Skip to content
  1. Apr 13, 2009
  2. Apr 11, 2009
  3. Apr 09, 2009
  4. Apr 08, 2009
  5. Apr 06, 2009
  6. Apr 03, 2009
  7. Apr 02, 2009
  8. Apr 01, 2009
  9. Mar 31, 2009
  10. Mar 29, 2009
  11. Mar 18, 2009
  12. Mar 15, 2009
    • Gisle Vanem's avatar
      · 0ac8e1d8
      Gisle Vanem authored
      If CURL_DISABLE_PROXY is defined, we must allow socks_sspi.c to call
      Curl_blockread_all(). It is needed in code inside USE_WINDOWS_SSPI.
      0ac8e1d8
  13. Mar 13, 2009
  14. Mar 12, 2009
  15. Mar 11, 2009
  16. Mar 09, 2009
    • Daniel Stenberg's avatar
      - Frank Hempel found out a bug and provided the fix: · bdec6f2b
      Daniel Stenberg authored
        curl_easy_duphandle did not necessarily duplicate the CURLOPT_COOKIEFILE
        option. It only enabled the cookie engine in the destination handle if
        data->cookies is not NULL (where data is the source handle). In case of a
        newly initialized handle which just had the cookie support enabled by a
        curl_easy_setopt(handle, CURL_COOKIEFILE, "")-call, handle->cookies was
        still NULL because the setopt-call only appends the value to
        data->change.cookielist, hence duplicating this handle would not have the
        cookie engine switched on.
      
        We also concluded that the slist-functionality would be suitable for being
        put in its own module rather than simply hanging out in lib/sendf.c so I
        created lib/slist.[ch] for them.
      bdec6f2b
    • Dan Fandrich's avatar
      a9a03b97
  17. Mar 08, 2009
  18. Mar 05, 2009
  19. Mar 03, 2009
  20. Mar 02, 2009
    • Daniel Stenberg's avatar
      - David Kierznowski notified us about a security flaw · 042cc1f6
      Daniel Stenberg authored
        (http://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in
        which previous libcurl versions (by design) can be tricked to access an
        arbitrary local/different file instead of a remote one when
        CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release
        together this the addition of two new setopt options for controlling this
        new behavior:
      
        o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to
        follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option
        excludes the FILE and SCP protocols and thus you nee to explicitly allow
        them in your app if you really want that behavior.
      
        o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch
        using the primary URL option. This is useful if you want to allow a user or
        other outsiders control what URL to pass to libcurl and yet not allow all
        protocols libcurl may have been built to support.
      curl-7_19_4
      042cc1f6
  21. Feb 28, 2009
  22. Feb 27, 2009
  23. Feb 25, 2009
  24. Feb 24, 2009