[bugfix][auth] Basic method uses trusted CAs when connecting to DB

Fixes #17392
qgis · Nov 3, 2017 · 73fec4a · luipir · Nov 3, 2017 · 73fec4a
1 parent 9c5ace0
commit 73fec4a
Showing 1 changed file with 23 additions and 0 deletions.
diff --git a/src/auth/basic/qgsauthbasicmethod.cpp b/src/auth/basic/qgsauthbasicmethod.cpp
@@ -23,6 +23,7 @@
 
 #include <QNetworkProxy>
 #include <QMutexLocker>
+#include <QUuid>
 
 static const QString AUTH_METHOD_KEY = QStringLiteral( "Basic" );
 static const QString AUTH_METHOD_DESCRIPTION = QStringLiteral( "Basic authentication" );
@@ -123,6 +124,28 @@ bool QgsAuthBasicMethod::updateDataSourceUriItems( QStringList &connectionItems,
     connectionItems.append( passparam );
   }
 
+  // add extra CAs
+  QList<QSslCertificate> cas;
+  cas = QgsApplication::authManager()->trustedCaCerts();
+  // save CAs to temp file
+  QString tempFileBase = QStringLiteral( "tmp_basic_%1.pem" );
+  QString caFilePath = QgsAuthCertUtils::pemTextToTempFile(
+                         tempFileBase.arg( QUuid::createUuid().toString() ),
+                         QgsAuthCertUtils::certsToPemText( cas ) );
+  if ( ! caFilePath.isEmpty() )
+  {
+    QString caparam = "sslrootcert='" + caFilePath + "'";
+    int sslcaindx = connectionItems.indexOf( QRegExp( "^sslrootcert='.*" ) );
+    if ( sslcaindx != -1 )
+    {
+      connectionItems.replace( sslcaindx, caparam );
+    }
+    else
+    {
+      connectionItems.append( caparam );
+    }
+  }
+
   return true;
 }