CHANGES

- Both Jeff Schasny and Ketil Froyn asked me how to tell curl not to send one
  of those internally generated headers. They didn't settle with the blank
  ones you could tell curl to use. I rewrote the header-replace stuff a
  little. Now, if you replace an internal header with your own and that new
  one is a blank header you will only remove the internal one and not get any
  blank. I couldn't figure out any case when you want that blank header.

Daniel (29 July 2000)
- It struck me that the lib used localtime() which is not thread-safe, so now
  I use localtime_r() in the systems that has it.

- I went through this entire document and removed all email addresses and left
  names only. I've really made an effort to always note who brought be bug
  reports or fixes, but more and more people ask me to remove the email
  addresses since they become victims for spams this way. Gordon Beaton got me
  working on this.

Daniel (27 July 2000)
- Jörn Hartroth found out that when you specified a HTTP proxy in an
  environment variable and used -L, curl failed in the second fetch. I
  corrected this problem and posted a patch to the list. No need for an extra
  beta release just for this.

Version 7.0.10beta

Daniel (27 July 2000)
- So, libtool replaced two of my files with symbolic links and I forgot to add
  the two new libtool files to the release archive (and they were added as
  symlinks as well!) This of course lead to that the configure script failed
  on 7.0.9...

Version 7.0.9beta

Daniel (25 July 2000)
- Kristian Köhntopp <kris at koehntopp.de> brought a fix that makes libcurl
  libtoolified, just as we've wanted for a while now. He also made the
  recently added man pages get installed properly on 'make install' and some
  other nice cleanups.

- In a discussion with Eetu Ojanen it struck me that if we use curl to get a
  page using a password, and that page then sends a Location: to another
  server that curl follows, curl will send the user name and password to that
  server as well.

  Now, I'll never be able to make curl do Location: following all that perfect
  and you're all sooner or later required to write a script to do several
  fetches when you're doing advanced stuff, but now I've modified curl to at
  least *only* send the user name and password to the original server. Which
  means that if get a page from server A with a password, that forwards curl
  to server B, curl won't use the password there. If server B then forwards
  curl back to server A again, the password will be used again.

  This is not a perfect implementation, as in a browser case it would only use
  the password if the left-prefix of the first path is the same. I just think
  that this fix prevents a somewhat lurky "security hole".

  As a side-note in this subject: HTTP passwords are sent in cleartext and
  will never be considered to be safe or secure. Use HTTPS for that.

- As discussed on the mailing list, I converted the FTP response reading
  function into using select() which then allows timeouts (even under win32!)
  if the command-reply session gets too slow or dies completely. I made a
  default timeout on 3600 seconds unless anything else is specified, since I
  don't think anyone wants to wait more than that for a single character to
  get received...

- Torsten Foertsch <torsten.foertsch at gmx.net> brought a set of fixes for
  the rfc1867 form posts. He introduced 'name=<file' which brings a means to
  suuply very large text chunks read from the given file name. It differs from
  'name=@file' in the way that this latter thing is marked in the uploaded
  contents as a file upload, while the first is just text (as in a input or
  textarea field). Torsten also corrected a bug that would happen if you used
  %s or similar in a -F file name.

- As discovered by Nico Baggus <Nico.Baggus at mail.ing.nl>, when transferring
  files to/from FTP using type ASCII curl should not expect the transfer to be
  the exact size reported by the server as the file size. Since ASCII may very
  well mean that the content is translated while transfered, the final size
  may very well differ. Therefor, curl now ignores the file size when doing
  ASCII transfers in FTP.

Daniel (24 July 2000)
- Added CURLOPT_PROXYPORT to the curl_easy_setopt() call to allow the proxy
  port number to be set separately from the proxy host name.

- Andrew <andrew at ugh.net.au> pointed out a netrc manual bug.

- The FTP transfer code now accepts a 250-code as well as the previously
  accepted 226, after a successful file transfer. Mohan <mnair at
  evergreen-funds.com> pointed this out.

- The check for *both* nsl and socket was never added in the v7 configure.in
  when I moved the main branch. I re-added that check to configure.in. This was
  discovered by Rich Gray.

