Skip to content
  1. Mar 15, 2009
    • Gisle Vanem's avatar
      · 0ac8e1d8
      Gisle Vanem authored
      If CURL_DISABLE_PROXY is defined, we must allow socks_sspi.c to call
      Curl_blockread_all(). It is needed in code inside USE_WINDOWS_SSPI.
      0ac8e1d8
  2. Mar 13, 2009
  3. Mar 12, 2009
  4. Mar 11, 2009
  5. Mar 09, 2009
    • Daniel Stenberg's avatar
      - Frank Hempel found out a bug and provided the fix: · bdec6f2b
      Daniel Stenberg authored
        curl_easy_duphandle did not necessarily duplicate the CURLOPT_COOKIEFILE
        option. It only enabled the cookie engine in the destination handle if
        data->cookies is not NULL (where data is the source handle). In case of a
        newly initialized handle which just had the cookie support enabled by a
        curl_easy_setopt(handle, CURL_COOKIEFILE, "")-call, handle->cookies was
        still NULL because the setopt-call only appends the value to
        data->change.cookielist, hence duplicating this handle would not have the
        cookie engine switched on.
      
        We also concluded that the slist-functionality would be suitable for being
        put in its own module rather than simply hanging out in lib/sendf.c so I
        created lib/slist.[ch] for them.
      bdec6f2b
    • Dan Fandrich's avatar
      a9a03b97
  6. Mar 08, 2009
  7. Mar 05, 2009
  8. Mar 03, 2009
  9. Mar 02, 2009
    • Daniel Stenberg's avatar
      - David Kierznowski notified us about a security flaw · 042cc1f6
      Daniel Stenberg authored
        (http://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in
        which previous libcurl versions (by design) can be tricked to access an
        arbitrary local/different file instead of a remote one when
        CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release
        together this the addition of two new setopt options for controlling this
        new behavior:
      
        o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to
        follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option
        excludes the FILE and SCP protocols and thus you nee to explicitly allow
        them in your app if you really want that behavior.
      
        o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch
        using the primary URL option. This is useful if you want to allow a user or
        other outsiders control what URL to pass to libcurl and yet not allow all
        protocols libcurl may have been built to support.
      curl-7_19_4
      042cc1f6
  10. Feb 28, 2009
  11. Feb 27, 2009
  12. Feb 25, 2009
  13. Feb 24, 2009
  14. Feb 23, 2009
  15. Feb 20, 2009
  16. Feb 19, 2009
    • Daniel Stenberg's avatar
      - Patrik Thunstrom reported a problem and helped me repeat it. It turned out · 5af0629b
      Daniel Stenberg authored
        libcurl did a superfluous 1000ms wait when doing SFTP downloads!
      
        We read data with libssh2 while doing the "DO" operation for SFTP and then
        when we were about to start getting data for the actual file part, the
        "TRANSFER" part, we waited for socket action (in 1000ms) before doing a
        libssh2-read. But in this case libssh2 had already read and buffered the
        data so we ended up always just waiting 1000ms before we get working on the
        data!
      5af0629b
  17. Feb 18, 2009
  18. Feb 17, 2009
  19. Feb 14, 2009
  20. Feb 12, 2009
  21. Feb 11, 2009
  22. Feb 07, 2009