Commit 169fedbd authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

login options: remove the ;[options] support from CURLOPT_USERPWD 

To avoid the regression when users pass in passwords containing semi-
colons, we now drop the ability to set the login options with the same
options. Support for login options in CURLOPT_USERPWD was added in
7.31.0.

Test case 83 was modified to verify that colons and semi-colons can be
used as part of the password when using -u (CURLOPT_USERPWD).

Bug: http://curl.haxx.se/bug/view.cgi?id=1311


Reported-by: Petr Bahula
Assisted-by: Steve Holme
Signed-off-by: default avatarDaniel Stenberg <daniel@haxx.se>
parent 32b9c30e

docs/libcurl/curl_easy_setopt.3

+7 −7
Original line number Diff line number Diff line
@@ -1165,22 +1165,22 @@ authentication. You should not use this option together with the (older) 
CURLOPT_USERPWD option.



To specify the password and login options, along with the user name, use the

\fICURLOPT_PASSWORD\fP and \fICURLOPT_OPTIONS\fP options or alternatively use

the older \CURLOPT_USERPWD\fP option instead. (Added in 7.19.1)

\fICURLOPT_PASSWORD\fP and \fICURLOPT_LOGIN_OPTIONS\fP options. (Added in

7.19.1)

.IP CURLOPT_PASSWORD

Pass a char * as parameter, which should be pointing to the zero terminated

password to use for the transfer.



The CURLOPT_PASSWORD option should be used in conjunction with the

\fICURLOPT_USERNAME\fP option. (Added in 7.19.1)

.IP CURLOPT_OPTIONS

.IP CURLOPT_LOGIN_OPTIONS

Pass a char * as parameter, which should be pointing to the zero terminated

options string to use for the transfer.



\CURLOPT_OPTIONS\fP can be used to set protocol specific authentication options,

such as the preferred authentication mechanism via "AUTH=NTLM" or "AUTH=*", and

should be used in conjunction with the \fICURLOPT_USERNAME\fP option. (Added in

7.34.0)

\CURLOPT_LOGIN_OPTIONS\fP can be used to set protocol specific login options,

such as the preferred authentication mechanism via "AUTH=NTLM" or "AUTH=*",

and should be used in conjunction with the \fICURLOPT_USERNAME\fP option.

(Added in 7.34.0)

.IP CURLOPT_PROXYUSERNAME

Pass a char * as parameter, which should be pointing to the zero terminated

user name to use for the transfer while connecting to Proxy.

docs/libcurl/symbols-in-versions

+1 −1
Original line number Diff line number Diff line
@@ -395,6 +395,7 @@ CURLOPT_KRB4LEVEL 7.3 7.17.0 
CURLOPT_KRBLEVEL                7.16.4

CURLOPT_LOCALPORT               7.15.2

CURLOPT_LOCALPORTRANGE          7.15.2

CURLOPT_LOGIN_OPTIONS           7.34.0

CURLOPT_LOW_SPEED_LIMIT         7.1

CURLOPT_LOW_SPEED_TIME          7.1

CURLOPT_MAIL_AUTH               7.25.0
@@ -418,7 +419,6 @@ CURLOPT_NOSIGNAL 7.10 
CURLOPT_NOTHING                 7.1.1         7.11.1      7.11.0

CURLOPT_OPENSOCKETDATA          7.17.1

CURLOPT_OPENSOCKETFUNCTION      7.17.1

CURLOPT_OPTIONS                 7.34.0

CURLOPT_PASSWDDATA              7.4.2         7.11.1      7.15.5

CURLOPT_PASSWDFUNCTION          7.4.2         7.11.1      7.15.5

CURLOPT_PASSWORD                7.19.1

include/curl/curl.h

+1 −1
Original line number Diff line number Diff line
@@ -1569,7 +1569,7 @@ typedef enum { 
  CINIT(DNS_LOCAL_IP6, OBJECTPOINT, 223),



  /* Set authentication options directly */

  CINIT(OPTIONS, OBJECTPOINT, 224),

  CINIT(LOGIN_OPTIONS, OBJECTPOINT, 224),



  CURLOPT_LASTENTRY /* the last unused */

} CURLoption;

include/curl/typecheck-gcc.h

+2 −2
Original line number Diff line number Diff line
@@ -7,7 +7,7 @@ 
 *                            | (__| |_| |  _ <| |___

 *                             \___|\___/|_| \_\_____|

 *

 * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.

 * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.

 *

 * This software is licensed as described in the file COPYING, which

 * you should have received as part of this distribution. The terms
@@ -269,7 +269,7 @@ _CURL_WARNING(_curl_easy_getinfo_err_curl_slist, 
   (option) == CURLOPT_DNS_INTERFACE ||                                       \

   (option) == CURLOPT_DNS_LOCAL_IP4 ||                                       \

   (option) == CURLOPT_DNS_LOCAL_IP6 ||                                       \

   (option) == CURLOPT_OPTIONS ||                                             \

   (option) == CURLOPT_LOGIN_OPTIONS ||                                       \

   0)



/* evaluates to true if option takes a curl_write_callback argument */

lib/url.c

+6 −15
Original line number Diff line number Diff line
@@ -299,13 +299,11 @@ static CURLcode setstropt(char **charp, char *s) 
  return CURLE_OK;

}



static CURLcode setstropt_userpwd(char *option, char **userp, char **passwdp,

                                  char **optionsp)

static CURLcode setstropt_userpwd(char *option, char **userp, char **passwdp)

{

  CURLcode result = CURLE_OK;

  char *user = NULL;

  char *passwd = NULL;

  char *options = NULL;



  /* Parse the login details if specified. It not then we treat NULL as a hint

     to clear the existing data */
@@ -313,7 +311,7 @@ static CURLcode setstropt_userpwd(char *option, char **userp, char **passwdp, 
    result = parse_login_details(option, strlen(option),

                                 (userp ? &user : NULL),

                                 (passwdp ? &passwd : NULL),

                                 (optionsp ? &options : NULL));

                                 NULL);

  }



  if(!result) {
@@ -335,12 +333,6 @@ static CURLcode setstropt_userpwd(char *option, char **userp, char **passwdp, 
      Curl_safefree(*passwdp);

      *passwdp = passwd;

    }



    /* Store the options part of option if required */

    if(optionsp) {

      Curl_safefree(*optionsp);

      *optionsp = options;

    }

  }



  return result;
@@ -1553,12 +1545,11 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option, 


  case CURLOPT_USERPWD:

    /*

     * user:password;options to use in the operation

     * user:password to use in the operation

     */

    result = setstropt_userpwd(va_arg(param, char *),

                               &data->set.str[STRING_USERNAME],

                               &data->set.str[STRING_PASSWORD],

                               &data->set.str[STRING_OPTIONS]);

                               &data->set.str[STRING_PASSWORD]);

    break;



  case CURLOPT_USERNAME:
@@ -1577,7 +1568,7 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option, 
                       va_arg(param, char *));

    break;



  case CURLOPT_OPTIONS:

  case CURLOPT_LOGIN_OPTIONS:

    /*

     * authentication options to use in the operation

     */
@@ -1662,7 +1653,7 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option, 
     */

    result = setstropt_userpwd(va_arg(param, char *),

                               &data->set.str[STRING_PROXYUSERNAME],

                               &data->set.str[STRING_PROXYPASSWORD], NULL);

                               &data->set.str[STRING_PROXYPASSWORD]);

    break;

  case CURLOPT_PROXYUSERNAME:

    /*