Bogus If-Modified-Since header causes 500 in django.views.static.serve

[Antti Kaihola]

Every now and then I get requests with a bogus If-Modified-Since header like

If-Modified-Since: Fri, 34 Feb 3118 24:34:19 GMT

These cause a server error.

Since invalid dates are most certainly only used by malicious clients, it would probably be safe to respond with a "not modified" HTTP response.

[Antti Kaihola]

Fix and tests: handle bogus If-Modified-Since headers gracefully

[Antti Kaihola]

The patch fixes the server error by responding with "not modified" to requests with a bogus If-Modified-Since value. It also adds test cases for If-Modified-Since values

• which are earlier than the mtime of the file
• which are later than the mtime of the file
• which are invalid

[Antti Kaihola]

On a second thought, I haven't checked what RFCs say about handling bogus timestamps, and maybe it would be wiser to respond with "has been modified" just in case there are legitimate broken clients out there. Thoughts?

[Antti Kaihola]

Checked the ​RFC:

      a) If the request would normally result in anything other than a
         200 (OK) status, or if the passed If-Modified-Since date is
         invalid, the response is exactly the same as for a normal GET.
         A date which is later than the server's current time is
         invalid.

Fixed patch upcoming...

[Antti Kaihola]

Fixed to comply with RFC 2616 section 14.25

[Jannis Leidel]

The patch doesn't work for me, e.g. mktime_tz doesn't raise an OverflowError for me.

[Jannis Leidel]

(In [13870]) Fixed #12544 and #13600 -- Fixed static files serving view to catch invalid date from If-Modified-Since header. Thanks akaihola and SmileyChris for patches.

[Jannis Leidel]

(In [13871]) Fixed #12544 and #13600 -- Fixed static files serving view to catch invalid date from If-Modified-Since header. Thanks akaihola and SmileyChris for patches.

Backport from trunk (r13870).