curl/RELEASE-NOTES

Curl and libcurl 7.19.5

 Public curl releases:         111
 Command line options:         132
 curl_easy_setopt() options:   163
 Public functions in libcurl:  58
 Known libcurl bindings:       38
 Contributors:                 715

This release includes the following changes:

 o libcurl now closes all dead connections whenever you attempt to open a new
   connection
 o libssh2's version number can now be figured out run-time instead of using
   the build-time fixed number

This release includes the following bugfixes:

 o NTLM authentication memory leak on SSPI enabled Windows builds
 o fixed the GnuTLS-using code to do correct return code checks
 o an alloc-related call in the OpenSSL-using code didn't check the return value
 o curl_easy_duphandle() failed to duplicate cookies at times
 o missing TELNET timeout support in Windows builds
 o missing Curl_read() and write callback result checking in TELNET transfers
 o more ciphers enabled in libcurl built to use NSS
 o properly return an error code in curl_easy_recv
 o Sun compilers specific preprocessor block removed from curlbuild.h.dist
 o allow creation of four way fat libcurl Mac OS X Framework
 o several memory leaks in libcurl+NSS
 o improved the CURLOPT_NOBODY set to 0 confusions
 o persistent connections when doing FTP over a HTTP proxy
 o --libcurl bogus strings where other data was pointed to
 o crash related to FTP and "Re-used connection seems dead, get a new one"
 o CURLINFO_APPCONNECT_TIME with the multi interface

This release includes the following known bugs:

 o see docs/KNOWN_BUGS (http://curl.haxx.se/docs/knownbugs.html)

This release would not have looked like this without help, code, reports and
advice from friends like these:

 Daniel Fandrich, Yang Tse, David James, Chris Deidun, Bill Egert,
 Andre Guibert de Bruet, Andreas Farber, Frank Hempel, Pierre Brico,
 Kamil Dudka, Jim Freeman, Daniel Johnson, Toshio Kuratomi, Martin Storsjo,
 Pramod Sharma, Gisle Vanem, Leanic Lefever, Rainer Koenig, Sven Wegener

        Thanks! (and sorry if I forgot to mention someone)
start over on the journey towards 7.19.5 2009-03-03 07:44:42 +08:00			`Curl and libcurl 7.19.5`
working draft of the upcoming 7.10.8 release notes 2003-09-23 05:38:52 +08:00
start over on the journey towards 7.19.5 2009-03-03 07:44:42 +08:00			`Public curl releases: 111`
- Craig A West brought us: libcurl now defaults to do CONNECT with HTTP version 1.1 instead of 1.0 like before. This change also introduces the new proxy type for libcurl called 'CURLPROXY_HTTP_1_0' that then allows apps to switch (back) to CONNECT 1.0 requests. The curl tool also got a --proxy1.0 option that works exactly like --proxy but sets CURLPROXY_HTTP_1_0. I updated all test cases cases that use CONNECT and I tried to do some using --proxy1.0 and some updated to do CONNECT 1.1 to get both versions run. 2009-02-03 00:19:23 +08:00			`Command line options: 132`
- David Kierznowski notified us about a security flaw (http://curl.haxx.se/docs/adv_20090303.html also known as CVE-2009-0037) in which previous libcurl versions (by design) can be tricked to access an arbitrary local/different file instead of a remote one when CURLOPT_FOLLOWLOCATION is enabled. This flaw is now fixed in this release together this the addition of two new setopt options for controlling this new behavior: o CURLOPT_REDIR_PROTOCOLS controls what protocols libcurl is allowed to follow to when CURLOPT_FOLLOWLOCATION is enabled. By default, this option excludes the FILE and SCP protocols and thus you nee to explicitly allow them in your app if you really want that behavior. o CURLOPT_PROTOCOLS controls what protocol(s) libcurl is allowed to fetch using the primary URL option. This is useful if you want to allow a user or other outsiders control what URL to pass to libcurl and yet not allow all protocols libcurl may have been built to support. 2009-03-03 07:05:31 +08:00			`curl_easy_setopt() options: 163`
- Introducing curl_easy_send() and curl_easy_recv(). They can be used to send and receive data over a connection previously setup with curl_easy_perform() and its CURLOPT_CONNECT_ONLY option. The sendrecv.c example was added to show how they can be used. 2008-05-13 05:43:24 +08:00			`Public functions in libcurl: 58`
the Eiffel binding 2009-03-02 17:03:11 +08:00			`Known libcurl bindings: 38`
15 additional contributor from the 7.19.4 RELEASE-NOTES 2009-03-03 18:41:11 +08:00			`Contributors: 715`
David Hull made the file: URL parser also accept the somewhat sloppy file syntax: file:/path. I added test case 203 to verify this. 2003-10-29 17:53:21 +08:00
Armel Asselin made the CURLOPT_PREQUOTE option work fine even when CURLOPT_NOBODY is set true. PREQUOTE is then run roughly at the same place in the command sequence as it would have run if there would've been a transfer. 2006-08-09 06:56:46 +08:00			`This release includes the following changes:`
mention the curl_off_t changes first 2008-09-01 22:27:24 +08:00
- David James brought a patch that make libcurl close (all) dead connections whenever you attempt to open a new connection. 2009-03-03 19:01:24 +08:00			`o libcurl now closes all dead connections whenever you attempt to open a new`
			`connection`
- Use libssh2_version() to present the libssh2 version in case the libssh2 library is found to support it. 2009-03-13 17:58:15 +08:00			`o libssh2's version number can now be figured out run-time instead of using`
			`the build-time fixed number`
Armel Asselin made the CURLOPT_PREQUOTE option work fine even when CURLOPT_NOBODY is set true. PREQUOTE is then run roughly at the same place in the command sequence as it would have run if there would've been a transfer. 2006-08-09 06:56:46 +08:00
HTTP Digest auth fix on a re-used connection 2007-07-22 18:17:52 +08:00			`This release includes the following bugfixes:`

