Mercurial > hg
view tests/cgienv @ 29289:3536673a25ae
sslutil: move and change warning when cert verification is disabled
A short time ago, validatesocket() didn't know the reasons why
cert verification was disabled. Multiple code paths could lead
to cert verification being disabled. e.g. --insecure and lack
of loaded CAs.
With the recent refactorings to sslutil.py, we now know the reasons
behind security settings. This means we can recognize when the user
requested security be disabled (as opposed to being unable to provide
certificate verification due to lack of CAs).
This patch moves the check for certificate verification being disabled
and changes the wording to distinguish it from other states. The
warning message is purposefully more dangerous sounding in order
to help discourage people from disabling security outright.
We may want to add a URL or hint to this message. I'm going to wait
until additional changes to security defaults before committing to
something.
author | Gregory Szorc <gregory.szorc@gmail.com> |
---|---|
date | Mon, 30 May 2016 13:15:53 -0700 |
parents | aa3f726a2bdb |
children |
line wrap: on
line source
DOCUMENT_ROOT="/var/www/hg"; export DOCUMENT_ROOT GATEWAY_INTERFACE="CGI/1.1"; export GATEWAY_INTERFACE HTTP_ACCEPT="text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"; export HTTP_ACCEPT HTTP_ACCEPT_CHARSET="ISO-8859-1,utf-8;q=0.7,*;q=0.7"; export HTTP_ACCEPT_CHARSET HTTP_ACCEPT_ENCODING="gzip,deflate"; export HTTP_ACCEPT_ENCODING HTTP_ACCEPT_LANGUAGE="en-us,en;q=0.5"; export HTTP_ACCEPT_LANGUAGE HTTP_CACHE_CONTROL="max-age=0"; export HTTP_CACHE_CONTROL HTTP_CONNECTION="keep-alive"; export HTTP_CONNECTION HTTP_HOST="hg.omnifarious.org"; export HTTP_HOST HTTP_KEEP_ALIVE="300"; export HTTP_KEEP_ALIVE HTTP_USER_AGENT="Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.0.4) Gecko/20060608 Ubuntu/dapper-security Firefox/1.5.0.4"; export HTTP_USER_AGENT PATH_INFO="/"; export PATH_INFO PATH_TRANSLATED="/var/www/hg/index.html"; export PATH_TRANSLATED QUERY_STRING=""; export QUERY_STRING REMOTE_ADDR="127.0.0.2"; export REMOTE_ADDR REMOTE_PORT="44703"; export REMOTE_PORT REQUEST_METHOD="GET"; export REQUEST_METHOD REQUEST_URI="/test/"; export REQUEST_URI SCRIPT_FILENAME="/home/hopper/hg_public/test.cgi"; export SCRIPT_FILENAME SCRIPT_NAME="/test"; export SCRIPT_NAME SCRIPT_URI="http://hg.omnifarious.org/test/"; export SCRIPT_URI SCRIPT_URL="/test/"; export SCRIPT_URL SERVER_ADDR="127.0.0.1"; export SERVER_ADDR SERVER_ADMIN="eric@localhost"; export SERVER_ADMIN SERVER_NAME="hg.omnifarious.org"; export SERVER_NAME SERVER_PORT="80"; export SERVER_PORT SERVER_PROTOCOL="HTTP/1.1"; export SERVER_PROTOCOL SERVER_SIGNATURE="<address>Apache/2.0.53 (Fedora) Server at hg.omnifarious.org Port 80</address>"; export SERVER_SIGNATURE SERVER_SOFTWARE="Apache/2.0.53 (Fedora)"; export SERVER_SOFTWARE