if userpwd is "username:", this now implies a blank password while only

"username" will cause libcurl to prompt for password. Bryan Kemp noticed.

test case 136 is added for this

2 files changed, 13 insertions, 5 deletions

diff --git a/lib/url.c b/lib/url.c
index d085f3ce4..ad0acd3bb 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -2526,14 +2526,17 @@ static CURLcode CreateConnection(struct SessionHandle *data,
       /* the name is given, get user+password */
       sscanf(data->set.userpwd, "%127[^:]:%127[^\n]",
              data->state.user, data->state.passwd);
+      if(strchr(data->set.userpwd, ':'))
+        /* a colon means the password was given, even if blank */
+        data->state.passwdgiven = TRUE;
     }
     else
-      /* no name given, get the password only */
+      /* no name given, starts with a colon, get the password only */
       sscanf(data->set.userpwd+1, "%127[^\n]", data->state.passwd);
   }
 
   if (data->set.use_netrc != CURL_NETRC_IGNORED &&
-      data->state.passwd[0] == '\0' ) {  /* need passwd */
+      !data->state.passwdgiven) {  /* need passwd */
     if(Curl_parsenetrc(conn->hostname,
                        data->state.user,
                        data->state.passwd)) {
@@ -2544,8 +2547,7 @@ static CURLcode CreateConnection(struct SessionHandle *data,
   }
 
   /* if we have a user but no password, ask for one */
-  if(conn->bits.user_passwd &&
-     !data->state.passwd[0] ) {
+  if(conn->bits.user_passwd && !data->state.passwdgiven ) {
     if(data->set.fpasswd(data->set.passwd_client,
                          "password:", data->state.passwd,
                          sizeof(data->state.passwd)))
@@ -2556,9 +2558,12 @@ static CURLcode CreateConnection(struct SessionHandle *data,
 
   /* If our protocol needs a password and we have none, use the defaults */
   if ( (conn->protocol & (PROT_FTP|PROT_HTTP)) &&
-       !conn->bits.user_passwd) {
+       !conn->bits.user_passwd &&
+       !data->state.passwdgiven) {
+
     strcpy(data->state.user, CURL_DEFAULT_USER);
     strcpy(data->state.passwd, CURL_DEFAULT_PASSWORD);
+
     /* This is the default password, so DON'T set conn->bits.user_passwd */
   }
 
diff --git a/lib/urldata.h b/lib/urldata.h
index 153825d4b..b8145acc0 100644
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -570,6 +570,9 @@ struct UrlState {
   char proxyuser[MAX_CURL_USER_LENGTH];
   char proxypasswd[MAX_CURL_PASSWORD_LENGTH];
 
+  bool passwdgiven; /* set TRUE if an application-provided password has been
+                       set */
+
   struct timeval keeps_speed; /* for the progress meter really */
 
   /* 'connects' will be an allocated array with pointers. If the pointer is