Fix NTLM authentication memory leak on SSPI enabled Windows builds 2009-03-05 09:23:14 +08:00			`o NTLM authentication memory leak on SSPI enabled Windows builds`
- Andre Guibert de Bruet fixed the gnutls-using code: There are a few places in the gnutls code where we were checking for negative values for errors, when the man pages state that GNUTLS_E_SUCCESS is returned on success and other values indicate error conditions. 2009-03-09 06:52:05 +08:00			`o fixed the GnuTLS-using code to do correct return code checks`
- Andre Guibert de Bruet found and fixed a code segment in ssluse.c where the allocation of the memory BIO was not being properly checked. 2009-03-09 06:56:55 +08:00			`o an alloc-related call in the OpenSSL-using code didn't check the return value`
- Frank Hempel found out a bug and provided the fix: curl_easy_duphandle did not necessarily duplicate the CURLOPT_COOKIEFILE option. It only enabled the cookie engine in the destination handle if data->cookies is not NULL (where data is the source handle). In case of a newly initialized handle which just had the cookie support enabled by a curl_easy_setopt(handle, CURL_COOKIEFILE, "")-call, handle->cookies was still NULL because the setopt-call only appends the value to data->change.cookielist, hence duplicating this handle would not have the cookie engine switched on. We also concluded that the slist-functionality would be suitable for being put in its own module rather than simply hanging out in lib/sendf.c so I created lib/slist.[ch] for them. 2009-03-09 20:21:46 +08:00			`o curl_easy_duphandle() failed to duplicate cookies at times`
Added TELNET timeout support for Windows builds 2009-03-11 12:15:33 +08:00			`o missing TELNET timeout support in Windows builds`
Fix TELNET transfers not being aborted upon write callback failures 2009-03-12 21:18:25 +08:00			`o missing Curl_read() and write callback result checking in TELNET transfers`
- Kamil Dudka brought a patch that enables 6 additional crypto algorithms when NSS is used. These ciphers were added in NSS 3.4 and require to be enabled explicitly. 2009-03-18 20:48:51 +08:00			`o more ciphers enabled in libcurl built to use NSS`
Added the curl_easy_recv return code fix 2009-04-02 12:41:03 +08:00			`o properly return an error code in curl_easy_recv`
Sun compilers specific preprocessor block removed from curlbuild.h.dist 2009-04-08 09:25:34 +08:00			`o Sun compilers specific preprocessor block removed from curlbuild.h.dist`
Daniel Johnson improved the MacOSX-Framework shell script to now perform all the steps required to build a Mac OS X four way fat ppc/i386/ppc64/x86_64 libcurl.framework. Four way fat framework requires OS X 10.5 SDK or later. 2009-04-10 10:50:21 +08:00			`o allow creation of four way fat libcurl Mac OS X Framework`
- Kamil Dudka fixed another NSS-related leak when client certs were used. 2009-04-25 05:55:18 +08:00			`o several memory leaks in libcurl+NSS`
- bug report #2727981 (http://curl.haxx.se/bug/view.cgi?id=2727981) by Martin Storsjo pointed out how setting CURLOPT_NOBODY to 0 could be downright confusing as it set the method to either GET or HEAD. The example he showed looked like: curl_easy_setopt(curl, CURLOPT_PUT, 1); curl_easy_setopt(curl, CURLOPT_NOBODY, 0); The new way doesn't alter the method until the request is about to start. If CURLOPT_NOBODY is then 1 the HTTP request will be HEAD. If CURLOPT_NOBODY is 0 and the request happens to have been set to HEAD, it will then instead be set to GET. I believe this will be less surprising to users, and hopefully not hit any existing users badly. 2009-04-14 02:01:02 +08:00			`o improved the CURLOPT_NOBODY set to 0 confusions`
mention Pramod Sharma and "persistent connections when doing FTP over a HTTP proxy" 2009-04-18 06:36:13 +08:00			`o persistent connections when doing FTP over a HTTP proxy`
- Gisle Vanem noticed that --libtool would produce bogus strings at times for OBJECTPOINT options. Now we've introduced a new function - my_setopt_str - within the app for setting plain string options to avoid the risk of this mistake happening. 2009-04-21 01:53:06 +08:00			`o --libcurl bogus strings where other data was pointed to`
- Leanic Lefever reported a crash and did some detailed research on why and how it occurs (http://curl.haxx.se/mail/lib-2009-04/0289.html). The conclusion was that if an error is detected and Curl_done() is called for the connection, ftp_done() could at times return another error code that then would take precedence and that new code confused existing logic that works for the first error code (CURLE_SEND_ERROR) only. 2009-04-21 05:41:17 +08:00			`o crash related to FTP and "Re-used connection seems dead, get a new one"`
- Bug report #2779733 (http://curl.haxx.se/bug/view.cgi?id=2779733) by Sven Wegener pointed out that CURLINFO_APPCONNECT_TIME didn't work with the multi interface and provided a patch that fixed the problem! 2009-04-26 19:56:22 +08:00			`o CURLINFO_APPCONNECT_TIME with the multi interface`
HTTP Digest auth fix on a re-used connection 2007-07-22 18:17:52 +08:00
			`This release includes the following known bugs:`

