archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Revert "Fixed GH-18458: Authorization set with CURLOPT_USERPWD with NULL value."

Browse source 
This reverts commit bb431f124c.
This commit is contained in:
David Carlier 2025-04-29 22:48:16 +01:00
parent bb431f124c
commit d9d58c9d79
No known key found for this signature in database
GPG key ID: 8486F847B4B94EF1
2 changed files with 1 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

18
ext/curl/interface.c
View file

@ -1900,6 +1900,7 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
case CURLOPT_SSLKEYTYPE: case CURLOPT_SSLKEYTYPE:
case CURLOPT_SSL_CIPHER_LIST: case CURLOPT_SSL_CIPHER_LIST:
case CURLOPT_USERAGENT: case CURLOPT_USERAGENT:
case CURLOPT_USERPWD:
case CURLOPT_COOKIELIST: case CURLOPT_COOKIELIST:
case CURLOPT_FTP_ALTERNATIVE_TO_USER: case CURLOPT_FTP_ALTERNATIVE_TO_USER:
case CURLOPT_SSH_HOST_PUBLIC_KEY_MD5: case CURLOPT_SSH_HOST_PUBLIC_KEY_MD5:
@ -1997,23 +1998,6 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
return ret; return ret;
} }
case CURLOPT_USERPWD:
{
if (Z_ISNULL_P(zvalue)) {
// Authorization header would be implictly set
// with an empty string thus we explictly set the option
// to null to avoid this unwarranted side effect
error = curl_easy_setopt(ch->cp, option, NULL);
} else {
zend_string *tmp_str;
zend_string *str = zval_get_tmp_string(zvalue, &tmp_str);
zend_result ret = php_curl_option_str(ch, option, ZSTR_VAL(str), ZSTR_LEN(str));
zend_tmp_string_release(tmp_str);
return ret;
}
break;
}
/* Curl nullable string options */ /* Curl nullable string options */
case CURLOPT_CUSTOMREQUEST: case CURLOPT_CUSTOMREQUEST:
case CURLOPT_FTPPORT: case CURLOPT_FTPPORT:

20
ext/curl/tests/gh18458.phpt
View file

@ -1,20 +0,0 @@
--TEST--
GH-18458 authorization header is set despite CURLOPT_USERPWD set to null
--EXTENSIONS--
curl
--SKIPIF--
<?php
include 'skipif-nocaddy.inc';
?>
--FILE--
<?php
$ch = curl_init("https://localhost/userpwd");
curl_setopt($ch, CURLOPT_USERPWD, null);
curl_setopt($ch, CURLOPT_VERBOSE, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);
var_dump(str_contains($response, "authorization"));
?>
--EXPECT--
bool(false)