From b740a1ecc6be64a35e5b83c1185a518d607765d7 Mon Sep 17 00:00:00 2001 From: Kamil Dudka Date: Thu, 6 Aug 2020 11:04:30 +0200 Subject: [PATCH] setopt: unset NOBODY switches to GET if still HEAD MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported-by: Vít Ondruch --- 0002-curl-7.71.1-unset-nobody.patch | 108 ++++++++++++++++++++++++++++ curl.spec | 9 ++- 2 files changed, 116 insertions(+), 1 deletion(-) create mode 100644 0002-curl-7.71.1-unset-nobody.patch diff --git a/0002-curl-7.71.1-unset-nobody.patch b/0002-curl-7.71.1-unset-nobody.patch new file mode 100644 index 0000000..8487132 --- /dev/null +++ b/0002-curl-7.71.1-unset-nobody.patch @@ -0,0 +1,108 @@ +From 750188fc8eb239f51255d6f3510f544377e78ecd Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 27 Jul 2020 11:44:01 +0200 +Subject: [PATCH 1/2] setopt: unset NOBODY switches to GET if still HEAD + +Unsetting CURLOPT_NOBODY with 0L when doing HTTP has no documented +action but before 7.71.0 that used to switch back to GET and with this +change (assuming the method is still set to HEAD) this behavior is +brought back. + +Reported-by: causal-agent on github +Fixes #5725 +Closes #5728 + +Upstream-commit: 91cb16b21faa556d4467399781379ad3abafd3fe +Signed-off-by: Kamil Dudka +--- + lib/setopt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/setopt.c b/lib/setopt.c +index 90edf6a..d621335 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -274,6 +274,8 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param) + if(data->set.opt_no_body) + /* in HTTP lingo, no body means using the HEAD request... */ + data->set.method = HTTPREQ_HEAD; ++ else if(data->set.method == HTTPREQ_HEAD) ++ data->set.method = HTTPREQ_GET; + break; + case CURLOPT_FAILONERROR: + /* +-- +2.25.4 + + +From 44add6f66c7ddec9f002fb52ce8e893a8ca9165d Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 27 Jul 2020 11:54:29 +0200 +Subject: [PATCH 2/2] CURLOPT_NOBODY.3: clarify what setting to 0 means + +... and mention that HTTP with other methods than HEAD might get a body and +there's no option available to stop that. + +Closes #5729 + +Upstream-commit: e1bac81cc815f3fe968e009eb69b8e0236dcd82c +Signed-off-by: Kamil Dudka +--- + docs/libcurl/opts/CURLOPT_NOBODY.3 | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +diff --git a/docs/libcurl/opts/CURLOPT_NOBODY.3 b/docs/libcurl/opts/CURLOPT_NOBODY.3 +index f720f49..3674dde 100644 +--- a/docs/libcurl/opts/CURLOPT_NOBODY.3 ++++ b/docs/libcurl/opts/CURLOPT_NOBODY.3 +@@ -5,7 +5,7 @@ + .\" * | (__| |_| | _ <| |___ + .\" * \___|\___/|_| \_\_____| + .\" * +-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, , et al. ++.\" * Copyright (C) 1998 - 2020, Daniel Stenberg, , et al. + .\" * + .\" * This software is licensed as described in the file COPYING, which + .\" * you should have received as part of this distribution. The terms +@@ -34,7 +34,17 @@ output when doing what would otherwise be a download. For HTTP(S), this makes + libcurl do a HEAD request. For most other protocols it means just not asking + to transfer the body data. + +-Enabling this option means asking for a download but without a body. ++For HTTP operations when \fBCURLOPT_NOBODY(3)\fP has been set, unsetting the ++option (with 0) will make it a GET again - only if the method is still set to ++be HEAD. The proper way to get back to a GET request is to set ++\fBCURLOPT_HTTPGET(3)\fP and for other methods, use the POST ur UPLOAD ++options. ++ ++Enabling \fBCURLOPT_NOBODY(3)\fP means asking for a download without a body. ++ ++If you do a transfer with HTTP that involves a method other than HEAD, you ++will get a body (unless the resource and server sends a zero byte body for the ++specific URL you request). + .SH DEFAULT + 0, the body is transferred + .SH PROTOCOLS +@@ -43,9 +53,9 @@ Most + .nf + curl = curl_easy_init(); + if(curl) { +- curl_easy_setopt(curl, CURLOPT_URL, "http://example.com"); ++ curl_easy_setopt(curl, CURLOPT_URL, "https://example.com"); + +- /* get us the resource without a body! */ ++ /* get us the resource without a body - use HEAD! */ + curl_easy_setopt(curl, CURLOPT_NOBODY, 1L); + + /* Perform the request */ +@@ -57,5 +67,5 @@ Always + .SH RETURN VALUE + Returns CURLE_OK + .SH "SEE ALSO" +-.BR CURLOPT_HTTPGET "(3), " CURLOPT_POST "(3), " +-.BR CURLOPT_REQUEST_TARGET "(3), " ++.BR CURLOPT_HTTPGET "(3), " CURLOPT_POSTFIELDS "(3), " CURLOPT_UPLOAD "(3), " ++.BR CURLOPT_REQUEST_TARGET "(3), " CURLOPT_MIMEPOST "(3), " +-- +2.25.4 + diff --git a/curl.spec b/curl.spec index 9706b9f..dcde2a2 100644 --- a/curl.spec +++ b/curl.spec @@ -1,13 +1,16 @@ Summary: A utility for getting files from remote servers (FTP, HTTP, and others) Name: curl Version: 7.71.1 -Release: 4%{?dist} +Release: 5%{?dist} License: MIT Source: https://curl.haxx.se/download/%{name}-%{version}.tar.xz # curl: make the --krb option work again (#1833193) Patch1: 0001-curl-7.71.1-tool-krb-opt.patch +# setopt: unset NOBODY switches to GET if still HEAD +Patch2: 0002-curl-7.71.1-unset-nobody.patch + # patch making libcurl multilib ready Patch101: 0101-curl-7.32.0-multilib.patch @@ -176,6 +179,7 @@ be installed. # upstream patches %patch1 -p1 +%patch2 -p1 # Fedora patches %patch101 -p1 @@ -354,6 +358,9 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal %changelog +* Thu Aug 06 2020 Kamil Dudka - 7.71.1-5 +- setopt: unset NOBODY switches to GET if still HEAD + * Mon Jul 27 2020 Fedora Release Engineering - 7.71.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild