From 02a62074c77e5932655a136b39637051bfac30d6 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Sun, 14 Jul 2019 16:32:50 +0200 Subject: libcurl-security.3: update to new CURLOPT_REDIR_PROTOCOLS defaults follow-up to 6080ea098 --- docs/libcurl/libcurl-security.3 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'docs') diff --git a/docs/libcurl/libcurl-security.3 b/docs/libcurl/libcurl-security.3 index 0cfdddea8..cdb97915c 100644 --- a/docs/libcurl/libcurl-security.3 +++ b/docs/libcurl/libcurl-security.3 @@ -5,7 +5,7 @@ .\" * | (__| |_| | _ <| |___ .\" * \___|\___/|_| \_\_____| .\" * -.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, , et al. +.\" * Copyright (C) 1998 - 2019, Daniel Stenberg, , et al. .\" * .\" * This software is licensed as described in the file COPYING, which .\" * you should have received as part of this distribution. The terms @@ -97,8 +97,8 @@ Never ever switch off certificate verification. The \fICURLOPT_FOLLOWLOCATION(3)\fP option automatically follows HTTP redirects sent by a remote server. These redirects can refer to any kind of URL, not just HTTP. libcurl restricts the protocols allowed to be used in -redirects for security reasons: FILE, SCP, SMB and SMBS are disabled by -default. Applications are encouraged to restrict that set further. +redirects for security reasons: only HTTP, HTTPS and FTP are enabled by +default. Applications may opt to restrict thus set further. A redirect to a file: URL would cause the libcurl to read (or write) arbitrary files from the local filesystem. If the application returns the data back to -- cgit v1.2.3