From d7b970e46ba29a7e558e21d19f485977ffed6266 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Fri, 29 Apr 2022 22:56:47 +0200 Subject: [PATCH] http: move Curl_allow_auth_to_host() It was mistakenly put within the CURL_DISABLE_HTTP_AUTH #ifdef Reported-by: Michael Olbrich Fixes #8772 Closes #8775 Upstream-Status: Backport [https://github.com/curl/curl/commit/d7b970e46ba29a7e558e21d19f485977ffed6266] CVE: CVE-2026-3783 #Dependency Patch Signed-off-by: Vijay Anusuri --- lib/http.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/lib/http.c b/lib/http.c index 0d5c449bc72a..b215307dcaaa 100644 --- a/lib/http.c +++ b/lib/http.c @@ -651,6 +651,21 @@ CURLcode Curl_http_auth_act(struct Curl_easy *data) return result; } +/* + * Curl_allow_auth_to_host() tells if authentication, cookies or other + * "sensitive data" can (still) be sent to this host. + */ +bool Curl_allow_auth_to_host(struct Curl_easy *data) +{ + struct connectdata *conn = data->conn; + return (!data->state.this_is_a_follow || + data->set.allow_auth_to_other_hosts || + (data->state.first_host && + strcasecompare(data->state.first_host, conn->host.name) && + (data->state.first_remote_port == conn->remote_port) && + (data->state.first_remote_protocol == conn->handler->protocol))); +} + #ifndef CURL_DISABLE_HTTP_AUTH /* * Output the correct authentication header depending on the auth type @@ -775,21 +790,6 @@ output_auth_headers(struct Curl_easy *data, return CURLE_OK; } -/* - * Curl_allow_auth_to_host() tells if authentication, cookies or other - * "sensitive data" can (still) be sent to this host. - */ -bool Curl_allow_auth_to_host(struct Curl_easy *data) -{ - struct connectdata *conn = data->conn; - return (!data->state.this_is_a_follow || - data->set.allow_auth_to_other_hosts || - (data->state.first_host && - strcasecompare(data->state.first_host, conn->host.name) && - (data->state.first_remote_port == conn->remote_port) && - (data->state.first_remote_protocol == conn->handler->protocol))); -} - /** * Curl_http_output_auth() setups the authentication headers for the * host/proxy and the correct authentication