READMEs.

aohrvetpv’s picture

aohrvetpv commented
Status: Patch (to be ported) » Needs review
StatusFileSize
new browscap-6.x-2.x-switch_urls_to_https-2573711-6.patch1.73 KB

Planning to go ahead and commit.

  • AohRveTPV committed ddb2a74 on 6.x-2.x 
    Issue #2573711 by AohRveTPV: Switch URLs to HTTPS where possible
aohrvetpv’s picture

aohrvetpv commented
Status: Needs review » Fixed

Note that this will not work for PHP compiled without SSL support. SSL support is not listed as a requirement for running Drupal. I do not know if there are such PHP deployments in practice.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.