- Howard, Blaise <Blaise.Howard at factiva.com> pointed out a missing free() in
  curl_disconnect() which of course meant libcurl ate memory.

- Brian E. Gallew noted that the HTTP 'Host:' header curl sent did not
  properly include the port number if non-default ports were used. This should
  now have been fixed.

- HTTP connect errors now return errors earlier. This was most notably causing
  problems when the HTTPS certificate had problems and later caused a crash.
  Many thanks to Gregory Nicholls <gnicholls at level8.com> for discovering
  and suggesting a fix...

Daniel (21 June 2000)
- After a "bug report" I received where the user was using both -F and -I in a
  HTTP request (it severly confused the library I should add), I added some
  checks to src/main.c that prevents setting more than one HTTP request
  command, no matter what the user wants! ;-)

Version 7.0.8beta

Daniel (20 June 2000)
- I did a major replace in many files to use the new curl domain haxx.se
  instead of the previous one.

- As Eetu Ojanen suggested, I finally took the step and now libcurl no longer
  makes a POST after it has followed a location. When the initial POST has
  been done, it'll turned into a GET for the further requests. This is only
  interesting when using -L/--location *and* doing a POST at the same time.

  While messing with this, I added another weird feature I call 'auto
  referer'. If you append ';auto' to the right of a given referer string (or
  only use that string as referer), libcurl will automatically set the
  previoud URL as refered when it follows a Location: and gets a succeeding
  document.

- My hero Rich Gray found the very obscure FTP bug that happened to him only
  when passing through a particular firewall and using the PORT command. It
  turned out that PORT was the only command in the lib/ftp.c source that
  didn't send a proper \r\n sequence but instead used the faulty \n which as
  it seemed is supported by most major ftp servers... :-O

Version 7.0.7beta

Daniel (16 June 2000)
- I had avoided this long enough now, so I moved the alternative progress bar
  stuff from the lib and added it to the client code. This is now using the
  recently added progress callback and it seems to work pretty much like
  before. Since it is only one progress bar and you and download and upload at
  the same time, this bar shows the combined progress of both directions. This
  code was just ported from the old place to this, Lars is still our saviour!
  ;-) This also made the documentation more accurate since I never removed
  this function from any docs! Although I now removed the CURLOPT_PROGRESSMODE
  from the library since the lib has only one internal progress meter and it
  will never get another. It is although likely that the internal one also
  will be moved to the client code in the future (when I have other means of
  getting the writeout data and move that too to the client).

- I took the opportunity to verify that standard progress meter works and I
  found out it didn't get inited properly. Grrr. I corrected that as well.

Daniel (15 June 2000)
- I thought I'd better verify that the -F option still works in v7 and of
  course it didn't... :-/ Anyway, I had the problems I could discover
  corrected. About one month of beta testing and not a single person has used
  this feature with v7?

- Björn correctly pointed out that the --progress-bar still doesn't work in
  v7. Hm.

Daniel (14 June 2000)
- Tim Tassonis discovered that curl 7 didn't handle normal http POST as it
  should. I corrected this.

Version 7.0.6beta

Daniel (14 June 2000)
- Björn Stenberg pointed out several problems (related to win32 compiling):
  lib/strequal.c had a bad #ifdef for one of the string comparisons (win32)
  src/main.c had several minor problems
  lib/makefile.m32 had getpass.[co] twice
  src/config-win32.h lacked the HAVE_FCNTL_H define
  both config-win32.h files now only set the HAVE_UNISTD_H define if the
  define MINGW32 is set, and I modified src/makefile.m32 and lib/makefile.m32
  to set it.

Version 7.0.5beta

Daniel (14 June 2000)
- Applied Luong Dinh Dung's comments about a few win32 compile problems.

- Applied Björn Stenberg's suggested fix that turns the win32 stdout to
  binary. It won't do it if the -B / --use-ascii option is used. That option
  is now an extended version of the previous -B /--ftp--ascii. The flag was
  already in use be the ldap as well so the new name fits pretty good. The
  libcyrl CURLOPT_TRANSFERTEXT was also introduced as an alias to the now
  obsolete CURLOPT_FTPASCII. Can't verify this fix myself as I have no win32
  compiler around.

