Not-so-automated merge.

diff --combined src/ChangeLog
index 193bcd75ca2fe5c9955463c0c29e9ffce6f19bfe,744ff2d26556e01e1c762728a812bc73b21f819a..5e7fc16d0fad4451d0d98f1c6d09785438d061bd
--- 1/src/ChangeLog
--- 2/src/ChangeLog
+++ b/src/ChangeLog
@@@ -1,8 -1,10 +1,15 @@@
 +2008-11-13  Micah Cowan  <micah@cowan.name>
 +
 +      * http.c (gethttp): Don't do anything when content-length >= our
 +      requested range.
 +
+ 2008-11-27  Saint Xavier  <wget@sxav.eu>
+ 
+       * http.c (gethttp): Move authentication code before filename
+       allocation avoiding fallbacking on default filename because
+       "Content-Disposition" header wasn't present before authentcation
+       has been completed. Fixes bug #24862.
+ 
  2008-11-16  Steven Schubiger  <stsc@members.fsf.org>
  
        * main.c: Declare and initialize the numurls counter.

diff --combined src/http.c
index 33b9a53c46af12ea1f49b9aa21c8edc38957660f,a52df265271a0c819641846a30f415d397827f0d..090950d2870c3eb0864d81f3f673ac2909ca6c0b
--- 1/src/http.c
--- 2/src/http.c
+++ b/src/http.c
@@@ -1815,6 -1815,95 +1815,95 @@@ gethttp (struct url *u, struct http_sta
        print_server_response (resp, "  ");
      }
  
+   /* Check for keep-alive related responses. */
+   if (!inhibit_keep_alive && contlen != -1)
+     {
+       if (resp_header_copy (resp, "Keep-Alive", NULL, 0))
+         keep_alive = true;
+       else if (resp_header_copy (resp, "Connection", hdrval, sizeof (hdrval)))
+         {
+           if (0 == strcasecmp (hdrval, "Keep-Alive"))
+             keep_alive = true;
+         }
+     }
+ 
+   if (keep_alive)
+     /* The server has promised that it will not close the connection
+        when we're done.  This means that we can register it.  */
+     register_persistent (conn->host, conn->port, sock, using_ssl);
+ 
+   if (statcode == HTTP_STATUS_UNAUTHORIZED)
+     {
+       /* Authorization is required.  */
+       if (keep_alive && !head_only && skip_short_body (sock, contlen))
+         CLOSE_FINISH (sock);
+       else
+         CLOSE_INVALIDATE (sock);
+       pconn.authorized = false;
+       if (!auth_finished && (user && passwd))
+         {
+           /* IIS sends multiple copies of WWW-Authenticate, one with
+              the value "negotiate", and other(s) with data.  Loop over
+              all the occurrences and pick the one we recognize.  */
+           int wapos;
+           const char *wabeg, *waend;
+           char *www_authenticate = NULL;
+           for (wapos = 0;
+                (wapos = resp_header_locate (resp, "WWW-Authenticate", wapos,
+                                             &wabeg, &waend)) != -1;
+                ++wapos)
+             if (known_authentication_scheme_p (wabeg, waend))
+               {
+                 BOUNDED_TO_ALLOCA (wabeg, waend, www_authenticate);
+                 break;
+               }
+ 
+           if (!www_authenticate)
+             {
+               /* If the authentication header is missing or
+                  unrecognized, there's no sense in retrying.  */
+               logputs (LOG_NOTQUIET, _("Unknown authentication scheme.\n"));
+             }
+           else if (!basic_auth_finished
+                    || !BEGINS_WITH (www_authenticate, "Basic"))
+             {
+               char *pth;
+               pth = url_full_path (u);
+               request_set_header (req, "Authorization",
+                                   create_authorization_line (www_authenticate,
+                                                              user, passwd,
+                                                              request_method (req),
+                                                              pth,
+                                                              &auth_finished),
+                                   rel_value);
+               if (BEGINS_WITH (www_authenticate, "NTLM"))
+                 ntlm_seen = true;
+               else if (!u->user && BEGINS_WITH (www_authenticate, "Basic"))
+                 {
+                   /* Need to register this host as using basic auth,
+                    * so we automatically send creds next time. */
+                   register_basic_auth_host (u->host);
+                 }
+               xfree (pth);
+               goto retry_with_auth;
+             }
+           else
+             {
+               /* We already did Basic auth, and it failed. Gotta
+                * give up. */
+             }
+         }
+       logputs (LOG_NOTQUIET, _("Authorization failed.\n"));
+       request_free (req);
+       return AUTHFAILED;
+     }
+   else /* statcode != HTTP_STATUS_UNAUTHORIZED */
+     {
+       /* Kludge: if NTLM is used, mark the TCP connection as authorized. */
+       if (ntlm_seen)
+         pconn.authorized = true;
+     }
+ 
    /* Determine the local filename if needed. Notice that if -O is used 
     * hstat.local_file is set by http_loop to the argument of -O. */
    if (!hs->local_file)
@@@ -1947,93 -2036,6 +2036,6 @@@ File %s already there; not retrieving.\
          contlen = parsed;
      }
  
