diff --git a/CHANGELOG b/CHANGELOG index 5db54b5..179d9be 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,3 +1,6 @@ +### 4.0.3 (Released 2016-05-18) ### +- Improve SSL instructions in report page. + ### 4.0.2 (Released 2016-04-21) ### - Detect and allow for Apache versions with buggy rewrite causing redirection failure during configuration. diff --git a/RESTfm.ini.php.dist b/RESTfm.ini.php.dist index 0f98271..38e12e1 100644 --- a/RESTfm.ini.php.dist +++ b/RESTfm.ini.php.dist @@ -41,17 +41,15 @@ $config['settings'] = array ( 'SSLOnly' => FALSE, // Enforce strict SSL certificate checking when RESTfm is connecting to - // FileMaker Server Web Publishing Engine. Disabling this is a security - // risk, and should not be used on a production server. It may be useful - // to disable this during development on systems using self-signed SSL - // certificates or the FMI certificate bundled with FileMaker Server. + // FileMaker Server Web Publishing Engine. + // Check http://www.restfm.com/restfm-manual/install/ssl-troubleshooting + // for further details. 'strictSSLCertsFMS' => TRUE, // Enforce strict SSL certificate checking for RESTfm connecting to // itself when executing the report page (report.php). - // Disabling this may hide the fact that access to RESTfm over SSL is - // insecure. It may be useful to disable this during development on systems - // using self-signed SSL certificates. + // Check http://www.restfm.com/restfm-manual/install/ssl-troubleshooting + // for further details. 'strictSSLCertsReport' => TRUE, // Respond 403 Forbidden on 401 Unauthorized. diff --git a/lib/RESTfm/Diagnostics.php b/lib/RESTfm/Diagnostics.php index 1f82973..323d082 100644 --- a/lib/RESTfm/Diagnostics.php +++ b/lib/RESTfm/Diagnostics.php @@ -287,8 +287,16 @@ public function test_webserverRedirect($reportItem) { $reportItem->status = ReportItem::ERROR; $reportItem->details .= 'cURL failed with error: ' . curl_errno($ch) . ': ' . curl_error($ch) . "\n"; if (curl_errno($ch) == 60) { // SSL certificate problem: self signed certificate - $reportItem->details .= 'On development (not production) systems it is possible to disable this check' ."\n"; - $reportItem->details .= 'by setting "strictSSLCertsReport" to FALSE in ' . RESTfmConfig::CONFIG_INI ."\n"; + $reportItem->details .= "\n"; + $reportItem->details .= 'The host\'s SSL certificate has failed a verification check. This may be' . "\n"; + $reportItem->details .= 'due to the certificate being invalid, or PHP\'s CA root certificates' . "\n"; + $reportItem->details .= 'being out of date.' . "\n"; + $reportItem->details .= "\n"; + $reportItem->details .= 'Please consult ' . + 'SSL Troubleshooting' . + ' in the RESTfm manual for further details.' . "\n"; + $reportItem->details .= "\n"; + $reportItem->details .= 'It is possible to disable this check by setting "strictSSLCertsReport" to FALSE in ' . RESTfmConfig::CONFIG_INI ."\n"; } } elseif ( strpos($result, 'RESTfm is not configured') ) { $reportItem->status = ReportItem::ERROR; @@ -344,10 +352,9 @@ public function test_filemakerAPI($reportItem) { curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 2); curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE); - if (RESTfmConfig::getVar('settings', 'strictSSLCertsReport') === FALSE) { - curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); - curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE); - } + // SSL certificates were checked in an earlier test. + curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); + curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE); curl_setopt($ch, CURLOPT_FRESH_CONNECT, TRUE); curl_setopt($ch, CURLOPT_FORBID_REUSE, TRUE); curl_setopt($ch, CURLOPT_USERAGENT, 'RESTfm Diagnostics'); @@ -368,6 +375,7 @@ public function test_filemakerAPI($reportItem) { public function test_filemakerConnect($reportItem) { $reportItem->name = 'FileMaker Server connection test'; + $reportItem->details = ''; if ($this->_isSSLOnlyAndNotHTTPS()) { $reportItem->status = ReportItem::WARN; @@ -377,7 +385,7 @@ public function test_filemakerConnect($reportItem) { if ($this->_report->filemakerAPI->status != ReportItem::OK) { $reportItem->status = ReportItem::ERROR; - $reportItem->details = 'Cannot test, FileMaker PHP API not found.' . "\n"; + $reportItem->details .= 'Cannot test, FileMaker PHP API not found.' . "\n"; return; } @@ -406,8 +414,16 @@ public function test_filemakerConnect($reportItem) { $reportItem->status = ReportItem::ERROR; $reportItem->details .= 'cURL failed with error: ' . curl_errno($ch) . ': ' . curl_error($ch) . "\n"; if (curl_errno($ch) == 60) { // SSL certificate problem: self signed certificate in certificate chain - $reportItem->details .= 'On development (not production) systems it is possible to disable this check' ."\n"; - $reportItem->details .= 'by setting "strictSSLCertsFMS" to FALSE in ' . RESTfmConfig::CONFIG_INI ."\n"; + $reportItem->details .= "\n"; + $reportItem->details .= 'The host\'s SSL certificate has failed a verification check. This may be' . "\n"; + $reportItem->details .= 'due to the certificate being invalid, or PHP\'s CA root certificates' . "\n"; + $reportItem->details .= 'being out of date.' . "\n"; + $reportItem->details .= "\n"; + $reportItem->details .= 'Please consult ' . + 'SSL Troubleshooting' . + ' in the RESTfm manual for further details.' . "\n"; + $reportItem->details .= "\n"; + $reportItem->details .= 'It is possible to disable this check by setting "strictSSLCertsFMS" to FALSE in ' . RESTfmConfig::CONFIG_INI ."\n"; } } elseif (stripos($result, 'FileMaker') === FALSE) { $reportItem->status = ReportItem::ERROR; @@ -425,12 +441,11 @@ public function test_filemakerConnect($reportItem) { $FM = new FileMaker(); $FM->setProperty('hostspec', $hostspec); - if (RESTfmConfig::getVar('settings', 'strictSSLCertsFMS') === FALSE) { - $FM->setProperty('curlOptions', array( - CURLOPT_SSL_VERIFYPEER => FALSE, - CURLOPT_SSL_VERIFYHOST => FALSE, - )); - } + // SSL certificates were checked in an earlier test. + $FM->setProperty('curlOptions', array( + CURLOPT_SSL_VERIFYPEER => FALSE, + CURLOPT_SSL_VERIFYHOST => FALSE, + )); $fileMakerResult = $FM->listDatabases(); $unauthorised = FALSE; diff --git a/lib/RESTfm/Version.php b/lib/RESTfm/Version.php index 979a450..308d74b 100644 --- a/lib/RESTfm/Version.php +++ b/lib/RESTfm/Version.php @@ -21,7 +21,7 @@ * Version static class to hold release version. */ class Version { - private static $_release = '4.0.2'; + private static $_release = '4.0.3'; private static $_revision = '%%REVISION%%'; private static $_protocol = '5'; // Bump this when REST API changes.