From 41650fcac23f66048fb94b55abd3e66475961a42 Mon Sep 17 00:00:00 2001 From: Matthias Kuhn Date: Tue, 4 Jun 2019 09:51:42 +0200 Subject: [PATCH] Only check server SSL certificate if requested Fix #30075 --- src/auth/basic/qgsauthbasicmethod.cpp | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/src/auth/basic/qgsauthbasicmethod.cpp b/src/auth/basic/qgsauthbasicmethod.cpp index 371d15f3ac4..9ca236505b5 100644 --- a/src/auth/basic/qgsauthbasicmethod.cpp +++ b/src/auth/basic/qgsauthbasicmethod.cpp @@ -105,18 +105,28 @@ bool QgsAuthBasicMethod::updateDataSourceUriItems( QStringList &connectionItems, return false; } + QString sslMode = QStringLiteral( "prefer" ); + int sslModeIdx = connectionItems.indexOf( QRegExp( "^sslmode='.*" ) ); + if ( sslModeIdx != -1 ) + { + sslMode = connectionItems.at( sslModeIdx ).split( '=' ).at( 1 ); + } + // SSL Extra CAs QString caparam; QList cas; - cas = QgsApplication::authManager()->trustedCaCerts(); - // save CAs to temp file - QString tempFileBase = QStringLiteral( "tmp_basic_%1.pem" ); - QString caFilePath = QgsAuthCertUtils::pemTextToTempFile( - tempFileBase.arg( QUuid::createUuid().toString() ), - QgsAuthCertUtils::certsToPemText( cas ) ); - if ( ! caFilePath.isEmpty() ) + if ( sslMode.startsWith( QStringLiteral( "verify-" ) ) ) { - caparam = "sslrootcert='" + caFilePath + "'"; + cas = QgsApplication::authManager()->trustedCaCerts(); + // save CAs to temp file + QString tempFileBase = QStringLiteral( "tmp_basic_%1.pem" ); + QString caFilePath = QgsAuthCertUtils::pemTextToTempFile( + tempFileBase.arg( QUuid::createUuid().toString() ), + QgsAuthCertUtils::certsToPemText( cas ) ); + if ( ! caFilePath.isEmpty() ) + { + caparam = "sslrootcert='" + caFilePath + "'"; + } } // Branch for OGR