moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-11-02 00:25:04 -04:00
Code Issues Releases Wiki Activity
042cc1f69e
curl/RELEASE-NOTES

71 lines
2.8 KiB
Plaintext
Raw Normal View History

start over on our journey towards 7.19.4...
2009-01-19 05:11:25 -05:00
Curl and libcurl 7.19.4
working draft of the upcoming 7.10.8 release notes
2003-09-22 17:38:52 -04:00
start over on our journey towards 7.19.4...
2009-01-19 05:11:25 -05:00
Public curl releases: 110
- Craig A West brought us: libcurl now defaults to do CONNECT with HTTP version 1.1 instead of 1.0 like before. This change also introduces the new proxy type for libcurl called 'CURLPROXY_HTTP_1_0' that then allows apps to switch (back) to CONNECT 1.0 requests. The curl tool also got a --proxy1.0 option that works exactly like --proxy but sets CURLPROXY_HTTP_1_0. I updated all test cases cases that use CONNECT and I tried to do some using --proxy1.0 and some updated to do CONNECT 1.1 to get both versions run.
2009-02-02 11:19:23 -05:00
Command line options: 132
- David Kierznowski notified us about a security flaw (http://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in which previous libcurl versions (by design) can be tricked to access an arbitrary local/different file instead of a remote one when CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release together this the addition of two new setopt options for controlling this new behavior: o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option excludes the FILE and SCP protocols and thus you nee to explicitly allow them in your app if you really want that behavior. o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch using the primary URL option. This is useful if you want to allow a user or other outsiders control what URL to pass to libcurl and yet not allow all protocols libcurl may have been built to support.
2009-03-02 18:05:31 -05:00
curl_easy_setopt() options: 163
- Introducing curl_easy_send() and curl_easy_recv(). They can be used to send and receive data over a connection previously setup with curl_easy_perform() and its CURLOPT_CONNECT_ONLY option. The sendrecv.c example was added to show how they can be used.
2008-05-12 17:43:24 -04:00
Public functions in libcurl: 58
the Eiffel binding
2009-03-02 04:03:11 -05:00
Known libcurl bindings: 38
700 friendly contributors after the new ones in 7.19.3 were added
2009-01-19 05:25:47 -05:00
Contributors: 700
David Hull made the file: URL parser also accept the somewhat sloppy file syntax: file:/path. I added test case 203 to verify this.
2003-10-29 04:53:21 -05:00
- David Kierznowski notified us about a security flaw (http://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in which previous libcurl versions (by design) can be tricked to access an arbitrary local/different file instead of a remote one when CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release together this the addition of two new setopt options for controlling this new behavior: o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option excludes the FILE and SCP protocols and thus you nee to explicitly allow them in your app if you really want that behavior. o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch using the primary URL option. This is useful if you want to allow a user or other outsiders control what URL to pass to libcurl and yet not allow all protocols libcurl may have been built to support.
2009-03-02 18:05:31 -05:00
This release includes the following security-related fix:
o CVE-2009-0037 with the curl advisory here:
http://curl.haxx.se/docs/adv_20090303.html
Armel Asselin made the CURLOPT_PREQUOTE option work fine even when CURLOPT_NOBODY is set true. PREQUOTE is then run roughly at the same place in the command sequence as it would have run if there would've been a transfer.
2006-08-08 18:56:46 -04:00
This release includes the following changes:
mention the curl_off_t changes first
2008-09-01 10:27:24 -04:00
- Craig A West brought CURLOPT_NOPROXY and the corresponding --noproxy option. They basically offer the same thing the NO_PROXY environment variable only offered previously: list a set of host names that shall not use the proxy even if one is specified.
2009-01-25 18:26:25 -05:00
o Added CURLOPT_NOPROXY and the corresponding --noproxy
wrap line at col 80
2009-01-26 09:37:29 -05:00
o the OpenSSL-specific code disables TICKET (rfc5077) which is enabled by
default in openssl 0.9.8j
- Chad Monroe provided the new CURLOPT_TFTP_BLKSIZE option that allows an app to set desired block size to use for TFTP transfers instead of the default 512 bytes.
