Bug #78162 [Ver->Csd]: cURL 7.64.0 does not allow to save cookies from a localserver
Edit report at https://bugs.php.net/bug.php?id=78162&edit=1
ID: 78162
Updated by: cmb@php.net
Reported by: alexandre at comsoftweb dot pt
Summary: cURL 7.64.0 does not allow to save cookies from a
localserver
-Status: Verified
+Status: Closed
Type: Bug
Package: cURL related
Operating System: Windows
PHP Version: 7.3.6
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
Since there is good progress on bug #78100, I'm closing this ticket.
Previous Comments:
------------------------------------------------------------------------
[2019-06-14 17:30:34] cmb@php.net
Thanks for reporting! I can confirm this issue.
However, upgrading to cURL 7.64.1 is blocked by bug #78007,
upgrading to cURL 7.65.0/1 by bug #78100. Downgrading is also no
option due to CVE fixes, which have been applied to the
libcurl-7.64.0-3 packages.
We certainly have to keep an eye on this.
------------------------------------------------------------------------
[2019-06-14 10:58:40] alexandre at comsoftweb dot pt
Description:
------------
---
From manual page: https://php.net/book.curl
---
> curl version is 7.64.0
> ["features"]=> int(2428829)
This "features" value does not have the PSL bit set (1<<20) which means this curl
version suffers from a cookie parsing bug present in 7.64.0, fixed in
7.64.1 (commit 299d9660f85), that made curl not accept cookies on domain names without any dots.
Solution: upgrade (or downgrade) curl.
Test script:
---------------
//this url is a local server, so bluepc has no dots in this url returns cookies
$url = 'http://bluepc/ERPV18/api/Shell/LoginUser/';
//Initiate cURL.
$ch = curl_init($url);
//thiscookie file will never have any cookies in it because bluepc has no dots
curl_setopt($ch, CURLOPT_COOKIEJAR, "C:/cookies/cookieFile.txt");
curl_exec($ch);
curl_close($ch);
Expected result:
----------------
cookiefile should have cookies inside like this
# Netscape HTTP Cookie File
# https://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.
bluepc FALSE / FALSE 0 eti_sessionInfo YgBsAHUAZQBwAGMAXABzAHEAbAAyADAAMQA3AKcAcwBpAHMAdABlAG0AYQBfAGEAbABhAGMAbwCnAEEATABBAEMATwCnAEUAeAAgADIAMAAxADkApwAxAKcAUABUAC0AUABUAA==
Actual result:
--------------
but it only has the header and its empty
# Netscape HTTP Cookie File
# https://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=78162&edit=1
Thread (6 messages)