php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #33057 PHP returns Content-Type header for 304 responses
Submitted: 2005-05-18 16:12 UTC Modified: 2005-05-20 09:13 UTC
From: cboitel at lfdj dot com Assigned: rasmus (profile)
Status: Closed Package: Apache related
PHP Version: 5.0.4, 4.3.11 OS: Solaris/Linux
Private report: No CVE-ID: None
View Developer Edit
 [2005-05-18 16:12 UTC] cboitel at lfdj dot com 
Description:
------------
When setting response code to 304 from within PHP code, a "Content-Type:" header is always added when PHP is compiled within Apache 1.3x whereas it is not for Apache 2.x

This makes Apache 1.3x/PHP non compliant with RFC HTTP/1.1 for 304 responses in the case where a weak validator is used (Content-Type MUST not be returned).

Reproduce code:
---------------
mytest1.php
<?
header( "HTTP/1.1 304 Not Modified" );
?>

Expected result:
----------------
telnet localhost 80
GET /mytest1.php HTTP/1.0

HTTP/1.1 304 Not Modified
Date: Wed, 18 May 2005 14:10:06 GMT
Server: Apache
Connection: close




Actual result:
--------------
telnet localhost 80
GET /mytest1.php HTTP/1.0

HTTP/1.1 304 Not Modified
Date: Wed, 18 May 2005 14:10:06 GMT
Server: Apache
Content-Type: text/html
Connection: close

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-05-18 16:23 UTC] cboitel at lfdj dot com 
I have patched the mod_php4.c file to use send_error_response apache function instead of send_http_headers for 304 responses. You should also check if send_error_response shall also be used for non-200 responses and if its second param (recursive call) shall be set to 0 or 1.

static int sapi_apache_send_headers(sapi_headers_struct *sapi_headers TSRMLS_DC)
{
        request_rec *r;

        if(SG(server_context) == NULL) { /* server_context is not here anymore */
                return SAPI_HEADER_SEND_FAILED;
        }
        r = (request_rec *) SG(server_context);
        r->status = SG(sapi_headers).http_response_code;
        if( r-> status==304 )
        {
         send_error_response( r, 0 );
        }
        else
        {
         send_http_header((request_rec *) SG(server_context));
        }
        return SAPI_HEADER_SENT_SUCCESSFULLY;
}
 [2005-05-18 17:04 UTC] tony2001@php.net 
Please generate unified diff (`diff -u`), put it somewhere and give us it's URL.
 [2005-05-19 09:04 UTC] cboitel at lfdj dot com 
Unified diff below:

--- mod_php4.c  2005-05-18 15:33:58.000000000 +0200
+++ mod_php4.c.original 2003-06-03 07:41:49.000000000 +0200
@@ -209,21 +209,12 @@
  */
 static int sapi_apache_send_headers(sapi_headers_struct *sapi_headers TSRMLS_DC)
 {
-       request_rec *r;
-
        if(SG(server_context) == NULL) { /* server_context is not here anymore */
                return SAPI_HEADER_SEND_FAILED;
        }
-       r = (request_rec *) SG(server_context);
-       r->status = SG(sapi_headers).http_response_code;
-       if( r-> status==304 )
-       {
-        send_error_response( r, 0 );
-       }
-       else
-       {
-        send_http_header((request_rec *) SG(server_context));
-        }
+
+       ((request_rec *) SG(server_context))->status = SG(sapi_headers).http_response_code;
+       send_http_header((request_rec *) SG(server_context));
        return SAPI_HEADER_SENT_SUCCESSFULLY;
 }
 /* }}} */
 [2005-05-19 17:18 UTC] rasmus@php.net 
Your patch is upside down, but the idea is sound.  I'll have a look.
 [2005-05-19 21:39 UTC] rasmus@php.net 
Fixed in CVS
 [2010-08-20 12:12 UTC] petr at mail dot ru 
This patch do not allow to send any extra headers now. 
The solution is bad.
It need remove Content-Type header only.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sun Dec 22 02:01:28 2024 UTC