MDL-81774 curl: Strip auth headers when redirecting to different host

2024-06-05 02:03:17 +00:00
parent 5bf91592cd
commit 3e38c84315
1 changed files with 7 additions and 0 deletions
@@ -3847,6 +3847,7 @@ class curl {

                $redirects++;

+                $currenturl = $redirecturl ?? $url;
                $redirecturl = null;
                if (isset($this->info['redirect_url'])) {
                    if (preg_match('|^https?://|i', $this->info['redirect_url'])) {
@@ -3904,6 +3905,12 @@ class curl {
                }

                curl_setopt($curl, CURLOPT_URL, $redirecturl);
+
+                if (parse_url($currenturl)['host'] !== parse_url($redirecturl)['host']) {
+                    curl_setopt($curl, CURLOPT_HTTPAUTH, null);
+                    curl_setopt($curl, CURLOPT_USERPWD, null);
+                }
+
                $ret = curl_exec($curl);

                $this->info  = curl_getinfo($curl);