| Subject: | ssl server with bad hard-coded values |
Hello, we were happy to find your http server lib supports https, so we were playing around with it and found a few bugs.
On the HTTPServer.pm (lines 340 - 342):
if (!defined($self->{CFG}->{SSL_KEY}) ||
!defined($self->{CFG}->{SSL_KEY}) ||
!defined($self->{CFG}->{SSL_KEY}))
Should be:
if (!defined($self->{CFG}->{SSL_KEY}) ||
!defined($self->{CFG}->{SSL_CERT}) ||
!defined($self->{CFG}->{SSL_CA}))
Also, the cert values are hard coded to your system in the .4 release (lines 353-355):
SSL_key_file => "/home/reatmon/devel/libs/IO-Socket-SSL-0.94/certs/server-key.pem",
SSL_cert_file => "/home/reatmon/devel/libs/IO-Socket-SSL-0.94/certs/server-cert.pem",
SSL_ca_file => "/home/reatmon/devel/libs/IO-Socket-SSL-0.94/certs/my-ca.pem",
Should be:
SSL_key_file => $self->{CFG}->{SSL_KEY},
SSL_cert_file => $self->{CFG}->{SSL_CERT},
SSL_ca_file => $self->{CFG}->{SSL_CA},
It is off to a good start. Thanks for the module.
-Cory