From 0d707a21ba3dc4f7433c78a51c013f50e627a7a3 Mon Sep 17 00:00:00 2001 From: Kevin Israel Date: Mon, 8 Sep 2014 18:15:09 -0400 Subject: [PATCH] CurlHttpRequest: Check library version, not CURLOPT_REDIR_PROTOCOLS This works around . We don't actually use the constant, so checking the library version should suffice. Bug: 70570 Change-Id: I732d8f7eb2908bae10100594f693cf7a63f8b5b1 --- includes/HttpFunctions.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/includes/HttpFunctions.php b/includes/HttpFunctions.php index 1eb8ca5294..8302124570 100644 --- a/includes/HttpFunctions.php +++ b/includes/HttpFunctions.php @@ -809,7 +809,8 @@ class CurlHttpRequest extends MWHttpRequest { return false; } - if ( !defined( 'CURLOPT_REDIR_PROTOCOLS' ) ) { + $curlVersionInfo = curl_version(); + if ( $curlVersionInfo['version_number'] < 0x071304 ) { wfDebug( "Cannot follow redirects with libcurl < 7.19.4 due to CVE-2009-0037\n" ); return false; } -- 2.20.1