aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2009-03-02- David Kierznowski notified us about a security flawDaniel Stenberg
(http://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in which previous libcurl versions (by design) can be tricked to access an arbitrary local/different file instead of a remote one when CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release together this the addition of two new setopt options for controlling this new behavior: o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option excludes the FILE and SCP protocols and thus you nee to explicitly allow them in your app if you really want that behavior. o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch using the primary URL option. This is useful if you want to allow a user or other outsiders control what URL to pass to libcurl and yet not allow all protocols libcurl may have been built to support.
2009-03-027.19.4 won't get anything elseDaniel Stenberg
2009-03-02the Eiffel bindingDaniel Stenberg
2009-03-01nothing more left for 7.19.4, the issue #216 is moved to 7.19.5 since we'reDaniel Stenberg
too close to release now
2009-02-28for portability reasons: s/inet_pton/Curl_inet_pton/Yang Tse
2009-02-28fix compiler warningYang Tse
2009-02-27mention the '-o -' trickDaniel Stenberg
2009-02-27217 - Dan Fandrich's "GnuTLS initialization thread safety"Daniel Stenberg
218 - Senthil Raja Velu's "CURLOPT_LOCALPORT option broken", patch by Markus Koetter Both are now committed
2009-02-27- Senthil Raja Velu reported a problem when CURLOPT_INTERFACE andDaniel Stenberg
CURLOPT_LOCALPORT were used together (the local port bind failed), and Markus Koetter provided the fix!
2009-02-27Indentation fixes, untabify and related whitespace-cleanup. No code changed.Daniel Stenberg
2009-02-25corrected and clarified the top commentDaniel Stenberg
2009-02-25- As Daniel Fandrich figured out, we must do the GnuTLS initing in theDaniel Stenberg
curl_global_init() function to properly maintain the performing functions thread-safe. We've previously (28 April 2007) moved the init to a later time just to avoid it to fail very early when libgcrypt dislikes the situation, but that move was bad and the fix should rather be in libgcrypt or elsewhere.
2009-02-24improvedDaniel Stenberg
2009-02-24A handy little helper file for doing recursive diffs on curl source/build treesDaniel Stenberg
without involving CVS: diff -X diff-exclude -ru curl-old curl-patched
2009-02-24- Brian J. Murrell found out that Negotiate proxy authentication didn't work.Daniel Stenberg
It happened because the code used the struct for server-based auth all the time for both proxy and server auth which of course was wrong.
2009-02-234.17 Non-functional connect timeoutsDaniel Stenberg
2009-02-23- After a bug reported by James Cheng I've made curl_easy_getinfo() forDaniel Stenberg
CURLINFO_CONTENT_LENGTH_DOWNLOAD and CURLINFO_CONTENT_LENGTH_UPLOAD return -1 if the sizes aren't know. Previously these returned 0, make it impossible to detect the difference between actually zero and unknown.
2009-02-23For 7.19.5 (due to feature freeze)Daniel Stenberg
220 - Take advantage of libssh2_version() that's been added for the upcoming 1.1, to extract the run-time version number properly.
2009-02-23adjustment for new Mac OS X framework build scriptYang Tse
2009-02-23Daniel Johnson provided a shell script that will perform all the steps neededYang Tse
to build a Mac OS X fat ppc/i386 or ppc64/x86_64 libcurl.framework
2009-02-23mention default port numberDaniel Stenberg
2009-02-23- I renamed everything in the windows builds files that used the name 'curllib'Daniel Stenberg
to the proper 'libcurl' as clearly this caused confusion.
