[Bug 1281646] [NEW] php5-curl: Curl truncates basic auth password after semicolon

[Michael Kliewe]

Public bug reported:

Hi there,

I'm not sure where to report this bug, if it's Ubuntu, Debian or curl.

I'm using newest stable Ubuntu 13.10 with PHP 5.5.3-1ubuntu2.1. Basic
authentication via curl does not work anymore if the password contains a
semicolon:


$curlSettings[CURLOPT_HTTPAUTH] = CURLAUTH_BASIC;
$curlSettings[CURLOPT_USERPWD] = '1testuser:pass;word';

$curl = curl_init('http://www.phpgangsta.de/download/curl_auth_test.php');
               // content:   echo 'Password: '.$_SERVER['PHP_AUTH_PW'];
curl_setopt_array($curl, $curlSettings);

curl_exec($curl);


It outputs just "pass" instead of "pass;word".
The same happens if you do this on a command line:
  curl --basic --user "1testuser:pass;word" http://www.phpgangsta.de/download/curl_auth_test.php

The problem seems to be the curl version that is used. I did a few
tests:

not affected: 5.4.14           (curl 7.19.7)
affected:     5.5.3-1ubuntu2.1 (curl 7.32.0)
not affected: 5.5.3            (curl 7.22.0)
affected:     5.5.9            (curl 7.32.0)
not affected: 5.5.9            (curl 7.22.0)
not affected: 5.6-alpha2       (curl 7.22.0)

The problem seems to be curl 7.32.0 (plus maybe versions before and
after)

While searching for that bug I just found 1 occurrence, but I cannot believe hat it has not been fixed since July 2013.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=717267

Maybe you can tell me where to report this bug so it gets fixed in
current stable Ubuntu 13.10.

Michael

** Affects: php5 (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to php5 in Ubuntu.
https://bugs.launchpad.net/bugs/1281646

Title:
  php5-curl: Curl truncates basic auth password after semicolon

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1281646/+subscriptions