As per lutter; augmented fix for #896 to be configurable and defaulting to validate the server certificate, honoring CVE-2007-5162.

1 files changed, 6 insertions, 1 deletions

diff --git a/lib/puppet/network/xmlrpc/client.rb b/lib/puppet/network/xmlrpc/client.rb
index 371648b61..5283daf5f 100644
--- a/lib/puppet/network/xmlrpc/client.rb
+++ b/lib/puppet/network/xmlrpc/client.rb
@@ -49,6 +49,12 @@ module Puppet::Network
             @http.use_ssl = true
             @http.read_timeout = 120
             @http.open_timeout = 120
+            # JJM Configurable fix for #896.
+            if Puppet[:http_enable_post_connection_check]
+                @http.enable_post_connection_check = true
+            else
+                @http.enable_post_connection_check = false
+            end
 
             @@http_cache[key] = @http if Puppet[:http_keepalive]
 
@@ -147,7 +153,6 @@ module Puppet::Network
                 @http.cert = client.cert
                 @http.verify_mode = OpenSSL::SSL::VERIFY_PEER
                 @http.key = client.key
-                @http.enable_post_connection_check = false
             end
         end