Bug #78162 [Csd]: cURL 7.64.0 does not allow to save cookies from a localserver
Edit report at https://bugs.php.net/bug.php?id=78162&edit=1
ID: 78162
Updated by: cmb@php.net
Reported by: alexandre at comsoftweb dot pt
Summary: cURL 7.64.0 does not allow to save cookies from a
localserver
Status: Closed
Type: Bug
Package: cURL related
Operating System: Windows
PHP Version: 7.3.6
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
The 7.2 and 7.3 branches have just been upgraded to curl 7.67.0,
so PHP for Windows 7.2.26, 7.3.13 and 7.4.0 will be build against
that version (or possibly later).
Previous Comments:
------------------------------------------------------------------------
[2019-09-18 09:18:38] cmb@php.net
The plan is to upgrade to curl 7.66.1 as soon as it'll be
available. I'll drop a note here when that happened.
------------------------------------------------------------------------
[2019-09-17 10:29:59] alexandre at comsoftweb dot pt
By closing this ticket I don't know when this is fixed/don't get notified.
I am waiting for this to install the latest PHP release on a project.
I really need this patched
------------------------------------------------------------------------
[2019-09-16 14:59:08] cmb@php.net
Since there is good progress on bug #78100, I'm closing this ticket.
------------------------------------------------------------------------
[2019-06-14 17:30:34] cmb@php.net
Thanks for reporting! I can confirm this issue.
However, upgrading to cURL 7.64.1 is blocked by bug #78007,
upgrading to cURL 7.65.0/1 by bug #78100. Downgrading is also no
option due to CVE fixes, which have been applied to the
libcurl-7.64.0-3 packages.
We certainly have to keep an eye on this.
------------------------------------------------------------------------
[2019-06-14 10:58:40] alexandre at comsoftweb dot pt
Description:
------------
---
From manual page: https://php.net/book.curl
---
> curl version is 7.64.0
> ["features"]=> int(2428829)
This "features" value does not have the PSL bit set (1<<20) which means this curl
version suffers from a cookie parsing bug present in 7.64.0, fixed in
7.64.1 (commit 299d9660f85), that made curl not accept cookies on domain names without any dots.
Solution: upgrade (or downgrade) curl.
Test script:
---------------
//this url is a local server, so bluepc has no dots in this url returns cookies
$url = 'http://bluepc/ERPV18/api/Shell/LoginUser/';
//Initiate cURL.
$ch = curl_init($url);
//thiscookie file will never have any cookies in it because bluepc has no dots
curl_setopt($ch, CURLOPT_COOKIEJAR, "C:/cookies/cookieFile.txt");
curl_exec($ch);
curl_close($ch);
Expected result:
----------------
cookiefile should have cookies inside like this
# Netscape HTTP Cookie File
# https://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.
bluepc FALSE / FALSE 0 eti_sessionInfo YgBsAHUAZQBwAGMAXABzAHEAbAAyADAAMQA3AKcAcwBpAHMAdABlAG0AYQBfAGEAbABhAGMAbwCnAEEATABBAEMATwCnAEUAeAAgADIAMAAxADkApwAxAKcAUABUAC0AUABUAA==
Actual result:
--------------
but it only has the header and its empty
# Netscape HTTP Cookie File
# https://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=78162&edit=1
Thread (6 messages)