base64: build conditionally if there are users

doh: CURL_DISABLE_DOH

auth: Rename the various authentication clean up functions

For consistency and to a avoid confusion.

Closes #3869

docs/INSTALL: fix broken link [ci skip]

Reported-by: Joombalaya on github
Fixes #3818

easy: fix another "clarify calculation precedence" warning

I missed this one in commit 6b3dde7fe62ea5a557fd1fd323fac2bcd0c2e9be.

build: fix "clarify calculation precedence" warnings

Codacy/CppCheck warns about this. Consistently use parentheses as we
already do in some places to silence the warning.

Close

build: fix "clarify calculation precedence" warnings

Codacy/CppCheck warns about this. Consistently use parentheses as we
already do in some places to silence the warning.

Closes https://github.com/curl/curl/pull/3866

show more ...

cmake: restore C89 compatibility of CurlTests.c

I broke it in d1b5cf830bfe169745721b21245d2217d2c2453e and
97de97daefc2ed084c91eff34af2426f2e55e134.

Reported-by: Viktor Szakats

cmake: restore C89 compatibility of CurlTests.c

I broke it in d1b5cf830bfe169745721b21245d2217d2c2453e and
97de97daefc2ed084c91eff34af2426f2e55e134.

Reported-by: Viktor Szakats
Ref: https://github.com/curl/curl/commit/97de97daefc2ed084c91eff34af2426f2e55e134#commitcomment-33499044
Closes https://github.com/curl/curl/pull/3868

show more ...

http_ntlm: Corrected the name of the include guard

Missed in f0bdd72c.

Closes #3867

http_digest: Don't expose functions when HTTP and Crypto Auth are disabled

Closes #3861

http_negotiate: Don't expose functions when HTTP is disabled

SECURITY-PROCESS: fix links [ci skip]

CMake: suppress unused variable warnings

I missed these in commit d1b5cf830bfe169745721b21245d2217d2c2453e.

doh: disable DOH for the cases it doesn't work

Due to limitations in Curl_resolver_wait_resolv(), it doesn't work for
DOH resolves. This fix disables DOH for those.

Limitation a

doh: disable DOH for the cases it doesn't work

Due to limitations in Curl_resolver_wait_resolv(), it doesn't work for
DOH resolves. This fix disables DOH for those.

Limitation added to KNOWN_BUGS.

Fixes #3850
Closes #3857

show more ...

checksrc.bat: Ignore snprintf warnings in docs/examples

.. because we allow snprintf use in docs/examples.

Closes https://github.com/curl/curl/pull/3862

vauth: Fix incorrect function description for Curl_auth_user_contains_domain()

...and misalignment of these comments. From a78c61a4.

Closes #3860

Revert "multi: support verbose conncache closure handle"

This reverts commit b0972bc.

- No longer show verbose output for the conncache closure handle.

The offending commit

Revert "multi: support verbose conncache closure handle"

This reverts commit b0972bc.

- No longer show verbose output for the conncache closure handle.

The offending commit was added so that the conncache closure handle
would inherit verbose mode from the user's easy handle. (Note there is
no way for the user to set options for the closure handle which is why
that was necessary.) Other debug settings such as the debug function
were not also inherited since we determined that could lead to crashes
if the user's per-handle private data was used on an unexpected handle.

The reporter here says he has a debug function to capture the verbose
output, and does not expect or want any output to stderr; however
because the conncache closure handle does not inherit the debug function
the verbose output for that handle does go to stderr.

There are other plausible scenarios as well such as the user redirects
stderr on their handle, which is also not inherited since it could lead
to crashes when used on an unexpected handle.

Short of allowing the user to set options for the conncache closure
handle I don't think there's much we can safely do except no longer
inherit the verbose setting.

Bug: https://curl.haxx.se/mail/lib-2019-05/0021.html
Reported-by: Kristoffer Gleditsch

Ref: https://github.com/curl/curl/pull/3598
Ref: https://github.com/curl/curl/pull/3618

Closes https://github.com/curl/curl/pull/3856

show more ...

ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup()

From 6012fa5a.

Closes #3858

BUG-BOUNTY: minor formatting fixes [ci skip]

RELEASE-NOTES: synced

BUG-BOUNTY.md: add the Dropbox "bonus" extra payout ability [ci skip]

Closes #3839

http_negotiate: do not treat failure of gss_init_sec_context() as fatal

Fixes #3726
Closes #3849

spnego_gssapi: fix return code on gss_init_sec_context() failure

Fixes #3726
Closes #3849

gen_resp_file.bat: Removed unnecessary @ from all but the first command

There is need to use @ on every command once echo has been turned off.

Closes #3854

http: Ignore HTTP/2 prior knowledge setting for HTTP proxies

- Do not switch to HTTP/2 for an HTTP proxy that is not tunnelling to
the destination host.

We already do somethin

http: Ignore HTTP/2 prior knowledge setting for HTTP proxies

- Do not switch to HTTP/2 for an HTTP proxy that is not tunnelling to
the destination host.

We already do something similar for HTTPS proxies by not sending h2. [1]

Prior to this change setting CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE would
incorrectly use HTTP/2 to talk to the proxy, which is not something we
support (yet?). Also it's debatable whether or not that setting should
apply to HTTP/2 proxies.

[1]: https://github.com/curl/curl/commit/17c5d05

Bug: https://github.com/curl/curl/issues/3570
Bug: https://github.com/curl/curl/issues/3832

Closes https://github.com/curl/curl/pull/3853

show more ...

travis: update mesalink build to xenial

Closes https://github.com/curl/curl/pull/3842