Daniel (13 June 2000)
- Luong Dinh Dung <dung at sch.bme.hu> found a problem in curl_easy_cleanup()
  since it free()ed the main curl struct *twice*. This is now corrected.

Daniel (9 June 2000)
- Updated the RESOURCES file, added a README.win32 file.

Daniel (8 June 2000)
- So I finally added the progress callback to the *setopt() options and it
  should work now. I don't have the energy to write any test program for it
  right now.
- Made the callback function typedefs public in curl/curl.h for comfort. Just
  in case anyone wanna fiddle with such pointers.
- Updated the curl_easy_setopt() man page accordingly.

Version 7.0.4beta

Daniel (2 June 2000)
- I noticed that when doing Location: following, we lost custom headers in all
  but the first request.
- Removed the 'HttpPost' struct and moved the header stuff to the more generic
  curl_slist.
- Added some better slist-cleanups in src/main.c

Version 7.0.3beta

Daniel (31 May 2000)
- So I discovered that I released the 7.0.2beta without it being able to
  compile under Linux. gethostbyname_r() and gethostbyaddr_r() turned out to
  feature a different amount of arguments on different systems so I had to add
  a configure check for this and adjust the code slightly.

Version 7.0.2beta

Daniel (29 May 2000)
- Corrected the bits.* assignments when using CURLOPT options that only
  toggles one of those bits.

- Applied the huge patches from David LeBlanc <dleblanc at qnx.com> that add
  usage of the gethostbyname_r() and similar functions in case they're around,
  since that make libcurl much better threadsafe in many systems (such as
  solaris). I added the checks for these functions to the configure script.

  I can't explain why, but the inet_ntoa_r() function did not appear in my
  Solaris include files, I had to add my own include file for this for now.

Daniel (22 May 2000)
- Jörn Hartroth brought me fixes to make the win32 version compile properly as
  well as a rename of the 'interface' field in the urldata struct, as it seems
  to be reserved in some gcc versions!

- Rich Gray struck back with yet some portability reports. Data General DG/UX
  needed a little fix in lib/ldap.c since it doesn't have RTLD_GLOBAL defined.
  More fixes are expected as a result of Richies very helpful work.

Version 7.0.1beta

Daniel (21 May 2000)
- Updated lots of #defines, enums and variable type names in the library. No
  more weird URG or URLTAG prefixes. All types and names should be curl-
  prefixed to avoid name space clashes. The FLAGS-parameter to the former
  curl_urlget() has been converted into a bunch of flags to use in separate
  setopt calls. I'm still focusing on the easy-interface, as the curl tool is
  now using that.

- Bjorn Reese has provided me with an asynchronous name resolver that I plan
  to use in upcoming versions of curl to be able to gracefully timeout name
  lookups.

Version 7.0beta

Daniel (18 May 2000)
- Introduced LIBCURL_VERSION_NUM to the curl.h include file to better allow
  source codes to be dependent on the lib version. This define is now set to
  a dexadecimal number, with 8 bits each for major number, minor number and
  patch number. In other words, version 1.2.3 would make it 0x010203. It also
  makes a larger number a newer version.

Daniel (17 May 2000)
- Martin Kammerhofer correctly pointed out several flaws in the FTP range
  option. I corrected them.
- Removed the win32 winsock init crap from the lib to the src/main.c file
  in the application instead. They can't be in the lib, especially not for
  multithreaded purposes.

Daniel (16 May 2000)
- Rewrote the src/main.c source to use the new easy-interface to libcurl 7.
  There is still more work to do, but the first step is now taken.
  <curl/easy.h> is the include file to use.

Daniel (14 May 2000)
- FTP URLs are now treated slightly different, more according to RFC 1738.
- FTP sessions are now performed differently, with CWD commands to change
  directory instead of RETR/STOR/LIST with the full path. Discussions with
  Rich Gray made me notice these problems.
- Janne Johansson discovered and corrected a buffer overflow in the
  src/usrglob.c file.
- I had to add a lib/strequal.c file for doing case insensitive string
  compares on all platforms.

