1 check-in tagged with "version-0.3.30"
|
2026-09-24
| ||
| 16:44 |
transport: refuse Basic over plain http to another host; drop it on a cross-host redirect
A Basic challenge was answered whatever the scheme, so over http the password crossed readable and the saved remote repeated it. It is now refused to non-loopback hosts, naming the https URL; a redirect to another host drops the credential; plain http to another host notes it on stderr. Release 0.3.30. check-in: b637cbd37c user: dmestas tags: trunk, version-0.3.30 | |