-   /* Check for keep-alive related responses. */
-   if (!inhibit_keep_alive && contlen != -1)
-     {
-       if (resp_header_copy (resp, "Keep-Alive", NULL, 0))
-         keep_alive = true;
-       else if (resp_header_copy (resp, "Connection", hdrval, sizeof (hdrval)))
-         {
-           if (0 == strcasecmp (hdrval, "Keep-Alive"))
-             keep_alive = true;
-         }
-     }
-   if (keep_alive)
-     /* The server has promised that it will not close the connection
-        when we're done.  This means that we can register it.  */
-     register_persistent (conn->host, conn->port, sock, using_ssl);
- 
-   if (statcode == HTTP_STATUS_UNAUTHORIZED)
-     {
-       /* Authorization is required.  */
-       if (keep_alive && !head_only && skip_short_body (sock, contlen))
-         CLOSE_FINISH (sock);
-       else
-         CLOSE_INVALIDATE (sock);
-       pconn.authorized = false;
-       if (!auth_finished && (user && passwd))
-         {
-           /* IIS sends multiple copies of WWW-Authenticate, one with
-              the value "negotiate", and other(s) with data.  Loop over
-              all the occurrences and pick the one we recognize.  */
-           int wapos;
-           const char *wabeg, *waend;
-           char *www_authenticate = NULL;
-           for (wapos = 0;
-                (wapos = resp_header_locate (resp, "WWW-Authenticate", wapos,
-                                             &wabeg, &waend)) != -1;
-                ++wapos)
-             if (known_authentication_scheme_p (wabeg, waend))
-               {
-                 BOUNDED_TO_ALLOCA (wabeg, waend, www_authenticate);
-                 break;
-               }
- 
-           if (!www_authenticate)
-             {
-               /* If the authentication header is missing or
-                  unrecognized, there's no sense in retrying.  */
-               logputs (LOG_NOTQUIET, _("Unknown authentication scheme.\n"));
-             }
-           else if (!basic_auth_finished
-                    || !BEGINS_WITH (www_authenticate, "Basic"))
-             {
-               char *pth;
-               pth = url_full_path (u);
-               request_set_header (req, "Authorization",
-                                   create_authorization_line (www_authenticate,
-                                                              user, passwd,
-                                                              request_method (req),
-                                                              pth,
-                                                              &auth_finished),
-                                   rel_value);
-               if (BEGINS_WITH (www_authenticate, "NTLM"))
-                 ntlm_seen = true;
-               else if (!u->user && BEGINS_WITH (www_authenticate, "Basic"))
-                 {
-                   /* Need to register this host as using basic auth,
-                    * so we automatically send creds next time. */
-                   register_basic_auth_host (u->host);
-                 }
-               xfree (pth);
-               goto retry_with_auth;
-             }
-           else
-             {
-               /* We already did Basic auth, and it failed. Gotta
-                * give up. */
-             }
-         }
-       logputs (LOG_NOTQUIET, _("Authorization failed.\n"));
-       request_free (req);
-       return AUTHFAILED;
-     }
-   else /* statcode != HTTP_STATUS_UNAUTHORIZED */
-     {
-       /* Kludge: if NTLM is used, mark the TCP connection as authorized. */
-       if (ntlm_seen)
-         pconn.authorized = true;
-     }
    request_free (req);
  
    hs->statcode = statcode;
@@@ -2150,15 -2152,11 +2152,15 @@@
          }
      }
  
 -  if (statcode == HTTP_STATUS_RANGE_NOT_SATISFIABLE)
 +  if (statcode == HTTP_STATUS_RANGE_NOT_SATISFIABLE
 +      || (hs->restval > 0 && statcode == HTTP_STATUS_OK
 +          && contrange == 0 && hs->restval >= contlen)
 +     )
      {
        /* If `-c' is in use and the file has been fully downloaded (or
           the remote file has shrunk), Wget effectively requests bytes
 -         after the end of file and the server response with 416.  */
 +         after the end of file and the server response with 416
 +         (or 200 with a <= Content-Length.  */
        logputs (LOG_VERBOSE, _("\
  \n    The file is already fully retrieved; nothing to do.\n\n"));
        /* In case the caller inspects. */