aboutsummaryrefslogtreecommitdiff
path: root/docs/libcurl
AgeCommit message (Collapse)Author
2009-03-18minor fixDaniel Stenberg
2009-03-05Expanded the security section of the libcurl-tutorial man page to coverDan Fandrich
more issues for authors to consider when writing robust libcurl-using applications.
2009-03-02- David Kierznowski notified us about a security flawDaniel Stenberg
(http://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in which previous libcurl versions (by design) can be tricked to access an arbitrary local/different file instead of a remote one when CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release together this the addition of two new setopt options for controlling this new behavior: o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option excludes the FILE and SCP protocols and thus you nee to explicitly allow them in your app if you really want that behavior. o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch using the primary URL option. This is useful if you want to allow a user or other outsiders control what URL to pass to libcurl and yet not allow all protocols libcurl may have been built to support.
2009-02-23- After a bug reported by James Cheng I've made curl_easy_getinfo() forDaniel Stenberg
CURLINFO_CONTENT_LENGTH_DOWNLOAD and CURLINFO_CONTENT_LENGTH_UPLOAD return -1 if the sizes aren't know. Previously these returned 0, make it impossible to detect the difference between actually zero and unknown.
2009-02-23mention default port numberDaniel Stenberg
2009-02-17three new CURLFTP_CREATE_DIR* symbolsDaniel Stenberg
2009-02-17- CURLOPT_FTP_CREATE_MISSING_DIRS can now be set to 2 in addition to 1 forDaniel Stenberg
plain FTP connections, and it will then allow MKD to fail once and retry the CWD afterwards. This is especially useful if you're doing many simultanoes connections against the same server and they all have this option enabled, as then CWD may first fail but then another connection does MKD before this connection and thus MKD fails but trying CWD works! The numbers can (should?) now be set with the convenience enums now called CURLFTP_CREATE_DIR and CURLFTP_CREATE_DIR_RETRY. Tests has proven that if you're making an application that uploads a set of files to an ftp server, you will get a noticable gain in speed if you're using multiple connections and this option will be then be very useful.
2009-02-11- CURLINFO_CONDITION_UNMET was added to allow an application to get to know ifDaniel Stenberg
the condition in the previous request was unmet. This is typically a time condition set with CURLOPT_TIMECONDITION and was previously not possible to reliably figure out. From bug report #2565128 (http://curl.haxx.se/bug/view.cgi?id=2565128)
2009-02-10completed the CURLPROXY_ collectionDaniel Stenberg
2009-02-10include the symbols-in-versions file in the release archiveDaniel Stenberg
2009-02-10introducing the symbols-in-versions file, in an effort to help app authorsDaniel Stenberg
to better know and track symbols in earlier libcurl versions
2009-02-10mention when CURLOPT_ADDRESS_SCOPE was addedDaniel Stenberg
2009-02-06Mention the first release of CURLOPT_FTP_FILEMETHODDan Fandrich
2009-02-02- Craig A West brought us: libcurl now defaults to do CONNECT with HTTPDaniel Stenberg
version 1.1 instead of 1.0 like before. This change also introduces the new proxy type for libcurl called 'CURLPROXY_HTTP_1_0' that then allows apps to switch (back) to CONNECT 1.0 requests. The curl tool also got a --proxy1.0 option that works exactly like --proxy but sets CURLPROXY_HTTP_1_0. I updated all test cases cases that use CONNECT and I tried to do some using --proxy1.0 and some updated to do CONNECT 1.1 to get both versions run.
2009-01-28- Markus Moeller introduced two new options to libcurl:Daniel Stenberg
CURLOPT_SOCKS5_GSSAPI_SERVICE and CURLOPT_SOCKS5_GSSAPI_NEC to allow libcurl to do GSS-style authentication with SOCKS5 proxies. The curl tool got the options called --socks5-gssapi-service and --socks5-gssapi-nec to enable these.
2009-01-26- Chad Monroe provided the new CURLOPT_TFTP_BLKSIZE option that allows an appDaniel Stenberg
to set desired block size to use for TFTP transfers instead of the default 512 bytes.
2009-01-25- Craig A West brought CURLOPT_NOPROXY and the corresponding --noproxy option.Daniel Stenberg
They basically offer the same thing the NO_PROXY environment variable only offered previously: list a set of host names that shall not use the proxy even if one is specified.
2009-01-12Mohun Biswas clarifiedDaniel Stenberg
2008-12-29further clarifcation based on input from Anthony BryanDaniel Stenberg
2008-12-28Anthony Bryan's man page cleanup in language and spellingDaniel Stenberg
2008-12-28Anthony Bryan reported quirks, I updatedDaniel Stenberg
2008-12-28Anthony Bryan reported and I corrected two typos.Daniel Stenberg
2008-12-28The CURLOPT_KRBLEVEL description wasn't properly formatted and thus wasDaniel Stenberg
corrupted in ouputs. Another report from Anthony Bryan.
