romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-14 19:03:39 +03:00
Code Issues Projects Releases Packages Wiki Activity

socks: deny server basic-auth if not configured

Browse source 
When the server proposes BASIC authentication and curl does
not have that configured, fail right away.

Reported-by: Joshua Rogers
Closes #18937
This commit is contained in:
Stefan Eissing 2025-10-08 14:06:55 +02:00 • committed by Daniel Stenberg
parent 0b4a704500
commit c0a279a8e9
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/socks.c
View file

@ -681,8 +681,12 @@ static CURLproxycode socks5_check_resp0(struct socks_state *sx,
return CURLPX_GSSAPI_PERMSG;
case 2:
/* regular name + password authentication */
sxstate(sx, cf, data, SOCKS5_ST_AUTH_INIT);
return CURLPX_OK;
if(data->set.socks5auth & CURLAUTH_BASIC) {
sxstate(sx, cf, data, SOCKS5_ST_AUTH_INIT);
return CURLPX_OK;
}
failf(data, "BASIC authentication proposed but not enabled.");
return CURLPX_NO_AUTH;
case 255:
failf(data, "No authentication method was acceptable.");
return CURLPX_NO_AUTH;