			`o see docs/KNOWN_BUGS (http://curl.haxx.se/docs/knownbugs.html)`

			`This release would not have looked like this without help, code, reports and`
			`advice from friends like these:`

- Andre Guibert de Bruet fixed the gnutls-using code: There are a few places in the gnutls code where we were checking for negative values for errors, when the man pages state that GNUTLS_E_SUCCESS is returned on success and other values indicate error conditions. 2009-03-09 06:52:05 +08:00			`Daniel Fandrich, Yang Tse, David James, Chris Deidun, Bill Egert,`
- Kamil Dudka brought a patch that enables 6 additional crypto algorithms when NSS is used. These ciphers were added in NSS 3.4 and require to be enabled explicitly. 2009-03-18 20:48:51 +08:00			`Andre Guibert de Bruet, Andreas Farber, Frank Hempel, Pierre Brico,`
- Leanic Lefever reported a crash and did some detailed research on why and how it occurs (http://curl.haxx.se/mail/lib-2009-04/0289.html). The conclusion was that if an error is detected and Curl_done() is called for the connection, ftp_done() could at times return another error code that then would take precedence and that new code confused existing logic that works for the first error code (CURLE_SEND_ERROR) only. 2009-04-21 05:41:17 +08:00			`Kamil Dudka, Jim Freeman, Daniel Johnson, Toshio Kuratomi, Martin Storsjo,`
- Bug report #2779733 (http://curl.haxx.se/bug/view.cgi?id=2779733) by Sven Wegener pointed out that CURLINFO_APPCONNECT_TIME didn't work with the multi interface and provided a patch that fixed the problem! 2009-04-26 19:56:22 +08:00			`Pramod Sharma, Gisle Vanem, Leanic Lefever, Rainer Koenig, Sven Wegener`
start over on 7.18.1 2008-01-29 05:19:15 +08:00
working draft of the upcoming 7.10.8 release notes 2003-09-23 05:38:52 +08:00			`Thanks! (and sorry if I forgot to mention someone)`