From: Benjamin Peterson <benjamin@python.org>
Date: Thu, 18 Feb 2016 06:13:19 +0000 (-0800)
Subject: open the cert store readonly
X-Git-Tag: v2.7.12rc1~230
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b2e3946d76e4a7a383187d2643ef51649ea4a243;p=thirdparty%2FPython%2Fcpython.git

open the cert store readonly

Patch from Chi Hsuan Yen.
---

diff --git a/Misc/NEWS b/Misc/NEWS
index b54809068c58..7635529e90b7 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -50,6 +50,8 @@ Core and Builtins
 Library
 -------
 
+- Issue #25939: On Windows open the cert store readonly in ssl.enum_certificates.
+
 - Issue #24303: Fix random EEXIST upon multiprocessing semaphores creation with
   Linux PID namespaces enabled.
 
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 9116d9f7fb78..8f34f955cf08 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -3653,7 +3653,9 @@ PySSL_enum_certificates(PyObject *self, PyObject *args, PyObject *kwds)
     if (result == NULL) {
         return NULL;
     }
-    hStore = CertOpenSystemStore((HCRYPTPROV)NULL, store_name);
+    hStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_A, 0, (HCRYPTPROV)NULL,
+                            CERT_STORE_READONLY_FLAG | CERT_SYSTEM_STORE_LOCAL_MACHINE,
+                            store_name);
     if (hStore == NULL) {
         Py_DECREF(result);
         return PyErr_SetFromWindowsErr(GetLastError());
@@ -3741,7 +3743,9 @@ PySSL_enum_crls(PyObject *self, PyObject *args, PyObject *kwds)
     if (result == NULL) {
         return NULL;
     }
-    hStore = CertOpenSystemStore((HCRYPTPROV)NULL, store_name);
+    hStore = CertOpenStore(CERT_STORE_PROV_SYSTEM_A, 0, (HCRYPTPROV)NULL,
+                            CERT_STORE_READONLY_FLAG | CERT_SYSTEM_STORE_LOCAL_MACHINE,
+                            store_name);
     if (hStore == NULL) {
         Py_DECREF(result);
         return PyErr_SetFromWindowsErr(GetLastError());