aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-02-06vms: config-vms.h is removed, no use trying to distribute itDaniel Stenberg
2013-02-06RELEASE-NOTES: mention the SASL buffer overflowDaniel Stenberg
2013-02-06Curl_sasl_create_digest_md5_message: fix buffer overflowEldar Zaitov
When negotiating SASL DIGEST-MD5 authentication, the function Curl_sasl_create_digest_md5_message() uses the data provided from the server without doing the proper length checks and that data is then appended to a local fixed-size buffer on the stack. This vulnerability can be exploited by someone who is in control of a server that a libcurl based program is accessing with POP3, SMTP or IMAP. For applications that accept user provided URLs, it is also thinkable that a malicious user would feed an application with a URL to a server hosting code targetting this flaw. Bug: http://curl.haxx.se/docs/adv_20130206.html
2013-02-06FEATURES: Removed erroneous whitespaceSteve Holme
Removed whitespace introduced in commit 5f8f20f5e65b that caused formatting issues when generating the website docs.
2013-02-06setup-vms.h: post VMS patch cleanup - IIIYang Tse
- rename post-config-vms.h to setup-vms.h - move its inclusion into proper location in curl_setup.h
2013-02-06vms_show: post VMS patch cleanup - IIYang Tse
- remove multiple declarations of vms_show and add comments
2013-02-06tool_main.c: post VMS patch cleanup - IYang Tse
- remove header inclusion already done in curl_setup_once.h
2013-02-06FEATURES: Added SSPI to list of NTLM librariesSteve Holme
2013-02-06FEATURES: Added Secure Transport and qssl to list of SSL librariesSteve Holme
2013-02-06FEATURES: Added email feature setSteve Holme
Added SMTP, SMTPS, POP3, POP3S, IMAP and IMAPS features.
2013-02-05imap.h: Corrected incorrect comment clarificationSteve Holme
Corrected comment clarification made in commit 167717b8069a.
2013-02-05COPYING: Updated copyright year to include 2013Steve Holme
2013-02-05RELEASE-NOTES: synced with 25f351424b3538Daniel Stenberg
8 more bug fixes mentioned
2013-02-05VMS: fix and generate the VMS build configJohn E. Malmberg
config_h.com is a new file that generates a config.h file based on the curl_config.h.in file and a quick scan of the configure script. This is actually a generic procedure that is shared with other VMS packages. The existing pre-built config-vms.h had over 100 entries that were not correct and in some cases conflicted with the build options available in the build_vms.com. generate_config_vms_h_curl.com is a helper procedure to the config_h.com. It covers the cases that the generic config_h.com is not able to figure out, and accepts input from the build_vms.com procedure. build_curlbuild_h.com is a new file to generate the curlbuild.h file that Curl is now using when it is using a curl_config.h file. post-config-vms.h is a new file that is needed to provide VMS specific definitions, and most of them need to be set before the system header files are included. The VMS build procedure is fixed: 1. Fixed to link in the correct HP ssl library. 2. Fixed to detect if HP Kerberos is installed. 3. Fixed to detect if HP LDAP is installed. 4. Fixed to detect if gnv$libzshr is installed. 5. Simplified the input parameter parsing to not use a loop. 6. Warn that 64 bit pointer option support is not complete in comments. 7. Default to IEEE floating if platform supports it so resulting libcurl will be compatible with other open source projects on VMS. 8. Default to LARGEFILE if platform supports it. 9. Default to enable SSL, LDAP, Kerberos, libz if the libraries are present. 10. Build with exact case global symbols for libcurl. 11. Generate linker option file needed. 12. Compiler list option only commonly needed items. 13. fulllist option for those who really want it. 14. Create debug symbol file on Alpha, IA64.
2013-02-05Curl_proxyCONNECT: return once CONNECT is sentDaniel Stenberg
By doing this unconditionally, we infer a simpler and more defined behavior. This also has the upside that test 1021 no longer fails for me even if I run with valgrind. Also fixed some wrong comments.
2013-02-05email: Reworked comments in the endofresp() functionsSteve Holme
Tidied up the comments in the endofresp() functions to be more meaningful prior to release.
2013-02-05schannel: Removed extended error connection setup flagMarc Hoersken
According KB975858 this flag may cause problems on Windows 7 and Windows Server 2008 R2 systems. Extended error information is not currently used by libcurl and therefore not a requirement. The flag may improve the SSL-connection shutdown in case of an error. This means it might be a good improvement in the future. Fixes bug/issue #1187 - thanks for the report
2013-02-05singleipconnect: Update *sockp for all CURLE_OKTor Arntsen
The 56b7c87c7 change left a case where a good sockfd was not copied to *sockp before returning with CURLE_OK
2013-02-05curl_easy_perform: Value stored to 'mcode' is never readDaniel Stenberg
pointed out by clang-analyzer
2013-02-05singleipconnect: remove dead assignmentDaniel Stenberg
pointed out by clang-analyzer
2013-02-05CURLMOPT_MAXCONNECTS: restore functionalityLinus Nielsen Feltzing
When a connection is no longer used, it is kept in the cache. If the cache is full, the oldest idle connection is closed. If no connection is idle, the current one is closed instead.
2013-02-05RELEASE-NOTES: Updated following recent changes to the email protocolsSteve Holme
Added recent additions and fixes following the changes to imap, pop3 and smtp. Additionally added another contributor that helped to test the imap sasl changes.
2013-02-04email: Provided extra comments following recent pop3/imap fixesSteve Holme
Provided additional clarification about the logic of the authenticate() functions following commit 6b6bdc83bd36 and b4270a9af1d0.