Daniel (8 May 2000):
- Been working lots on the new lib.
- Together with Rich Gray, I've tried to adjust the configure script to work
  better on the NCR MP-RAS Unix.

Daniel (2 May 2000):
- Albert Chin-A-Young pointed out that I had a few too many instructions in
  configure.in that didn't do any good.

Daniel (24 April 2000):
- Added a new paragraph to the FAQ about what to do when configure can't
  find OpenSSL even though it is installed. Supplied by Bob Allison

Daniel (12 April 2000):
- Started messing around big-time to convert the old library interface to a
  better one...

Daniel (8 April 2000):
- Made the progress bar look better for file sizes between 9999 kilobytes
  and 100 megabytes. They're now displayed XX.XM.
- I also noticed that ftp fetches through HTTP proxies didn't add the user
  agent string. It does now.
- Habibie <habibie at MailandNews.com> supplied a pretty good way to build RPMs
  on a Linux machine. It still a) requires me to be root to do it, b) leaves
  the rpm packages laying at some odd place on my disk c) doesn't work to
  build the ssl version of curl since I didn't install openssl from an rpm
  package so now the rpm crap thinks I don't have openssl and refuses to build
  a package that depends on ssl... Did I mention I don't get along with RPM?
- Once again I received a bug report about autoconf not setting -L prior to -l
  on the command line when checking for libs. In this case it made the native
  cc compiler on Solaris 7 to fail the OpenSSL check. This has previously been
  reported to cause problems on HP-UX and is a known flaw in autoconf 2.13. It
  is a pity there's no newer release around...

Daniel (4 April 2000):
- Marco G. Salvagno supplied me with two fixes that
  appearantly makes the OS/2 port work better with multiple URLs.

Daniel (2 April 2000):
- Another Location: fix. This time, when curl connected to a port and then
  followed a location with an absolute URL to another port, it misbehaved.

Daniel (27 March 2000):
- H. Daphne Luong pointed out that curl was wrongly
  messing up the proxy string when fetching a document through a http proxy,
  which screwed up multiple fetches such as in location: followings.

Daniel (23 March 2000):
- Marco G. Salvagno corrected my badly applied patch he
  actually already told me about!

- H. Daphne Luong brought me a fix that now makes curl
  ignore select() errors in the download if errno is EINTR, which turns out to
  happen every now and then when using libcurl multi-threaded...

Daniel (22 March 2000):
- Wham Bang supplied a couple of win32 fixes. HAVE_UNAME
  was accidentally #defined in config-win32.h, which it shouldn't have been.
  The HAVE_UNISTD_H is not defined when compiling with the Makefile.vc6
  makefile for MS VC++.

Daniel (21 March 2000):
- I removed the AC_PROG_INSTALL macro from configure.in, since it appears that
  one of the AM_* macros searches for a BSD compatible install already. Janne
  Johansson made me aware of this.

Version 6.5.2

Daniel (21 March 2000):
- Paul Harrington quickly pointed out to me that 6.5.1
  crashes hard. I upload 6.5.2 now as quickly as possible! The problem was
  the -D adjustments in src/main.c.

Version 6.5.1

Daniel (20 March 2000):
- An anonymous post on sourceforge correctly pointed out a possible buffer
  overflow in the curl_unescape() function for URL conversions. The main
  problem with this bug is that the ftp download uses that function and this
  single- byte overflow could lead to very odd bugs (as one reported by Janne
  Johansson).

Daniel (19 March 2000):
- Marco G. Salvagno supplied me with a series of patches
  that now allows curl to get compiled on OS/2. It even includes a section in
  the INSTALL file. Very nice job!

Daniel (17 March 2000):
- Wham Bang supplied a patch for the lib/Makefile.vc6
  file. We still need some fixes for the config-win32.h since it appears that
  VC++ and mingw32 have different opinions about (at least) unistd.h's
  existence.

Daniel (15 March 2000):
- I modified the -D/--dump-header workings so that it doesn't write anything
  to the file until it needs to. This way, you can actually use -b and -D
  on the same file if you want repeated invokes to store and read the cookies
  in that one single file.

