aboutsummaryrefslogtreecommitdiff
path: root/lib/imap.c
AgeCommit message (Collapse)Author
2012-01-24URL sanitize: reject URLs containing bad dataDaniel Stenberg
Protocols (IMAP, POP3 and SMTP) that use the path part of a URL in a decoded manner now use the new Curl_urldecode() function to reject URLs with embedded control codes (anything that is or decodes to a byte value less than 32). URLs containing such codes could easily otherwise be used to do harm and allow users to do unintended actions with otherwise innocent tools and applications. Like for example using a URL like pop3://pop3.example.com/1%0d%0aDELE%201 when the app wants a URL to get a mail and instead this would delete one. This flaw is considered a security vulnerability: CVE-2012-0036 Security advisory at: http://curl.haxx.se/docs/adv_20120124.html Reported by: Dan Fandrich
2012-01-04Fixed use of CURLUSESSL_TRY for POP3 and IMAP based connections.Steve Holme
Fixed a problem in POP3 and IMAP where a connection would fail when CURLUSESSL_TRY was specified for a server that didn't support SSL/TLS connections rather than continuing.
2012-01-04Fixed incorrect error code being returned in STARTTLSSteve Holme
The STARTTLS response code in SMTP, POP3 and IMAP would return CURLE_LOGIN_DENIED rather than CURLE_USE_SSL_FAILED when SSL/TLS was not available on the server. Reported by: Gokhan Sengun Bug: http://curl.haxx.se/mail/lib-2012-01/0018.html
2011-11-24query-part: ignore the URI part for given protocolsJonas Schnelli
By setting PROTOPT_NOURLQUERY in the protocol handler struct, the protocol will get the "query part" of the URL cut off before the data is handled by the protocol-specific code. This makes libcurl adhere to RFC3986 section 2.2. Test 1220 is added to verify a file:// URL with query-part.
2011-11-03rename ftp_ssl: the struct field is used for many protocolsDaniel Stenberg
Now called 'use_ssl' instead, which better matches the current CURLOPT name and since the option is used for all pingpong protocols (at least) it makes sense to not use 'ftp' in the name.
2011-10-21curl_multi_fdset: correct fdset with FTP PORT useDaniel Stenberg
After a PORT has been issued, and the multi handle would switch to the CURLM_STATE_DO_MORE state (which is unique for FTP), libcurl would return the wrong fdset to wait for when curl_multi_fdset() is called. The code would blindly assume that it was waiting for a connect of the second connection, while that isn't true immediately after the PORT command. Also, the function multi.c:domore_getsock() was highly FTP-centric and therefore ugly to keep in protocol-agnostic code. I solved this problem by introducing a new function pointer in the Curl_handler struct called domore_getsock() which is only called during the DOMORE state for protocols that set that pointer. The new ftp.c:ftp_domore_getsock() function now returns fdset info about the control connection's command/response handling while such a state is in use, and goes over to waiting for a writable second connection first once the commands are done. The original problem could be seen by running test 525 and checking the time stamps in the FTP server log. I can verify that this fix at least fixes this problem. Bug: http://curl.haxx.se/mail/lib-2011-10/0250.html Reported by: Gokhan Sengun
2011-09-05fix bool variables checking and assignmentYang Tse
2011-09-03fix a bunch of MSVC compiler warningsYang Tse
2011-08-29pingpong.c: fix Curl_pp_vsendf() arbitrary restrictions on command lengthYang Tse
This removes command length restrictions on calling functions.
2011-08-19tcpconnect: follow-up commit after b998d95bDaniel Stenberg
As I modified conn->bits.tcpconnect to become an array that holds one bool for each potential connection all uses of that struct field must index it correctly.
2011-07-26stdio.h, stdlib.h, string.h, stdarg.h and ctype.h inclusion done in setup_once.hYang Tse
2011-05-05set_userpass: convert from protocol-specific to genericDaniel Stenberg
The protocol handler's flags field now can set that the protocol requires a password, so that the set_userpass function doesn't have to have the specific knowledge of which protocols that do.