2013-02-05winbuild: include version info for .dll .exeAndrei Kurushin
Bug: http://curl.haxx.se/bug/view.cgi?id=1186
2013-02-04FAQ: clarify 5.13 How do I stop an ongoing transferDaniel Stenberg
Rich Gray provided good feedback and we now clarify that you can in fact stop a multi transfer at any point you like by removing the easy handle.
2013-02-04cmake: Fix mingw buildMatt Arsenault
2013-02-04cmake: updated OpenSSL buildSergei Nikulov
2013-02-04pop3.c: Updated variable names to use shorter / more readable variantSteve Holme
Tidied up code from commit 6b6bdc83bdUpdated where a few instances of the pop3c struct variable used the longer conndata struct rather than matching what other code in pop3_authenticate() used.
2013-02-04updated copyright years.Guenter Knauf
2013-02-04configure: update the copyright years for the output.Guenter Knauf
2013-02-03imap: Fixed no known authentication mechanism when fallback is requiredSteve Holme
Fixed an issue where (lib)curl is compiled without support for a supported challenge-response based SASL authentication mechanism, such as CRAM-MD5 or NTLM, the server doesn't support the LOGIN or PLAIN mechanisms and (lib)curl doesn't fallback to Clear Text authentication. Note: In order to fallback to Clear Text authentication properly this fix adds support for the LOGINDISABLED server capability. imap: Fixed no known authentication mechanism when fallback is required Fixed an issue where (lib)curl is compiled without support for a supported challenge-response based SASL authentication mechanism, such as CRAM-MD5 or NTLM, the server doesn't support the LOGIN or PLAIN mechanisms and (lib)curl doesn't fallback to Clear Text authentication. Note: In order to fallback to Clear Text authentication properly this fix adds support for the LOGINDISABLED server capability. Related bug: http://curl.haxx.se/mail/lib-2013-02/0004.html Reported by: Stanislav Ivochkin
2013-02-03pop3: Fixed no known authentication mechanism when fallback is requiredSteve Holme
Fixed an issue where (lib)curl is compiled without support for a supported challenge-response based SASL authentication mechanism, such as CRAM-MD5 or NTLM, the server doesn't support the LOGIN or PLAIN mechanisms and (lib)curl doesn't fallback to APOP or Clear Text authentication. Bug: http://curl.haxx.se/mail/lib-2013-02/0004.html Reported by: Stanislav Ivochkin
2013-02-01singleipconnect: simplify and clean upDaniel Stenberg
Remove timeout argument that's never used. Make the actual connection get detected on a single spot to reduce code duplication. Store the IPv6 state already when the connection is attempted.
2013-02-01Curl_perfom: removedDaniel Stenberg
Curl_perfom is no longer used anywhere since the always-multi commit c43127414d89ccb9, and some related functions were used only from within Curl_perfom.
2013-01-30Updated date.Guenter Knauf
2013-01-30zz40-xc-ovr.m4: fix 'wc' detection - follow-up 2Yang Tse
- Fix a pair of single quotes to double quotes. URL: http://curl.haxx.se/mail/lib-2013-01/0355.html Reported by: Tor Arntsen
2013-01-30zz40-xc-ovr.m4: fix 'wc' detection - follow-upYang Tse
- Take into account that 'wc' may return leading spaces and/or tabs. - Set initial IFS to space, tab and newline.
2013-01-30zz40-xc-ovr.m4: fix 'wc' detectionYang Tse
- Take into account that 'wc' may return leading spaces. - Set internationalization behavior variables. Tor Arntsen analyzed and reported the issue. URL: http://curl.haxx.se/mail/lib-2013-01/0351.html
2013-01-29zz40-xc-ovr.m4: check another three basic utilitiesYang Tse
2013-01-29Fixed debug.c to work again unchanged.Guenter Knauf
Added CURLOPT_FOLLOWLOCATION since example.com is now redirected.
2013-01-29darwinssl: Fix bug where packets were sometimes transmitted twiceNick Zitzmann
There was a bug where, if SSLWrite() returned errSSLWouldBlock but did succeed in transmitting at least something, then we'd incorrectly resend the packet. Now we never take errSSLWouldBlock as a sign that nothing was transferred to/from the server. Bug: http://curl.haxx.se/mail/lib-2013-01/0295.html Reported by: Bruno de Carvalho
2013-01-28FAQ: "Darwinssl" is AKA "Secure Transport" and supports NTLMNick Zitzmann
2013-01-28RELEASE-NOTES: only list Nick onceDaniel Stenberg
Even though he's a fine dude, once is enough for this time!
2013-01-28zz40-xc-ovr.m4: 1.0 interface stabilizationYang Tse
- Stabilization results in 4 public interface m4 macros: XC_CONFIGURE_PREAMBLE XC_CONFIGURE_PREAMBLE_VER_MAJOR XC_CONFIGURE_PREAMBLE_VER_MINOR XC_CHECK_PATH_SEPARATOR - Avoid one level of internal indirection - Update comments - Drop XC_OVR_ZZ40 macro
2013-01-28docs: fix typos in man pagesKamil Dudka
Reported by: Jiri Jaburek Bug: https://bugzilla.redhat.com/896544
2013-01-28docs: update the comments about loading CA certs with NSSKamil Dudka
Bug: https://bugzilla.redhat.com/696783
2013-01-28Updated dependency libs.Guenter Knauf
2013-01-28Fixed simple.c to work again unchanged.Guenter Knauf
Added CURLOPT_FOLLOWLOCATION since example.com is now redirected.
2013-01-27smtp.c: Fixed unnecessary state change if starttls failsSteve Holme
The state machine should only be changed to SMTP_STARTTLS when the STARTTLS command has been successfully sent to the server.
2013-01-27pop3.c: Fixed unnecessary state change if starttls failsSteve Holme
The state machine should only be changed to POP3_STARTTLS when the STLS command has been successfully sent to the server.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 04:44:56 +0000