Guillaume Cottenceau's patch that adds CURLOPT_UNRESTRICTED_AUTH that

disables the host name check in the FOLLOWLOCATION code. With that option
set, libcurl will send user+password to all hosts.

3 files changed, 11 insertions, 1 deletions

diff --git a/lib/http.c b/lib/http.c
index 850731ce3..1a9bd2a1d 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -663,7 +663,8 @@ CURLcode Curl_http(struct connectdata *conn)
        host due to a location-follow, we do some weirdo checks here */
     if(!data->state.this_is_a_follow ||
        !data->state.auth_host ||
-       curl_strequal(data->state.auth_host, conn->hostname)) {
+       curl_strequal(data->state.auth_host, conn->hostname) ||
+       data->set.http_disable_hostname_check_before_authentication) {
       sprintf(data->state.buffer, "%s:%s",
               data->state.user, data->state.passwd);
       if(Curl_base64_encode(data->state.buffer, strlen(data->state.buffer),
diff --git a/lib/url.c b/lib/url.c
index 8a61d05ae..43e92b961 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -503,6 +503,14 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option, ...)
      */
     data->set.http_follow_location = va_arg(param, long)?TRUE:FALSE;
     break;
+  case CURLOPT_UNRESTRICTED_AUTH:
+    /*
+     * Send authentication (user+password) when following locations, even when
+     * hostname changed.
+     */
+    data->set.http_disable_hostname_check_before_authentication =
+      va_arg(param, long)?TRUE:FALSE;
+    break;
   case CURLOPT_HTTP_VERSION:
     /*
      * This sets a requested HTTP version to be used. The value is one of
diff --git a/lib/urldata.h b/lib/urldata.h
index 93ad35b60..eb5952174 100644
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -736,6 +736,7 @@ struct UserDefined {
   bool hide_progress;
   bool http_fail_on_error;
   bool http_follow_location;
+  bool http_disable_hostname_check_before_authentication;
   bool include_header;
 #define http_include_header include_header /* former name */