2011-05-05RTSP: convert protocol-specific checks to genericDaniel Stenberg
Add a 'readwrite' function to the protocol handler struct and use that for the extra readwrite functionality RTSP needs.
2011-05-05SSL: check for SSL, not specific protocolsDaniel Stenberg
Code cleanup to check less for protocols and more for the specific relevant feature. Like if SSL is required.
2011-04-27source cleanup: unify look, style and indent levelsDaniel Stenberg
By the use of a the new lib/checksrc.pl script that checks that our basic source style rules are followed.
2011-04-21Fix a couple of spelling errors in lib/Fabian Keil
Found with codespell.
2011-04-20CURL_DOES_CONVERSIONS: cleanupDaniel Stenberg
Massively reduce #ifdefs all over (23 #ifdef lines less so far) Moved conversion-specific code to non-ascii.c
2011-04-04http-proxy: move proxy code to http_proxy.cDaniel Stenberg
The new http_proxy.* files now host HTTP proxy specific code (500+ lines moved out from http.c), and as a consequence there is a macro introduced for the Curl_proxyCONNECT() function so that code can use it without actually supporting proxy (or HTTP) in builds.
2011-03-15protocol handler cleanup: SSL awarenessDaniel Stenberg
As a follow-up to commit 8831000bc0: don't assume that the SSL powered protocol alternatives are available.
2011-03-14protocols: use CURLPROTO_ internallyDaniel Stenberg
The PROT_* set of internal defines for the protocols is no longer used. We now use the same bits internally as we have defined in the public header using the CURLPROTO_ prefix. This is for simplicity and because the PROT_* prefix was already used duplicated internally for a set of KRB4 values. The PROTOPT_* defines were moved up to just below the struct definition within which they are used.
2011-03-14protocol handler: added flags fieldDaniel Stenberg
The protocol handler struct got a 'flags' field for special information and characteristics of the given protocol. This now enables us to move away central protocol information such as CLOSEACTION and DUALCHANNEL from single defines in a central place, out to each protocol's definition. It also made us stop abusing the protocol field for other info than the protocol, and we could start cleaning up other protocol-specific things by adding flags bits to set in the handler struct. The "protocol" field connectdata struct was removed as well and the code now refers directly to the conn->handler->protocol field instead. To make things work properly, the code now always store a conn->given pointer that points out the original handler struct so that the code can learn details from the original protocol even if conn->handler is modified along the way - for example when switching to go over a HTTP proxy.
2011-03-13state: add missing state to debug tableDaniel Stenberg
As a new state recently was added to the IMAP state machine it has to be in the array of names as well as otherwise libcurl crashes when a debug version runs...
2011-02-20IMAP in multi mode: use Curl_ssl_connect_nonblocking() when upgrading the ↵Ben Noordhuis
connection to TLS/SSL.
2011-02-20IMAP in multi mode: use Curl_ssl_connect_nonblocking() when connecting.Ben Noordhuis
2011-02-07imap: Fixed typo in a comment.Julien Chaffraix
2010-12-06url: provide dead_connection flag in Curl_handler::disconnectKamil Dudka
It helps to prevent a hangup with some FTP servers in case idle session timeout has exceeded. But it may be useful also for other protocols that send any quit message on disconnect. Currently used by FTP, POP3, IMAP and SMTP.
2010-04-16Curl_setup_transfer: no longer returns anythingDaniel Stenberg
This function could only return CURLE_OK and by changing it to a void instead, we can simplify code all over.
2010-04-12added a cast to silent compiler warning with 64bit systems.Guenter Knauf
2010-03-24remove the CVSish $Id$ linesDaniel Stenberg
2010-02-26Fixed a couple of out of memory leaks and a segfault in the IMAP code.Dan Fandrich
2010-01-25make Curl_handler_*_proxy definition staticYang Tse
2009-12-30VMS specific preprocessor symbol checking adjustmentsYang Tse
2009-12-20free the allocated mailbox name at disconnectDaniel Stenberg
2009-12-14Fix compiler warningYang Tse
2009-12-12introducing IMAP, POP3 and SMTP support (still lots of polish left to do)Daniel Stenberg