2009-02-23lzma compressed tarballs too for some testing, it does produce MUCH smallerDaniel Stenberg
files
2009-02-23use the internal snprintf() functionYang Tse
2009-02-20mention 4 pending fixes/patchesDaniel Stenberg
2009-02-20Mark Incley noticed VS2008 compilation halting when building for Windows 2000Yang Tse
2009-02-20Do not halt compilation when using VS2008 to build a Windows 2000 targetYang Tse
2009-02-20clarified the FTP passive/active mode options somewhatDaniel Stenberg
2009-02-20the FTP multi interface bugDaniel Stenberg
2009-02-20- Linus Nielsen Feltzing reported and helped me repeat and fix a problem withDaniel Stenberg
FTP with the multi interface: when a transfer fails, like when aborted by a write callback, the control connection was wrongly closed and thus not re-used properly. This change is also an attempt to cleanup the code somewhat in this area, as now the FTP code attempts to keep (better) track on pending responses necessary to get read in ftp_done().
2009-02-19The C++ binding home was changedDaniel Stenberg
2009-02-19verify that a 550-response for a RETR returns 78 but also that the controlDaniel Stenberg
connection is kept alive afterwards
2009-02-19- Patrik Thunstrom reported a problem and helped me repeat it. It turned outDaniel Stenberg
libcurl did a superfluous 1000ms wait when doing SFTP downloads! We read data with libssh2 while doing the "DO" operation for SFTP and then when we were about to start getting data for the actual file part, the "TRANSFER" part, we waited for socket action (in 1000ms) before doing a libssh2-read. But in this case libssh2 had already read and buffered the data so we ended up always just waiting 1000ms before we get working on the data!
2009-02-18spell-fixed comments and other minor non-code editsDaniel Stenberg
2009-02-18FTP downloads (i.e.: RETR) ending with code 550 now return error ↵Patrick Monnerat
CURLE_REMOTE_FILE_NOT_FOUND instead of CURLE_FTP_COULDNT_RETR_FILE.
2009-02-17Continue sync work on OS400 specific code and RPG binding.Patrick Monnerat
2009-02-17- Kamil Dudka made NSS-powered builds compile and run again!Daniel Stenberg
2009-02-17- A second follow-up change by Andre Guibert de Bruet to fix a related memoryDaniel Stenberg
leak like that fixed on the 14th. When zlib returns failure, we need to cleanup properly before returning error.
2009-02-17three new CURLFTP_CREATE_DIR* symbolsDaniel Stenberg
2009-02-17- CURLOPT_FTP_CREATE_MISSING_DIRS can now be set to 2 in addition to 1 forDaniel Stenberg
plain FTP connections, and it will then allow MKD to fail once and retry the CWD afterwards. This is especially useful if you're doing many simultanoes connections against the same server and they all have this option enabled, as then CWD may first fail but then another connection does MKD before this connection and thus MKD fails but trying CWD works! The numbers can (should?) now be set with the convenience enums now called CURLFTP_CREATE_DIR and CURLFTP_CREATE_DIR_RETRY. Tests has proven that if you're making an application that uploads a set of files to an ftp server, you will get a noticable gain in speed if you're using multiple connections and this option will be then be very useful.
2009-02-16Preparation of imminent release: synchronizing OS400 wrappers + RPG binding ↵Patrick Monnerat
to current state.
2009-02-14In MSVC9 'time_t' is a 64-bit quantity. This causes a truncation warningGisle Vanem
when an 'int' is assigned to a 'time_t' variable. Hence redefine 'retry_time' and 'retry_max' to 'time_t'.
2009-02-14nah, use the simpler year - year range syntax only, no matter what emacs'Daniel Stenberg
copyright-update script thinks
2009-02-14- Andre Guibert de Bruet found and fixed a memory leak in the content encodingDaniel Stenberg
code, which could happen on libz errors.
2009-02-13there is nothing left planned for next release, metalink experiments are post-Daniel Stenberg
poned
2009-02-13Anthony Bryan's letter=>symbol fixesDaniel Stenberg
2009-02-13ignoreYang Tse
2009-02-13Remove following files generated on previous buildconf run:Yang Tse
ltoptions.m4 ltsugar.m4 ltversion.m4 lt~obsolete.m4
2009-02-13check for poll() as it is done for other functionsYang Tse
2009-02-12Fixed NTLM on curl-config --features with GnuTLSDan Fandrich