2009-01-26 17:43:06 -05:00
o Added CURLOPT_TFTP_BLKSIZE
- Markus Moeller introduced two new options to libcurl: CURLOPT_SOCKS5_GSSAPI_SERVICE and CURLOPT_SOCKS5_GSSAPI_NEC to allow libcurl to do GSS-style authentication with SOCKS5 proxies. The curl tool got the options called --socks5-gssapi-service and --socks5-gssapi-nec to enable these.
2009-01-28 16:33:58 -05:00
o Added CURLOPT_SOCKS5_GSSAPI_SERVICE and CURLOPT_SOCKS5_GSSAPI_NEC - with
the corresponding curl options --socks5-gssapi-service and
--socks5-gssapi-nec
- When building with c-ares 1.6.1 (not yet released) or later and IPv6 support enabled, we can now take advantage of its brand new AF_UNSPEC support in ares_gethostbyname(). This makes test case 241 finally run fine for me wtih this setup since it now parses the "::1 ip6-localhost" line fine in my /etc/hosts file!
2009-01-31 15:25:55 -05:00
o Improved IPv6 support when built with with c-ares >= 1.6.1
- Craig A West brought us: libcurl now defaults to do CONNECT with HTTP version 1.1 instead of 1.0 like before. This change also introduces the new proxy type for libcurl called 'CURLPROXY_HTTP_1_0' that then allows apps to switch (back) to CONNECT 1.0 requests. The curl tool also got a --proxy1.0 option that works exactly like --proxy but sets CURLPROXY_HTTP_1_0. I updated all test cases cases that use CONNECT and I tried to do some using --proxy1.0 and some updated to do CONNECT 1.1 to get both versions run.
2009-02-02 11:19:23 -05:00
o Added CURLPROXY_HTTP_1_0 and --proxy1.0
Added docs/libcurl/symbols-in-versions
2009-02-10 08:06:25 -05:00
o Added docs/libcurl/symbols-in-versions
- CURLINFO_CONDITION_UNMET was added to allow an application to get to know if the condition in the previous request was unmet. This is typically a time condition set with CURLOPT_TIMECONDITION and was previously not possible to reliably figure out. From bug report #2565128 (http://curl.haxx.se/bug/view.cgi?id=2565128)
2009-02-11 16:47:14 -05:00
o Added CURLINFO_CONDITION_UNMET
Added support for Digest and NTLM authentication using GnuTLS.
2009-02-12 15:48:40 -05:00
o Added support for Digest and NTLM authentication using GnuTLS
- CURLOPT_FTP_CREATE_MISSING_DIRS can now be set to 2 in addition to 1 for plain FTP connections, and it will then allow MKD to fail once and retry the CWD afterwards. This is especially useful if you're doing many simultanoes connections against the same server and they all have this option enabled, as then CWD may first fail but then another connection does MKD before this connection and thus MKD fails but trying CWD works! The numbers can (should?) now be set with the convenience enums now called CURLFTP_CREATE_DIR and CURLFTP_CREATE_DIR_RETRY. Tests has proven that if you're making an application that uploads a set of files to an ftp server, you will get a noticable gain in speed if you're using multiple connections and this option will be then be very useful.
2009-02-17 04:07:25 -05:00
o CURLOPT_FTP_CREATE_MISSING_DIRS can now be set to 2 to retry the CWD even
when MKD fails
- As Daniel Fandrich figured out, we must do the GnuTLS initing in the curl_global_init() function to properly maintain the performing functions thread-safe. We've previously (28 April 2007) moved the init to a later time just to avoid it to fail very early when libgcrypt dislikes the situation, but that move was bad and the fix should rather be in libgcrypt or elsewhere.
2009-02-25 07:51:17 -05:00
o GnuTLS initing moved to curl_global_init()
- David Kierznowski notified us about a security flaw (http://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in which previous libcurl versions (by design) can be tricked to access an arbitrary local/different file instead of a remote one when CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release together this the addition of two new setopt options for controlling this new behavior: o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option excludes the FILE and SCP protocols and thus you nee to explicitly allow them in your app if you really want that behavior. o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch using the primary URL option. This is useful if you want to allow a user or other outsiders control what URL to pass to libcurl and yet not allow all protocols libcurl may have been built to support.
