Bug#850885: apache2: Using dwww, fails with internal server error when trying to access /usr/share/doc

[Stefan Fritsch]

reassign 850885 dwww
severity 850885 grave
tags 850885 patch
thanks

On Thursday, 12 January 2017 06:50:16 CET Arjan Opmeer wrote:
> > is correct however, here's the HTTP header part:
> > Content-type: text/html
> > Last modified: Tue Dec 13 14:16:35 2016
> > Content-Disposition: inline; filename="index.html"
> 
> Actually the header should read "Last-Modified" (note spelling). After
> patching the dwww script to emit the correct header the error no longer
> occurs with Apache. Therefore I believe the bug should be reassigned to
> dwww.

Exactly. "Last modified" (with a space) is not HTTP compliant as a header name.

> I will reply to the corresponding dwww bug report (#781987) with the fix I
> applied to the dwww script.

I don't think the original issue reported in #781987 is the same issue. But 
the patch you posted there looks ok for this issue (#850885). I am therefore 
reassigning the bug to dwww.

Cheers,
Stefan

Bug#850885: apache2: Using dwww, fails with internal server error when trying to access /usr/share/doc

[Arjan Opmeer]

I ran into the same problem and started investigating.

On Tue, 10 Jan 2017 22:01:45 +0100 Jerome  wrote:
> 
> When looking at the Apache log, the following entry can be found:
> 
> [Fri Jan 06 21:34:53.830541 2017] [http:error] [pid 6785:tid
> 140419151554304] [client ::1:45220] AH02429: Response header name
> 'Last modified' contains invalid characters, aborting request,
> referer: http://localhost/dwww/
> 
> When calling the dwww CGI script manually, the 'Last modified' field
> is correct however, here's the HTTP header part:
> 
> Content-type: text/html
> Last modified: Tue Dec 13 14:16:35 2016
> Content-Disposition: inline; filename="index.html"

Actually the header should read "Last-Modified" (note spelling). After
patching the dwww script to emit the correct header the error no longer
occurs with Apache. Therefore I believe the bug should be reassigned to
dwww.

I will reply to the corresponding dwww bug report (#781987) with the fix I
applied to the dwww script.


Arjan

Bug#850885: apache2: Using dwww, fails with internal server error when trying to access /usr/share/doc

[Jerome]

Package: apache2
Version: 2.4.25-1
Severity: normal

Dear Maintainer,

Upgrading from jessie to stretch partially broke the package "dwww" when
using apache2 as web server. dwww is a CGI web application allowing
easy access to the Debian documentation. Its entry page still works on
stretch, but when trying to access any resource under /usr/share/doc
through dwww, Apache returns an "500 Internal Server Error".

To reproduce the problem one just has to go to http://localhost/dwww,
and click on the top menu link for "/usr/share/doc".

When looking at the Apache log, the following entry can be found:

[Fri Jan 06 21:34:53.830541 2017] [http:error] [pid 6785:tid
140419151554304] [client ::1:45220] AH02429: Response header name
'Last modified' contains invalid characters, aborting request,
referer: http://localhost/dwww/

When calling the dwww CGI script manually, the 'Last modified' field
is correct however, here's the HTTP header part:

Content-type: text/html
Last modified: Tue Dec 13 14:16:35 2016
Content-Disposition: inline; filename="index.html"

When using the very same dwww application with another web server (I
tried lighttpd), it works fine as before so the issue is related to
Apache.

Compared to a default apache2 configuration, I just enabled the cgid
module as well as the dwww, dhelp and dpkg-dwww configurations. No
other changes under /etc/apache2. 

Thanks

-- Package-specific info:

-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.8.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages apache2 depends on:
ii  apache2-bin  2.4.25-1
ii  apache2-data 2.4.25-1
ii  apache2-utils2.4.25-1
ii  dpkg 1.18.18
ii  init-system-helpers  1.46
ii  lsb-base 9.20161125
ii  mime-support 3.60
ii  perl 5.24.1~rc4-1
pn  perl:any 
ii  procps   2:3.3.12-3

Versions of packages apache2 recommends:
ii  ssl-cert  1.0.38

Versions of packages apache2 suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  chromium [www-browser]   55.0.2883.75-3
ii  konqueror [www-browser]  4:16.08.3-1
ii  w3m [www-browser]0.5.3-33

Versions of packages apache2-bin depends on:
ii  libapr1  1.5.2-5
ii  libaprutil1  1.5.4-3
ii  libaprutil1-dbd-sqlite3  1.5.4-3
ii  libaprutil1-ldap 1.5.4-3
ii  libc62.24-8
ii  libldap-2.4-22.4.44+dfsg-2
ii  liblua5.2-0  5.2.4-1.1+b1
ii  libnghttp2-141.17.0-1
ii  libpcre3 2:8.39-2
ii  libssl1.0.2  1.0.2j-4
ii  libxml2  2.9.4+dfsg1-2.1
pn  perl:any 
ii  zlib1g   1:1.2.8.dfsg-4

Versions of packages apache2-bin suggests:
pn  apache2-doc  
pn  apache2-suexec-pristine | apache2-suexec-custom  
ii  chromium [www-browser]   55.0.2883.75-3
ii  konqueror [www-browser]  4:16.08.3-1
ii  w3m [www-browser]0.5.3-33

Versions of packages apache2 is related to:
ii  apache2  2.4.25-1
ii  apache2-bin  2.4.25-1

-- no debconf information