[ZCM] [ZC] 2233/ 6 Reject "Inconsistent Newline Handling in ZPublisher and ZServer Response HEaders"

Issue #2233 Update (Reject) "Inconsistent Newline Handling in ZPublisher and ZServer Response HEaders"
 Status Rejected, Zope/bug medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/2233

==============================================================
= Reject - Entry #6 by ajung on Jan 13, 2007 6:30 am

 Status: Pending => Rejected

Not reproducable
________________________________________
= Comment - Entry #5 by ajung on Nov 12, 2006 4:02 am

I can not reproduce that. If it would be a general issue all Plone users would have cried already..
________________________________________
= Comment - Entry #4 by sirgarr on Nov 12, 2006 3:52 am

The bug occurs in both Firefox 2.0 and Internet Explorer, running on Windows XP with the Plone sitting on a freebsd server. Zope 2.9.5.

Install a fresh Zope instance; install a Plone 2.5.1 site. (This replaces acl_users with a PAS folder.) Quit the browser and reopen; attempt to access rooturl/manage and I cannot access it, nor does an authentication dialog box appear.

PAS uses addHeader to put the WWW-Authenticate information in the response, and this is where \n\r\n pops up and breaks the page so that the HTTP authentication does not show up. When the \n is changed to \r\n in the Zope code, it works fine.
________________________________________
= Comment - Entry #3 by ajung on Nov 12, 2006 3:27 am

You must provide a reasonable description how to reproduce the error? Which browser are you using? On which OS?
________________________________________
= Edit - Entry #2 by ajung on Nov 12, 2006 3:25 am

 Changes: submitter email, importance (critical => medium)
________________________________________
= Request - Entry #1 by sirgarr on Nov 9, 2006 1:30 am

In one recent case, inconsistent newline handling in ZPublisher and ZServer caused response headers ending in

  charset=iso-8859-15\r\nWww-Authenticate: basic realm="Zope"\n\r\n

This \n\r\n killed my ability to log into the ZMI when I was running Zope (with Plone and PAS) -- but it wasn't a Plone or PAS bug, that combination simply brought out the Zope bug.

My best understanding of a fix: Replace all the \n's below with \r\n's, but I don't understand the nuances of newlines on different systems to know if this is accurate.

The relevant code:

ZPublisher\HTTPResponse.py, method setHeader, lines 256-257:
            self.accumulated_headers = (
                "%s%s: %s\n" % (self.accumulated_headers, name, value))

ZPublisher\HTTPResponse.py, method addHeader, lines 268-269:
            self.accumulated_headers = (
                "%s%s: %s\n" % (self.accumulated_headers, name, value))

ZPublisher\HTTPResponse.py, method __str__, line 870:
        return '\n'.join(headersl)

ZServer\HTTPResponse.py, method __str__, line 132:
        return '\r\n'.join(headersl)
==============================================================