Bug Report: Solution to 416 errors, 502 errors and other errors with https

Oops. Wrong paste of the snippet there. Should be:

<?php

function get() {
$ch = curl_init(“https://creativecommons.org/licenses/&#8221;);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); //Required to make HTTPS URLs work.
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
return $ch;
}
function get_with_range() {
$ch = curl_init(“https://creativecommons.org/licenses/&#8221;);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); //Required to make HTTPS URLs work.
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$request_headers[] = ‘Range: bytes=0-2048’;
curl_setopt($ch, CURLOPT_HTTPHEADER, $request_headers);
return $ch;
}

function head() {
$ch = curl_init(“https://creativecommons.org/licenses/&#8221;);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); //Required to make HTTPS URLs work.
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_NOBODY, true);
return $ch;
}

function test($fn) {
$ch = call_user_func($fn);
curl_exec($ch);
$info = curl_getinfo($ch);
curl_close($ch);
var_dump($info);
}

test(‘head’);
test(‘get’);
test(‘get_with_range’);
?>

I second this!

I also get many false positives with https. Makes the plugin useless in its current state.

Agreed. I am seeing the same issue. Will be turning off the plug-in until it works.

Yes please submit a patch to [email protected]

The plugin will soon be github too.

I was about to +1 this thread, then saw Vladimir’s post. Can’t wait ??

I’m looking forward to this as well.

For sure. I’m buzzed by false positive on SSL.

Ok. Here’s a patch to be applied to modules/checkers/http.php.

Unfortunately I don’t know the implications this could have on load levels for others. As written after this patch, the code should only make a GET request as a retry if a HEAD request fails. But now it GET’s the whole amount rather than only the first 2048 bytes, so it’s possible it could be downloading much more.

However, my intuition is that a) That retry shouldn’t happen in very many cases and b) even if it does, since it’s not downloading assets etc like a browser would, but just the HTML, the impact should be pretty negligable. Unfortunately I have no way to test it in the wild for everyone, but it fixes things in my environment with no measurable impact. Something to look out for if you use it though.

--- http.php.old	2015-10-15 12:29:54.000000000 -0400
+++ http.php	2016-01-05 10:41:09.000000000 -0500
@@ -228,16 +228,12 @@
         $parts = @parse_url($url);
         if( $parts['scheme'] == 'https' ){
         	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); //Required to make HTTPS URLs work.
-            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
-            $nobody = false; //Can't use HEAD with HTTPS.
+            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
         }

         if ( $nobody ){
         	//If possible, use HEAD requests for speed.
 			curl_setopt($ch, CURLOPT_NOBODY, true);
-		} else {
-			//If we must use GET at least limit the amount of downloaded data.
-			$request_headers[] = 'Range: bytes=0-2048'; //2 KB
 		}

 		//Set request headers.

@gmcinnes I should modify it myself or wait for update?

@lotlog. No idea. Vlad has the patch, but I’m not sure how long it will take him to check it out and apply it, if he agrees. I hope it’s soon.

For my client’s sake, I’d prefer not to be spending time working on my own fork.

The sage version of the patch is up today, enjoy the new version.