[ZCM] [ZC] 1441/12 Edit "Silly Borg Headers tempt MS Office"

Fri Jul 30 17:40:32 EDT 2004

Issue #1441 Update (Edit) "Silly Borg Headers tempt MS Office"
 Status Accepted, Zope/bug critical
To followup, visit:
  http://collector.zope.org/Zope/1441

==============================================================
= Edit - Entry #12 by chrisw on Jul 30, 2004 5:40 pm

 Changes: submitter email, edited transcript, new comment

Tooo long on a bug day, need sleep...
________________________________________
= Comment - Entry #11 by chrisw on Jul 30, 2004 5:39 pm

Bingo. Spot on Chris. I debugged this but downloading an Excel file from Apache, and one from Zope and seeing what the difference was. These headers are it. Hack/patching them out as I have been for 2 years solves the problem with no ill effect.

PS: They're now gone in SVN and those changes will land in Zope 2.8 ;-)
________________________________________
= Comment - Entry #10 by mcdonc on Jul 30, 2004 5:07 pm

Er, I was never clear on how to fix this, but does what you're suggesting to fix have to do with this set of symptoms?:

http://www.plope.com/Members/chrism/ms_befuddled/view

________________________________________
= Comment - Entry #9 by chrisw on Jul 30, 2004 2:19 pm

This stuff IS going away, very shortly.

If M$ users are offended, they can add a add-broken-ms-headers switch to zope.conf and the appropriate code that only adds the broken headers when an incoming request from a broken MS client arrives.

________________________________________
= Comment - Entry #8 by ajung on Jul 30, 2004 5:39 am

see also #1368
________________________________________
= Comment - Entry #7 by ajung on Jul 30, 2004 12:43 am

As far as I can remember sending an ETAG is necessary 
for make this M$ crap happy (which is important).

But I think it should only be send out on the webdav port
and not over the standard http port (so we need to add
a check for the outgoing port first). 

In addition if you want sane HTTP header, you should add
an additional configuration  option to zope.conf that removes any M$ specific headers...maybe the one you have 
mentioned in your original posting. 

Ok, we can discuss what the default behaviour should be (with or without M$ insane headers....I don't care). The default behaviour is known to the people but it is a bit insane to provide non-compliant behaviour by default. So maybe a switch "enable-all-my-microsoft-crap-headers" would be fine for me.

________________________________________
= Comment - Entry #6 by tseaver on Jul 29, 2004 10:06 am

Uploaded:  "death-to-empty-Etag.patch"
 - http://collector.zope.org/Zope/1441/death-to-empty-Etag.patch/view
While you are at it, scrub the "stuff an emtpy E-tag in
the response headers because some MS client thought it
needed one" hack.

Given the intended semantics of E-tags, an empty one is
*far* worse than an absent one, by any sane standard.
________________________________________
= Comment - Entry #5 by chrisw on Jul 28, 2004 4:47 pm

Well, I'd invite those users to come forward and try things out! Commenting out three lines of code and restarting Zope isn't a lot to ask.

What I'd LIKE to do (and was discussed in one of those threads below) is to add a knob in zope.conf that turns off ALL WebDAV on the main server port.

But, since I don't know how to do that from a how-the-f-is-webdav-wired-into-zserver point of view, I have the current plan.

Your suggestion of a knob just to disable these headers is a good one, and I'll do it IF users come forward who are relying on this functionality. Otherwise, deleting 3 lines of code is a MUCH easier prospect.
________________________________________
= Comment - Entry #4 by Caseman on Jul 28, 2004 4:38 pm

We need to account for users/applications that rely on Zope's compatibility with MS webfolders/office DAV. At a minimum that means testing functionality with and without the changes to determine what may be lost (if any). If there is a loss as a result, then I think we need to add a nob to zope.conf (which can be off by default) that turns on an MS compatibility mode which enables the existing behavior, or some variation thereof.
________________________________________
= Resubmit - Entry #3 by chrisw on Jul 28, 2004 4:30 pm

 Status: Rejected => Accepted

Fine, well, to quote webdav.Resource.Resource:

# Note we set an borg-specific header for ie5 :( Also, we

The offensive headers are:

webdav/Resource.py - line 77:
        response.setHeader('MS-Author-Via', 'DAV')

webdav/Resource.py - line 204:
        RESPONSE.setHeader('DAV', '1,2', 1)

webdav/Collection.py - line 47:
        response.setHeader('MS-Author-Via', 'DAV')

The symptoms are that anonymously accessible file objects storing things like Excel and Word documents pop up an MS Office auth box when accessed via IE on computers where MS Office is 2000 or above is installed.

Here's the tail of suffering:
http://mail.zope.org/pipermail/zope-coders/2002-January/000619.html
http://mail.zope.org/pipermail/zope/2002-January/106982.html
http://mail.zope.org/pipermail/zope-coders/2002-August/001648.html
http://mail.zope.org/pipermail/zope/2004-July/152055.html

I couldn't find my original post about the problem in 2001, I think it got eaten when the old collector died.

3 years of suffering is enough, like I said, provide compelling reasons for these headers to stay or they go on Friday.
________________________________________
= Reject - Entry #2 by Caseman on Jul 28, 2004 3:27 pm

 Status: Accepted => Rejected

No offense Chris, but this is the vaguest critical bug I have yet experienced in the Zope collector. Please write a bug report that actually specifies what is wrong and what you think should be done to fix it.

I think I know what you are refering to, and I agree that what I think you are talking about should addressed. Please write a bug report that identifies the specific problem, preferably without offending an entire fictional civilization, regardless of how different their fictional ideals might be to ours (fictional or otherwise).
________________________________________
= Request - Entry #1 by chrisw on Jul 28, 2004 1:48 pm

 Status: Pending => Accepted

 Supporters added: chrisw

Several silly Borg headers are still being sent by Zope. I'm sick and tired of having to patch every release to get rid of this whenever I want to serve office files files to anymous users.

Unless I hear very compelling reasons to keep them, they're going in this Friday's bug day...
==============================================================