- Poked around in lots of texts. Added the BUGS file for bug reporting stuff.
  Added the classic HTTP POST question to the FAQ, removed some #ifdef WIN32
  stuff from the sources (they're covered by the config-win32.h now).

- Pascal Gaudette fixed a missing ldap.c problem in the
  Makefile.vc6 file. He also addressed a problem in src/config-win32.h.

Daniel (14 March 2000):
- Paul Harrington pointed out that the 'http_code' variable in the -w output
  was never written. I fixed it now.

- Janne Johansson reported the complaints that OpenBSD does
  when getdate.c #includes malloc.h. It claims stdlib.h should be included
  instead. I added #ifdef HAVE_MALLOC_H code in getdate.y and two checks in
  the configure.in for malloc.h and stdlib.h.

Version 6.5

Daniel (13 March 2000):
- <curl at spam.wolvesbane.net> pointed out that the way curl sent cookies in a
  single line wasn't enjoyed by IIS4.0 servers. In my view, that is not what
  the standards say, but I added a white space between the name/value pairs to
  perhaps make them work better.

- Added the perl check back in the configure.in again since the mkhelp.pl
  script needs it!

- Made some beautifications in the curl man page.

Daniel (3 March 2000):
- Jörn helped me update the config-win32.h files with HAVE_SETVBUF and
  HAVE_STRDUP.

Daniel (3 March 2000):
- Uploaded the 6.5pre2 package.

Daniel (2 March 2000):
- Removed the perl-programs from the distribution, they never made many people
  happy and I'll still keep them available on the web.

- Added the -w and -N stuff to the man page. Documented the new progress meter
  display in README.curl.

- Jörn Hartroth, Chris <cbayliss at csc.come> and Ulf
  Möller from the openssl development team helped bringing me the details for
  fixing an OpenSSL usage flaw. It became apparent when they released openssl
  0.9.5 since that barfed on curl's bad behavior (not seeding a random number
  thing).

- Yet another option: -N/--no-buffer disables buffering in the output stream.
  Probably most useful for very slow transfers when you really want to get
  every byte curl receives within some preferred time. Andrew <tmr at gci.net>
  suggested this.

- Damien Adant mailed me his fixes for making curl compile on Ultrix.

Daniel (24 February 2000):
- Applied Jörn Hartroth's fixes for config-win32.h and lib/Makefile.w32.

  I should also make a note here, if nothing else to myself, that when using
  the %-syntax for variables in DOS command prompts, you must use two %-
  letters for each one since that is an escape letter there! Maybe I should
  use another letter instead!

- Added more variables to -w:

  'http_code'
  'time_namelookup'
  'time_connect'
  'time_pretransfer'
  'url_effective'

- Made -w@filename read the syntax from a file and -w@- reads the syntax from
  stdin in the good old "standard" curl way.

Daniel (22 February 2000):
- Released a 6.5pre1 version to get some test and user feedback.

Daniel (21 February 2000):

- I added the -w/--write-out flag and some variables to go with it. -w is a
  single string, whatever you enter there will be written out when curl has
  completed a successful request. There are some variable substitutions and
  they are specified as '%{variable}' (without the quotes). Variables that
  exist as of this moment are:

        total_time     - total transfer time in seconds (with 2 decimals)
        size_download  - total downloaded amount of bytes
        size_upload    - total uploaded amount of bytes
        speed_download - the average speed of the entire download
        speed_upload   - the average speed of the entire upload

  I will of course add more variables, but I need input on these and others.

- It struck me that the -# progress bar will be hard to just apply on the new
  progress bar concept. I need some feedback on this before that'll get re-
  introduced! :-/

Daniel (16 February 2000):
- Jörn Hartroth brought me some fixes for the progress meter and I continued
  working on it. It seems to work for http download, http post, ftp download
  and ftp upload. It should be a pretty good test it works generally good.

- Still need to add the -# progress bar into the new style progress interface.

- Gonna have a go at my new output option parameter next.

Daniel (15 February 2000):
- The progress meter stuff is slowly taking place. There's more left before it
  is working ok and everything is tested, but we're reaching there. Slowly!

