* lib/open-uri.rb (OpenURI.open_loop): send authentication only for

  the URI directly specified.


git-svn-id: http://svn.ruby-lang.org/repos/ruby/branches/ruby_1_8@7952 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 10 insertions, 0 deletions

diff --git a/lib/open-uri.rb b/lib/open-uri.rb
index 14e397b32..83bb756bb 100644
--- a/lib/open-uri.rb
+++ b/lib/open-uri.rb
@@ -176,6 +176,11 @@ module OpenURI
         unless OpenURI.redirectable?(uri, redirect)
           raise "redirection forbidden: #{uri} -> #{redirect}"
         end
+        if options.include? :http_basic_authentication
+          # send authentication only for the URI directly specified.
+          options = options.dup
+          options.delete :http_basic_authentication
+        end
         uri = redirect
         raise "HTTP redirection loop: #{uri}" if uri_set.include? uri.to_s
         uri_set[uri.to_s] = true
@@ -201,6 +206,11 @@ module OpenURI
       raise "Non-HTTP proxy URI: #{proxy}" if proxy.class != URI::HTTP
     end
 
+    if target.userinfo && "1.9.0" <= RUBY_VERSION
+      # don't raise for 1.8 because compatibility.
+      raise "userinfo not supported.  [RFC3986]"
+    end
+
     require 'net/http'
     klass = Net::HTTP
     if URI::HTTP === target