general/2209: CGI script with last-modified gives empty 200 response

[Darrell Kidnred <dk...@cs.cmu.edu>]

>Number:         2209
>Category:       general
>Synopsis:       CGI script with last-modified gives empty 200 response
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Sun May 10 14:10:00 PDT 1998
>Last-Modified:
>Originator:     dkindred=apachebug@cs.cmu.edu
>Organization:
apache
>Release:        1.3b6
>Environment:
Digital Unix 4.0, gcc
(but that's irrelevant)
>Description:
When an If-Modified-Since request for a CGI script is processed,
and the I-M-S date matches the Last-Modified date provided by the
script, apache transmits the normal status line as given by the script
(e.g., "200 OK") but doesn't transmit the body.  This causes browsers
to choke with "document contains no data" or the like.
>How-To-Repeat:
Write a CGI script that provides a last-modified header like
  Last-Modified: Sun, 04 Jun 1995 17:36:33 GMT
along with a normal document and status "200 OK".
Then send a request like this:
  GET /cgi-bin/testscript HTTP/1.0
  If-Modified-Since: Sun, 04 Jun 1995 17:36:33 GMT

Apache will respond with
  HTTP/1.1 200 OK
  Date: Sun, 10 May 1998 18:50:47 GMT
  Server: Apache/1.3b6
  Connection: close

and no further data.  The correct behavior would be to give a
"304 Not Modified" header.
>Fix:
The following patch takes care of it, and looks right to me.
I haven't worked with this code before, so someone familiar with
the code should sanity-check my fix.

Basically, what's happening is that ap_die is setting the request's status
to 304 but it doesn't change the status_line accordingly.  The fixed version
sets the status_line to NULL so it will be provided automatically by
ap_basic_http_header.

--- src/main/http_request.c.orig        Mon Apr 13 14:05:11 1998
+++ src/main/http_request.c     Sun May 10 14:58:46 1998
@@ -889,6 +889,7 @@
     }
 
     r->status = type;
+    r->status_line = NULL;    /* ap_basic_http_header will fill this in. */
 
     /*
      * This test is done here so that none of the auth modules needs to know
>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, ]
[you need to include <ap...@Apache.Org> in the Cc line ]
[and leave the subject line UNCHANGED.  This is not done]
[automatically because of the potential for mail loops. ]