Please remove CURLOPT_SSL_VERIFYHOST = false.

[danmarsden]

This should not be possible using settings - especially with a payment related plugin. SSL verifyhost should always be required.

Please note - this is a blocker for approval.

[nawazsharif]

Changed all curl instead of curl_init

[danmarsden]

hmm - this issue is not the same as changing to curl class ... you still have the ability to bypass the verification of the ssl cert - this is extremely bad security practice and should not be possible with a payment plugin.

https://github.com/eLearning-BS23/moodle-availability_sslcommerz/blob/main/checkout.php#L123

Please take another look and remove this setting - it should not be needed.