CVE-2021-22909-snippet-3.bash

get_tar_by_url () 
{ 
    mkdir $TMP_DIR 
    if [ "$NOPROMPT" -eq 0 ]; then 
        echo "Trying to get upgrade file from $TAR" 
    fi 
  
    if [ -n "$USERNAME" ]; then 
        auth="-u $USERNAME:$PASSWORD" 
    else 
        auth="" 
    fi 
  
    filename="${TMP_DIR}/${TAR##*/}" 
    if [ "$NOPROMPT" -eq 0 ]; then 
        curl -k $auth -f -L -o $filename $TAR      # <-----  
    else 
        curl -k $auth -f -s -L -o $filename $TAR   # <----- 
    fi 
    if [ $? -ne 0 ]; then 
        echo "Unable to get upgrade file from $TAR" 
        rm -f $filename 
        rm -f $DOWNLOADING 
        exit 1 
    fi 
  
    if [ ! -e $filename ]; then 
        echo "Download of $TAR failed" 
        rm -f $DOWNLOADING 
        exit 1 
    fi 
  
    if [ "$NOPROMPT" -eq 0 ]; then 
        echo "Download succeeded" 
    fi 
  
    TAR=$filename 
}