setopt: unset NOBODY switches to GET if still HEAD

Reported-by: Vít Ondruch

0002-curl-7.71.1-unset-nobody.patch

@@ -0,0 +1,108 @@
+From 750188fc8eb239f51255d6f3510f544377e78ecd Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 27 Jul 2020 11:44:01 +0200
+Subject: [PATCH 1/2] setopt: unset NOBODY switches to GET if still HEAD
+
+Unsetting CURLOPT_NOBODY with 0L when doing HTTP has no documented
+action but before 7.71.0 that used to switch back to GET and with this
+change (assuming the method is still set to HEAD) this behavior is
+brought back.
+
+Reported-by: causal-agent on github
+Fixes #5725
+Closes #5728
+
+Upstream-commit: 91cb16b21faa556d4467399781379ad3abafd3fe
+Signed-off-by: Kamil Dudka <kdudka@redhat.com>
+---
+ lib/setopt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 90edf6a..d621335 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -274,6 +274,8 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+     if(data->set.opt_no_body)
+       /* in HTTP lingo, no body means using the HEAD request... */
+       data->set.method = HTTPREQ_HEAD;
++    else if(data->set.method == HTTPREQ_HEAD)
++      data->set.method = HTTPREQ_GET;
+     break;
+   case CURLOPT_FAILONERROR:
+     /*
+-- 
+2.25.4
+
+
+From 44add6f66c7ddec9f002fb52ce8e893a8ca9165d Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 27 Jul 2020 11:54:29 +0200
+Subject: [PATCH 2/2] CURLOPT_NOBODY.3: clarify what setting to 0 means
+
+... and mention that HTTP with other methods than HEAD might get a body and
+there's no option available to stop that.
+
+Closes #5729
+
+Upstream-commit: e1bac81cc815f3fe968e009eb69b8e0236dcd82c
+Signed-off-by: Kamil Dudka <kdudka@redhat.com>
+---
+ docs/libcurl/opts/CURLOPT_NOBODY.3 | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/docs/libcurl/opts/CURLOPT_NOBODY.3 b/docs/libcurl/opts/CURLOPT_NOBODY.3
+index f720f49..3674dde 100644
+--- a/docs/libcurl/opts/CURLOPT_NOBODY.3
++++ b/docs/libcurl/opts/CURLOPT_NOBODY.3
+@@ -5,7 +5,7 @@
+ .\" *                            | (__| |_| |  _ <| |___
+ .\" *                             \___|\___/|_| \_\_____|
+ .\" *
+-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
++.\" * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
+ .\" *
+ .\" * This software is licensed as described in the file COPYING, which
+ .\" * you should have received as part of this distribution. The terms
+@@ -34,7 +34,17 @@ output when doing what would otherwise be a download. For HTTP(S), this makes
+ libcurl do a HEAD request. For most other protocols it means just not asking
+ to transfer the body data.
+ 
+-Enabling this option means asking for a download but without a body.
++For HTTP operations when \fBCURLOPT_NOBODY(3)\fP has been set, unsetting the
++option (with 0) will make it a GET again - only if the method is still set to
++be HEAD. The proper way to get back to a GET request is to set
++\fBCURLOPT_HTTPGET(3)\fP and for other methods, use the POST ur UPLOAD
++options.
++
++Enabling \fBCURLOPT_NOBODY(3)\fP means asking for a download without a body.
++
++If you do a transfer with HTTP that involves a method other than HEAD, you
++will get a body (unless the resource and server sends a zero byte body for the
++specific URL you request).
+ .SH DEFAULT
+ 0, the body is transferred
+ .SH PROTOCOLS
+@@ -43,9 +53,9 @@ Most
+ .nf
+ curl = curl_easy_init();
+ if(curl) {
+-  curl_easy_setopt(curl, CURLOPT_URL, "http://example.com");
++  curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+ 
+-  /* get us the resource without a body! */
++  /* get us the resource without a body - use HEAD! */
+   curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);
+ 
+   /* Perform the request */
+@@ -57,5 +67,5 @@ Always
+ .SH RETURN VALUE
+ Returns CURLE_OK
+ .SH "SEE ALSO"
+-.BR CURLOPT_HTTPGET "(3), " CURLOPT_POST "(3), "
+-.BR CURLOPT_REQUEST_TARGET "(3), "
++.BR CURLOPT_HTTPGET "(3), " CURLOPT_POSTFIELDS "(3), " CURLOPT_UPLOAD "(3), "
++.BR CURLOPT_REQUEST_TARGET "(3), " CURLOPT_MIMEPOST "(3), "
+-- 
+2.25.4
+

curl.spec

@@ -1,13 +1,16 @@
 Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
 Name: curl
 Version: 7.71.1
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: MIT
 Source: https://curl.haxx.se/download/%{name}-%{version}.tar.xz
 
 # curl: make the --krb option work again (#1833193)
 Patch1:   0001-curl-7.71.1-tool-krb-opt.patch
 
+# setopt: unset NOBODY switches to GET if still HEAD
+Patch2:   0002-curl-7.71.1-unset-nobody.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -176,6 +179,7 @@ be installed.
 
 # upstream patches
 %patch1 -p1
+%patch2 -p1
 
 # Fedora patches
 %patch101 -p1
@@ -354,6 +358,9 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
 %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
 
 %changelog
+* Thu Aug 06 2020 Kamil Dudka <kdudka@redhat.com> - 7.71.1-5
+- setopt: unset NOBODY switches to GET if still HEAD
+
 * Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7.71.1-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild