Curl settings break many shared hosts

[benwerd]

This error has been coming up a lot:

"CURLOPT_FOLLOWLOCATION cannot be activated when an open_basedir is set"

We need to test if open_basedir is set before setting this option.

[benwerd]

I've committed a partial fix for this. Need to test.

[mapkyca]

It should be noted that there needs to be a similar fix applied to the mention client code. I'm wondering whether forking this to use the native webservices library might be smart...

[Phyks]

My 0.02$: I encountered the same issues in a recent project. Basically, curl in PHP can't follow locations if an open_basedir is set, for security reasons. That's a pretty standard issue, found in many other projects such as OwnCloud or Drupal.

AFAIK, the only way to mitigate such an issue is to write a custom wrapper to follow redirections (but there may be security risks).

Note: In PHP 5.6.3, warning is no longer issued if open_basedir is set and CURL_FOLLOWLOCATION is used. That is still the case in PHP 5.4.35.

[mapkyca]

It's a bit more subtle.... The known web services code does exactly that, however a number of third party modules use their own comms code (curl or otherwise) and so need to be modified to use known's web service code.

For mentions this requires a modification in the upstream project, however I'm starting to think we should fork the project.

[Phyks]

True, I forgot about the external dependencies… mentions is the only external dependency that requires some modification, no ? Because for all the others, you seem not to be using the function \Idno\Core\Webservice::get in Known instead of the library-specific loading abilities.

[benwerd]

This hasn't come up again since last year, so I'm closing the issue.