2009-03-02 18:05:31 -05:00
o Added CURLOPT_REDIR_PROTOCOLS and CURLOPT_PROTOCOLS
Armel Asselin made the CURLOPT_PREQUOTE option work fine even when CURLOPT_NOBODY is set true. PREQUOTE is then run roughly at the same place in the command sequence as it would have run if there would've been a transfer.
2006-08-08 18:56:46 -04:00
HTTP Digest auth fix on a re-used connection
2007-07-22 06:17:52 -04:00
This release includes the following bugfixes:
- Lisa Xu pointed out that the ssh.obj file was missing from the lib/Makefile.vc6 file (and thus from the vc8 and vc9 ones too).
2009-01-20 01:24:25 -05:00
o missing ssh.obj in VS makefiles
the FTP multi interface bug
2009-02-20 03:19:19 -05:00
o FTP ;type=i URLs now work with CURLOPT_PROXY_TRANSFER_MODE in Turkish
locale
- Alexey Borzov filed bug report #2535504 (http://curl.haxx.se/bug/view.cgi?id=2535504) pointing out that realms with quoted quotation marks in HTTP Digest headers didn't work. I've now added test case 1095 that verifies my fix.
2009-01-26 08:19:03 -05:00
o realms with quoted quotation marks in HTTP Digest headers
- Scott Cantor filed bug report #2550061 (http://curl.haxx.se/bug/view.cgi?id=2550061) mentioning that I failed to properly make sure that the VC9 makefiles got included in the latest release. I've now fixed the release script and verified it so next release will hopefully include them properly!
2009-01-31 13:38:41 -05:00
o VC9 makefiles are now really included
- Patrick Scott found a rather large memory leak when using the multi interface and setting CURLMOPT_MAXCONNECTS to something less than the number of handles you add to the multi handle. All the connections that didn't fit in the cache would not be properly disconnected nor freed!
2009-02-02 16:36:47 -05:00
o multi interface memory leak with CURLMOPT_MAXCONNECTS set
- Hidemoto Nakada provided a small fix that makes it possible to get the CURLINFO_CONTENT_LENGTH_DOWNLOAD size from file:// "transfers" with CURLOPT_NOBODY set true.
2009-02-03 17:28:41 -05:00
o CURLINFO_CONTENT_LENGTH_DOWNLOAD size from file:// "transfers" with
CURLOPT_NOBODY set true
- Andre Guibert de Bruet found and fixed a memory leak in the content encoding code, which could happen on libz errors.
2009-02-14 04:09:09 -05:00
o memory leak on some libz errors for content encodings
- Kamil Dudka made NSS-powered builds compile and run again!
2009-02-17 07:18:34 -05:00
o NSS-enabled build is repaired
- Patrik Thunstrom reported a problem and helped me repeat it. It turned out libcurl did a superfluous 1000ms wait when doing SFTP downloads! We read data with libssh2 while doing the "DO" operation for SFTP and then when we were about to start getting data for the actual file part, the "TRANSFER" part, we waited for socket action (in 1000ms) before doing a libssh2-read. But in this case libssh2 had already read and buffered the data so we ended up always just waiting 1000ms before we get working on the data!
2009-02-19 05:36:20 -05:00
o superfluous wait in SFTP downloads removed
the FTP multi interface bug
2009-02-20 03:19:19 -05:00
o FTP with the multi interface no longer kills the control connection as
easily on transfer failures
Mark Incley noticed VS2008 compilation halting when building for Windows 2000
2009-02-20 07:10:23 -05:00
o compilation halting when using VS2008 to build a Windows 2000 target
Daniel Johnson provided a shell script that will perform all the steps needed to build a Mac OS X fat ppc/i386 or ppc64/x86_64 libcurl.framework
2009-02-23 07:39:06 -05:00
o ease creation of libcurl Mac OS X Framework
- After a bug reported by James Cheng I've made curl_easy_getinfo() for CURLINFO_CONTENT_LENGTH_DOWNLOAD and CURLINFO_CONTENT_LENGTH_UPLOAD return -1 if the sizes aren't know. Previously these returned 0, make it impossible to detect the difference between actually zero and unknown.