2008-12-28Anthony Bryan reported this outputs wrong in the PDF and I've now tried toDaniel Stenberg
escape these letters what I think is the correct way.
2008-12-22- Anthony Bryan provided a set of patches that cleaned up manual language,Daniel Stenberg
corrected spellings and more.
2008-12-19expand the CURLOPT_POSTREDIR explanationDaniel Stenberg
2008-12-10- Internet Explorer had a broken HTTP digest authentication before v7 andDaniel Stenberg
there are servers "out there" that relies on the client doing this broken Digest authentication. Apache even comes with an option to work with such broken clients. The difference is only for URLs that contain a query-part (a '?'-letter and text to the right of it). libcurl now supports this quirk, and you enable it by setting the CURLAUTH_DIGEST_IE bit in the bitmask you pass to the CURLOPT_HTTPAUTH or CURLOPT_PROXYAUTH options. They are thus individually controlled to server and proxy.
2008-12-09Documented CURLOPT_CONNECT_ONLY as being useful only on HTTP URLs.Dan Fandrich
2008-11-17Fixed an outdated mention of having keep strings around in curl_easy_setoptDan Fandrich
calls. Added a paragraph explaining that libcurl takes care of low-level protocol details. Made a few minor edits.
2008-11-05mention the speed unit for the _SPEED_LARGE options from bug #2226722Daniel Stenberg
2008-10-28Mention more restrictions on timeouts when using signalsDan Fandrich
2008-10-28Philippe Vaucher pointed out this use of an outdated option name...Daniel Stenberg
2008-10-17remove some spurious line-endingsYang Tse
2008-10-16CURLOPT_POST301 => CURLOPT_POSTREDIRDan Fandrich
2008-10-16- Igor Novoseltsev added CURLOPT_PROXYUSER and CURLOPT_PROXYPASSWORD that thenDaniel Stenberg
make CURLOPT_PROXYUSERPWD sort of deprecated. The primary motive for adding these new options is that they have no problems with the colon separator that the CURLOPT_PROXYUSERPWD option does.
2008-10-16mention the openssl requirement for the certinfo dataDaniel Stenberg
2008-10-16correct version number for the certinfo additionDaniel Stenberg
2008-10-16Added CURLINFO_CERTINFODaniel Stenberg
2008-10-09Fixed a leftover reference to CURLOPT_FTP_SSL (thanks to Carlos AlloattiDan Fandrich
for spotting it).
2008-10-08- Igor Novoseltsev brought a patch that introduced two new options toDaniel Stenberg
curl_easy_setopt: CURLOPT_USERNAME and CURLOPT_PASSWORD that sort of deprecates the good old CURLOPT_USERPWD since they allow applications to set the user name and password independently and perhaps more importantly allow both to contain colon(s) which CURLOPT_USERPWD doesn't fully support.
2008-09-10Checked in some grammatical and minor other fixes in the documentation andDan Fandrich
examples that I found in the FreeBSD ports system.
2008-09-09Hammer home the fact that "multi interface" != "multi-threaded"Dan Fandrich
2008-09-07SOCKS5_RESOLVE_LOCAL was just never added as an option!Daniel Stenberg
2008-09-05- Introducing CURLOPT_CERTINFO and the corresponding CURLINFO_CERTINFO. ByDaniel Stenberg
enabling this feature with CURLOPT_CERTINFO for a request using SSL (HTTPS or FTPS), libcurl will gather lots of server certificate info and that info can then get extracted by a client after the request has completed with curl_easy_getinfo()'s CURLINFO_CERTINFO option. Linus Nielsen Feltzing helped me test and smoothen out this feature. Unfortunately, this feature currently only works with libcurl built to use OpenSSL. This feature was sponsored by networking4all.com - thanks!
2008-08-28Fixed a couple of typosDan Fandrich
2008-08-20Added an edited version of Vincent Le Normand's documentation of SFTP quoteDan Fandrich
commands to the man pages.
2008-08-06- mention curl_multi_socket_action() rather than the deprecatedDaniel Stenberg
curl_multi_socket() - don't claim that it has an argument named 'easy' because it doesn't!
2008-07-30- Phil Blundell added the CURLOPT_SCOPE option, as well as adjusted the URLDaniel Stenberg
parser to allow numerical IPv6-addresses to be specified with the scope given, as per RFC4007 - with a percent letter that itself needs to be URL escaped. For example, for an address of fe80::1234%1 the HTTP URL is: "http://[fe80::1234%251]/"
2008-07-23Eliminated references to TRUE and FALSE since those identifiers aren'tDan Fandrich
defined by the libcurl API. Also changed curl_easy_setopt examples to pass longs where appropriate.
2008-07-23- I went over the curl_easy_setopt man page and replaced most references toDaniel Stenberg
non-zero with the fixed value of 1. We should strive at making options support '1' for enabling them mentioned explicitly, as that then will allow us for to extend them in the future without breaking older programs.