Vulnerability report: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0037
Vulnerability in curl was fixed in 7.19.3, released 2009-01-19 (http://curl.haxx.se/changes.html)
Minimum version of PHP we support is 5.2.3, released 2007-05-31 (http://www.php.net/ChangeLog-5.php#5.2.3)

I'll try to get this fixed in time for release.

unassigning myself so I don't practgice cookie-licking

for 1.18 tarball we should either fix this or add something to the release notes.

Reading over brion's comments more carefully (and making a stab at implementation), I see that this is more significant than a release notes thing.

The following bit definitely won't be implemented in time for 1.18.

This would allow our own protocol security checks to be applied consistently at
all times, and could also allow for a callback, eg for the caller to apply
their own domain checks at each stage.

And the vulnerability report in comment #1 was fixed in Tim's original implementation (duh!).

(mass change)

• 1.18.0 and 1.19.0 have been released already.
• Moving open bugs targeted for 1.18.0 or 1.19.0 to Mysterious future.
• Please re-target them to 1.19.x or 1.20.0 if needed.