2009-02-23 13:45:00 -05:00
o CURLINFO_CONTENT_LENGTH_DOWNLOAD and CURLINFO_CONTENT_LENGTH_UPLOAD are -1
if unknown
- Brian J. Murrell found out that Negotiate proxy authentication didn't work. It happened because the code used the struct for server-based auth all the time for both proxy and server auth which of course was wrong.
2009-02-24 03:30:09 -05:00
o Negotiate proxy authentication
- Senthil Raja Velu reported a problem when CURLOPT_INTERFACE and CURLOPT_LOCALPORT were used together (the local port bind failed), and Markus Koetter provided the fix!
2009-02-27 07:07:14 -05:00
o CURLOPT_INTERFACE and CURLOPT_LOCALPORT used together
HTTP Digest auth fix on a re-used connection
2007-07-22 06:17:52 -04:00
This release includes the following known bugs:
o see docs/KNOWN_BUGS (http://curl.haxx.se/docs/knownbugs.html)
This release would not have looked like this without help, code, reports and
advice from friends like these:
- The "-no_ticket" option was introduced in Openssl0.9.8j. It's a flag to disable "rfc4507bis session ticket support". rfc4507bis was later turned into the proper RFC5077 it seems: http://tools.ietf.org/html/rfc5077 The enabled extension concerns the session management. I wonder how often libcurl stops a connection and then resumes a TLS session. also, sending the session data is some overhead. .I suggest that you just use your proposed patch (which explicitly disables TICKET). If someone writes an application with libcurl and openssl who wants to enable the feature, one can do this in the SSL callback. Sharad Gupta brought this to my attention. Peter Sylvester helped me decide on the proper action.
2009-01-26 09:36:18 -05:00
Lisa Xu, Daniel Fandrich, Craig A West, Alexey Borzov, Sharad Gupta,
- Patrick Scott found a rather large memory leak when using the multi interface and setting CURLMOPT_MAXCONNECTS to something less than the number of handles you add to the multi handle. All the connections that didn't fit in the cache would not be properly disconnected nor freed!
2009-02-02 16:36:47 -05:00
Peter Sylvester, Chad Monroe, Markus Moeller, Yang Tse, Scott Cantor,
- Kamil Dudka made NSS-powered builds compile and run again!
2009-02-17 07:18:34 -05:00
Patrick Scott, Hidemoto Nakada, Jocelyn Jaubert, Andre Guibert de Bruet,
Daniel Johnson provided a shell script that will perform all the steps needed to build a Mac OS X fat ppc/i386 or ppc64/x86_64 libcurl.framework
2009-02-23 07:39:06 -05:00
Kamil Dudka, Patrik Thunstrom, Linus Nielsen Feltzing, Mark Incley,
- Senthil Raja Velu reported a problem when CURLOPT_INTERFACE and CURLOPT_LOCALPORT were used together (the local port bind failed), and Markus Koetter provided the fix!
2009-02-27 07:07:14 -05:00
Daniel Johnson, James Cheng, Brian J. Murrell, Senthil Raja Velu,
- David Kierznowski notified us about a security flaw (http://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in which previous libcurl versions (by design) can be tricked to access an arbitrary local/different file instead of a remote one when CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release together this the addition of two new setopt options for controlling this new behavior: o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option excludes the FILE and SCP protocols and thus you nee to explicitly allow them in your app if you really want that behavior. o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch using the primary URL option. This is useful if you want to allow a user or other outsiders control what URL to pass to libcurl and yet not allow all protocols libcurl may have been built to support.
2009-03-02 18:05:31 -05:00
Markus Koetter, David Kierznowski, Michal Marek
start over on 7.18.1
2008-01-28 16:19:15 -05:00
working draft of the upcoming 7.10.8 release notes
2003-09-22 17:38:52 -04:00
Thanks! (and sorry if I forgot to mention someone)
Reference in New Issue Copy Permalink