Daniel (11 February 2000):
- Paul Marquis fixed the config file parsing of curl to
  deal with any-length lines, removing the previous limit of 4K.

- Eetu Ojanen's suggestion of supporting the @-style for -b
  is implemented. Now -b@<filename> works as well as the old style. -b@- also
  similarly reads the cookies from stdin.

- Reminder: -D should not write to the file until it needs to, in the same way
  -o does. That would enable curl to use -b and -D on the same file...

- Ellis Pritchard made getdate.y work for MacOS X.

- Paul Harrington helped me out finding the crash in the
  cookie parser. He also pointed out curl's habit of sending empty cookies to
  the server.

Daniel (8 February 2000):
 - Ron Zapp corrected a problem in src/urlglob.c that
   prevented curl from getting compiled on sunos 4. The problem had to do
   with the difference in sprintf() return code types.

 - Transfer() should now be able to download and upload simultaneously. Let's
   do some progress meter fixes later this week.

Daniel (31 January 2000):
 - Paul Harrington found another core dump in the cookie
   parser. Curl doesn't properly recognize the 'version' keyword and I think
   that is what caused this. I need to refresh some specs on cookies and see
   what else curl lacks to improve this a bit more once and for all.

   RFC 2109 clearly specifies how cookies should be dealt with when they are
   compliant with that spec. I don't think many servers are though...

 - Mark W. Eichin found that while curl is uploading a form
   to a web site, it doesn't read incoming data why it'll hang after a while
   since the socket "pipe" becomes full.

   It took me two hours to rewrite Download() and Upload() into the new
   single function Transfer(). It even seems to work! More testing is required
   of course... I should get the header-sending together in a kind of queue
   and let them get "uploaded" in Transfer() as well.

 - Zhibiao Wu pointed out a curl bug in the location: area,
   although I did not get a reproducible way to do this why I have to wait
   with fixing anything.

 - Bob Schader suggested I should implement resume
   support for the HTTP PUT operation, and as I think it is a valid suggestion
   I'll work on it.

Daniel (25 January 2000):
 - M Travis Obenhaus pointed out a manual mixup with -y and -Y that was
   corrected.

 - Jens Schleusener pointed out a problem to compile
   curl on AIX 4.1.4 and gave me a solution. This problem was already fixed
   by Jörn's recent #include modifications!

Daniel (19 January 2000):
 - Oskar Liljeblad pointed out and corrected a problem
   in the Location: following system that made curl following a location: to a
   different protocol to fail.

   At January 31st I re-considered this fix and the surrounding source code. I
   could not really see that the patch did any difference, why I removed it
   again for further research and debugging. (It disabled location: following
   on server not running on default ports.)

 - Jörn Hartroth brought a fix that once again
   made it possible to select progress bar.

 - Jörn also fixed a few include problems.

Version 6.4

Daniel (17 January 2000):
 - Based on suggestions from Björn Stenberg, I made the
   progress deal better with larger files and added a "Time" field which shows
   the time spent on the download so far.
 - I'm now using the CVS repository on sourceforge.net, which also allows web
   browsing. See http://curl.haxx.nu.

Daniel (10 January 2000):
 - Renumbered some enums in curl/curl.h since tag number 35 was used twice!
 - Added "postquote" support to the ftp section that enables post-ftp-transfer
   quote commands.
 - Now made the -Q/--quote parameter recognize '-' as a prefix, which means
   that command will be issued AFTER a successful ftp transfer. This can of
   course be used to delete or rename a file after it has been uploaded or
   downloaded. Use your imagination! ;-)
 - Since I do the main development on solaris 2.6 now, I had to download and
   install GNU groff to generate the hugehelp.c file. The solaris nroff cores
   on the man page! So, in order to make the solaris configure script find a
   better result I made gnroff get checked prior to the regular nroff.
 - Added all the curl exit codes to the man page.
 - Jim Gallagher properly tracked down a bug in autoconf
   2.13. The AC_CHECK_LIB() macro wrongfully uses the -l flag before the -L
   flag to 'ld' which causes the HP-UX 10.20 flavour to fail on all libchecks
   and therefore you can't make the configure script find the openssl libs!