htdocs/paypal/lib/paypal.lib.php passed a boolean to CURLOPT_SSL_VERIFYHOST:
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, ($ssl_verifypeer ? true : false));
CURLOPT_SSL_VERIFYHOST expects 0, 1 or 2 (not a bool). 'true' is cast to int 1,
which only checks that a Common Name is present, not that it matches the host
(value 1 is also deprecated / a no-op on some libcurl builds) - weakening TLS
host verification on PayPal API calls. Use 2 (full host check) / 0.
PHPStan level 10 flagged: Parameter #3 $value of function curl_setopt expects
0|2, bool given.
Co-authored-by: Laurent Destailleur <eldy@destailleur.fr>
3058208201