SSL verification on web-hooks should be configurable
I agree that people are using self-signed certificates a lot, but for real organizations, having ssl verification on web-hooks turned off isn't good.
Maybe this should be something that is configurable?
https://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/models/web_hook.rb#L34
Activity
I agree on that it should not be disabled by default. However, I don't like the idea of it being a new config file parameter which influences all webhooks the same. For smaller on-site installations this might be sufficient, but for larger installations with multiple users/groups using different hook endpoints, this is something that should be configurable on a per-hook basis.
On the other hand I do not feel like another check box next to the input field for the URL is good user experience. Sounds like confusing for a lot of people. Maybe we could add this dynamically only if the input has "https://..." in it...
Also discussed here:
Closing this here to continue discussion in https://github.com/gitlabhq/gitlabhq/issues/9304
