Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-13414

download/file.php sends Content-Length header even when issuing 304 Not Modified

    Details

    • Type: Bug
    • Status: Unverified Fix
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 3.0.12
    • Fix Version/s: 3.0.14-RC1, 3.1.4-RC1
    • Component/s: Other, Viewing posts
    • Labels:
      None
    • Environment:
      PHP 5.5.18, nginx 1.7.6/1.7.7

      Description

      phpbb 3.0.12

      download/file.php returns Content-Length header (with non-zero value) even if after it it returns 304 Not Modified. Which resulting to connection stuck until keepalive timeouts when server is nginx+php-fpm with keepalive_timeout > 0

      There should not be Content-Length header at all if 304 is returned.

        Activity

        Hide
        nickvergessen Joas Schilling added a comment -

        Can you test, whether this happens on 3.1.2 aswell?

        Show
        nickvergessen Joas Schilling added a comment - Can you test, whether this happens on 3.1.2 aswell?
        Hide
        Semik Semen Panevin [X] (Inactive) added a comment - - edited

        this part of code in 3.1.2 is the same, so I don't think that behavior is different.

        But I don't have 3.1.2 installation. My 3.0.12 has enough amount of mods which I can't easily convert to 3.1 extensions... and I haven't had extra time to try clean 3.1.2

        Show
        Semik Semen Panevin [X] (Inactive) added a comment - - edited this part of code in 3.1.2 is the same, so I don't think that behavior is different. But I don't have 3.1.2 installation. My 3.0.12 has enough amount of mods which I can't easily convert to 3.1 extensions... and I haven't had extra time to try clean 3.1.2
        Hide
        Marc Marc added a comment -

        Can you please explain how we can reproduce this?
        file.php can only return a 304 with the function set_modified_headers(). Once the 304 is triggered, $exit is set to true in file.php. This should also prevent it from sending the Content-Length.

        Show
        Marc Marc added a comment - Can you please explain how we can reproduce this? file.php can only return a 304 with the function set_modified_headers(). Once the 304 is triggered, $exit is set to true in file.php. This should also prevent it from sending the Content-Length.
        Hide
        Semik Semen Panevin [X] (Inactive) added a comment - - edited

        https://github.com/phpbb/phpbb/blob/040d451dcca9ae54d8f4b7bdd2f231033765a8f2/phpBB/includes/functions_download.php#L213

        it's obvious that content-length header is set BEFORE set_modified_headers()

        and there is no code inside set_modified_headers() which cleans headers which were set before.

        The fix is very simple: just move

        if ($size)

        { header("Content-Length: $size"); }

        a few lines lower, right after "if (!set_modified_headers){"

        Show
        Semik Semen Panevin [X] (Inactive) added a comment - - edited https://github.com/phpbb/phpbb/blob/040d451dcca9ae54d8f4b7bdd2f231033765a8f2/phpBB/includes/functions_download.php#L213 it's obvious that content-length header is set BEFORE set_modified_headers() and there is no code inside set_modified_headers() which cleans headers which were set before. The fix is very simple: just move if ($size) { header("Content-Length: $size"); } a few lines lower, right after "if (!set_modified_headers){"
        Show
        bantu Andreas Fischer added a comment - http://trac.nginx.org/nginx/ticket/459 links to http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.5 and http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.3

          People

          • Assignee:
            Marc Marc
            Reporter:
            Semik Semen Panevin [X] (Inactive)
          • Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development