From a2b66c7833aafac915a06e791cd19d0c9966baa9 Mon Sep 17 00:00:00 2001
From: Carson Tam <carson.tam@ucsf.edu>
Date: Thu, 28 Sep 2017 08:46:31 -0700
Subject: [PATCH 1/3] MDL-60161 class curl in filelib: Avoid duplicate params
 in http header

---
 lib/filelib.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/filelib.php b/lib/filelib.php
index 6b4f1dc8210..4a6768a3689 100644
--- a/lib/filelib.php
+++ b/lib/filelib.php
@@ -3036,7 +3036,10 @@ class curl {
             }
         } else {
             // Remove newlines, they are not allowed in headers.
-            $this->header[] = preg_replace('/[\r\n]/', '', $header);
+            $newvalue = preg_replace('/[\r\n]/', '', $header);
+            if (!in_array($newvalue, $this->header)) {
+                $this->header[] = $newvalue;
+            }
         }
     }
 

From 7d4a3d1d07f861109c510124ace53c992fd6a439 Mon Sep 17 00:00:00 2001
From: Carson Tam <carson.tam@ucsf.edu>
Date: Mon, 27 Nov 2017 14:47:53 -0800
Subject: [PATCH 2/3] MDL-60161 class curl in filelib: Cleaned up doc block.

---
 lib/filelib.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/filelib.php b/lib/filelib.php
index 4a6768a3689..9e0e6d2d221 100644
--- a/lib/filelib.php
+++ b/lib/filelib.php
@@ -3027,7 +3027,6 @@ class curl {
      * Set HTTP Request Header
      *
      * @param array $header
-     * @param bool $replace If true, will remove any existing headers before appending the new one.
      */
     public function setHeader($header) {
         if (is_array($header)) {

From 01957f1a699cc6afca4d811a0377b64023b7558b Mon Sep 17 00:00:00 2001
From: Adrian Greeve <adrian@moodle.com>
Date: Wed, 13 Dec 2017 11:07:13 +0800
Subject: [PATCH 3/3] MDL-60161 filelib: Unit test for duplicate curl headers.

---
 lib/tests/filelib_test.php | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/tests/filelib_test.php b/lib/tests/filelib_test.php
index b6109d98164..c613169977a 100644
--- a/lib/tests/filelib_test.php
+++ b/lib/tests/filelib_test.php
@@ -501,6 +501,21 @@ class core_filelib_testcase extends advanced_testcase {
         $CFG->proxybypass = $oldproxybypass;
     }
 
+    /**
+     * Test that duplicate lines in the curl header are removed.
+     */
+    public function test_duplicate_curl_header() {
+        $testurl = $this->getExternalTestFileUrl('/test_post.php');
+
+        $curl = new curl();
+        $headerdata = 'Accept: application/json';
+        $header = [$headerdata, $headerdata];
+        $this->assertCount(2, $header);
+        $curl->setHeader($header);
+        $this->assertCount(1, $curl->header);
+        $this->assertEquals($headerdata, $curl->header[0]);
+    }
+
     public function test_curl_post() {
         $testurl = $this->getExternalTestFileUrl('/test_post.php');