rapid7/metasploit-framework — pull request #1500 by dmaloney-r7 (2013-02-18 04:56:35+00:00)
Title: Rex HTTP Invisibile Auth v2

Fix up the invisible auth concerns by creating a new Request class specifically for use by the Http client. The logic used originally in request_raw and request_cgi is mvoed into the Clientrequest class, and the request_raw and request_cgi methods are only responsible for setting up the options passed in then. This should leave no conflict in behaviour as we saw with using the Request class that was designed for use by the Http Server class.

Tested with the crawler, http_login modules, and tomcat_mgr_deploy exploit to ensure they all still work.