Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Commit 24ab0f1

Browse files
committed
Fixed GH-18458: Authorization set with CURLOPT_USERPWD with NULL value.
Close GH-18460
1 parent 9c555f5 commit 24ab0f1

File tree

3 files changed

+44
-3
lines changed

3 files changed

+44
-3
lines changed

‎NEWS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? ????, PHP 8.3.22
44

5+
- Curl:
6+
. Fixed GH-18460 (curl_easy_setopt with CURLOPT_USERPWD/CURLOPT_USERNAME/
7+
CURLOPT_PASSWORD set the Authorization header when set to NULL).
8+
(David Carlier)
9+
510
- Date:
611
. Fixed bug GH-18076 (Since PHP 8, the date_sun_info() function returns
712
inaccurate sunrise and sunset times, but other calculated times are

‎ext/curl/interface.c‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1900,14 +1900,11 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
19001900
case CURLOPT_SSLKEYTYPE:
19011901
case CURLOPT_SSL_CIPHER_LIST:
19021902
case CURLOPT_USERAGENT:
1903-
case CURLOPT_USERPWD:
19041903
case CURLOPT_COOKIELIST:
19051904
case CURLOPT_FTP_ALTERNATIVE_TO_USER:
19061905
case CURLOPT_SSH_HOST_PUBLIC_KEY_MD5:
1907-
case CURLOPT_PASSWORD:
19081906
case CURLOPT_PROXYPASSWORD:
19091907
case CURLOPT_PROXYUSERNAME:
1910-
case CURLOPT_USERNAME:
19111908
case CURLOPT_NOPROXY:
19121909
case CURLOPT_SOCKS5_GSSAPI_SERVICE:
19131910
case CURLOPT_MAIL_FROM:
@@ -2021,6 +2018,12 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
20212018
case CURLOPT_HSTS:
20222019
#endif
20232020
case CURLOPT_KRBLEVEL:
2021+
// Authorization header would be implictly set
2022+
// with an empty string thus we explictly set the option
2023+
// to null to avoid this unwarranted side effect
2024+
case CURLOPT_USERPWD:
2025+
case CURLOPT_USERNAME:
2026+
case CURLOPT_PASSWORD:
20242027
{
20252028
if (Z_ISNULL_P(zvalue)) {
20262029
error = curl_easy_setopt(ch->cp, option, NULL);

‎ext/curl/tests/gh18458.phpt‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
--TEST--
2+
GH-18458 (authorization header is set despite CURLOPT_USERPWD set to null)
3+
--EXTENSIONS--
4+
curl
5+
--SKIPIF--
6+
<?php
7+
include 'skipif-nocaddy.inc';
8+
?>
9+
--FILE--
10+
<?php
11+
12+
$ch = curl_init("https://localhost/userpwd");
13+
curl_setopt($ch, CURLOPT_USERPWD, null);
14+
curl_setopt($ch, CURLOPT_VERBOSE, true);
15+
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
16+
curl_setopt($ch, CURLOPT_STDERR, fopen("php://stdout", "w"));
17+
$response = curl_exec($ch);
18+
var_dump(str_contains($response, "authorization"));
19+
20+
$ch = curl_init("https://localhost/username");
21+
curl_setopt($ch, CURLOPT_USERNAME, null);
22+
curl_setopt($ch, CURLOPT_PASSWORD, null);
23+
curl_setopt($ch, CURLOPT_VERBOSE, true);
24+
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
25+
curl_setopt($ch, CURLOPT_STDERR, fopen("php://stdout", "w"));
26+
$response = curl_exec($ch);
27+
var_dump(str_contains($response, "authorization"));
28+
?>
29+
--EXPECTF--
30+
%A
31+
bool(false)
32+
%A
33+
bool(false)

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /