id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
16890	Mutliple Location response headers can trigger notices	hakre		"The current implementation for manual cUrl redirects (safemode / openbasedir restrictions, see #11305) will do notices and fail if a response contains more than one location response header.

Technically this is possible.

In the RFC I have not found any definition so far wether or not this is violating any standard or not not. Next to that I could gather no information how a HTTP client should interprete such a response.

For my fix I will prefer the first location header over any additional one."	defect	new	normal	Awaiting Review	HTTP		normal		has-patch