fix(HTTP): remove invalid CURLOPT_HTTPHEADER string assignment in CURLRequest (#10695)

Author: gr8man

system/HTTP/CURLRequest.php

@@ -813,8 +813,7 @@ private function applyResponseOptions(array $curlOptions, array $config): array
             if ($accept !== '') {
                 $curlOptions[CURLOPT_ENCODING] = $accept;
             } else {
-                $curlOptions[CURLOPT_ENCODING]   = '';
-                $curlOptions[CURLOPT_HTTPHEADER] = 'Accept-Encoding';
+                $curlOptions[CURLOPT_ENCODING] = '';
             }
         }
 

tests/system/HTTP/CURLRequestTest.php

@@ -673,7 +673,6 @@ public function testDecodeContent(): void
 
     public function testDecodeContentWithoutAccept(): void
     {
-        //      $this->request->setHeader('Accept-Encoding', 'cobol');
         $this->request->request('get', 'http://example.com', [
             'decode_content' => true,
         ]);
@@ -682,8 +681,11 @@ public function testDecodeContentWithoutAccept(): void
 
         $this->assertArrayHasKey(CURLOPT_ENCODING, $options);
         $this->assertSame('', $options[CURLOPT_ENCODING]);
-        $this->assertArrayHasKey(CURLOPT_HTTPHEADER, $options);
-        $this->assertSame('Accept-Encoding', $options[CURLOPT_HTTPHEADER]);
+        $this->assertArrayNotHasKey(CURLOPT_HTTPHEADER, $options);
+
+        // Verify that curl_setopt_array accepts the options without TypeError
+        $handle = curl_init();
+        $this->assertTrue(curl_setopt_array($handle, $options));
     }
 
     public function testAllowRedirectsOptionFalse(): void
@@ -1629,7 +1631,7 @@ public function testSetCURLOptions(): void
         // Test Response Options (decode_content / http_errors)
         $options12 = $invoker([], ['decode_content' => true]);
         $this->assertSame('', $options12[CURLOPT_ENCODING]);
-        $this->assertSame('Accept-Encoding', $options12[CURLOPT_HTTPHEADER]);
+        $this->assertArrayNotHasKey(CURLOPT_HTTPHEADER, $options12);
 
         // Test Protocol/Misc/Client Options
         $options13 = $invoker([], [

user_guide_src/source/changelogs/v4.7.6.rst

@@ -99,6 +99,7 @@ Bugs Fixed
 - **HTTP:** Fixed a bug in ``ContentSecurityPolicy`` where a numeric source such as ``'0'`` threw a ``TypeError``, and a space-separated directive string in ``Config\\ContentSecurityPolicy`` was emitted as one unquoted source.
 - **HTTP:** Fixed a regression in v4.7.0 where calling ``ContentSecurityPolicy::reportOnly()`` after the policy was created did not apply to array sources from ``Config\\ContentSecurityPolicy``, so they stayed in the enforced ``Content-Security-Policy`` header alongside the ``Content-Security-Policy-Report-Only`` header.
 - **HTTP:** Fixed a bug in ``ContentSecurityPolicy::setDefaultSrc()`` where passing an array of URIs resulted in an invalid ``'Array'`` directive.
+- **HTTP:** Fixed a bug where ``CURLRequest`` threw a ``TypeError`` when ``decode_content`` was enabled without custom request headers because ``CURLOPT_HTTPHEADER`` was set to a string instead of an array.
 - **HTTP:** Fixed a bug where ``IncomingRequest`` did not read the request body when PHP's ``post_max_size`` was set to ``0`` or ``-1`` (unlimited).
 - **HTTP:** Fixed a bug where ``IncomingRequest::isSecure()`` did not recognize ``https`` in the ``X-Forwarded-Proto`` header from a trusted proxy when the value contained uppercase letters or surrounding whitespace, or was represented as a single-element array.
 - **HTTP:** Fixed a bug where ``Negotiate::media()`` threw an ``ErrorException`` when the ``Accept`` header contained a value without a subtype, such as ``json`` or an empty list element. Such values are now ignored.