1From 093531556203decd92d92bccd431edbe5561781c Mon Sep 17 00:00:00 2001 2From: Daniel Stenberg <daniel@haxx.se> 3Date: Tue, 26 Apr 2022 07:46:19 +0200 4Subject: [PATCH] gnutls: don't leak the SRP credentials in redirects 5 6Follow-up to 620ea21410030 and 139a54ed0a172a 7 8Reported-by: Harry Sintonen 9Closes #8752 10--- 11 lib/vtls/gtls.c | 6 +++--- 12 1 file changed, 3 insertions(+), 3 deletions(-) 13 14diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c 15index 9c3a68f0ac6b..0535011911d5 100644 16--- a/lib/vtls/gtls.c 17+++ b/lib/vtls/gtls.c 18@@ -445,11 +445,11 @@ gtls_connect_step1(struct Curl_easy *data, 19 } 20 21 #ifdef HAVE_GNUTLS_SRP 22- if(SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP) { 23+ if((SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP) && 24+ Curl_allow_auth_to_host(data)) { 25 infof(data, "Using TLS-SRP username: %s", SSL_SET_OPTION(username)); 26 27- rc = gnutls_srp_allocate_client_credentials( 28- &backend->srp_client_cred); 29+ rc = gnutls_srp_allocate_client_credentials(&backend->srp_client_cred); 30 if(rc != GNUTLS_E_SUCCESS) { 31 failf(data, "gnutls_srp_allocate_client_cred() failed: %s", 32 gnutls_strerror(rc)); 33