From f17417e95cd7c86a4bac5c8d318bce0ea4306247 Mon Sep 17 00:00:00 2001 From: Alexandre Alapetite Date: Sun, 20 May 2018 23:23:48 +0200 Subject: Strip credentials from HTTP Referer (#1891) https://github.com/simplepie/simplepie/blob/0edf39018709c0d66cfa6d9b972907bb92461efb/library/SimplePie/File.php#L109 Candidate for pull-request upstream to SimplePie --- lib/SimplePie/SimplePie/File.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/SimplePie/SimplePie/File.php b/lib/SimplePie/SimplePie/File.php index 8be38f145..b8a595571 100644 --- a/lib/SimplePie/SimplePie/File.php +++ b/lib/SimplePie/SimplePie/File.php @@ -110,7 +110,7 @@ class SimplePie_File curl_setopt($fp, CURLOPT_FAILONERROR, 1); curl_setopt($fp, CURLOPT_TIMEOUT, $timeout); curl_setopt($fp, CURLOPT_CONNECTTIMEOUT, $timeout); - curl_setopt($fp, CURLOPT_REFERER, $url); + curl_setopt($fp, CURLOPT_REFERER, SimplePie_Misc::url_remove_credentials($url)); curl_setopt($fp, CURLOPT_USERAGENT, $useragent); curl_setopt($fp, CURLOPT_HTTPHEADER, $headers2); if (!ini_get('open_basedir') && !ini_get('safe_mode') && version_compare(SimplePie_Misc::get_curl_version(), '7.15.2', '>=')) -- cgit v1.2.3