Re: Error log diving (was: Re: [Fwd: Software error:])

* Ville Skyttä wrote:
>Anyway, there are 46 "Malformed multipart POST" and "Malformed multipart
>POST: data truncated" entries in today's error log, but unfortunately
>there doesn't seem to be anything terribly interesting nearby.  Samples
>(as well as POST examples with the same timestamp from access log, or
>complete_log as it's called on v.w.o) with IP addresses masked:
>
>  [Sat May 22 14:41:28 2004] check: Malformed multipart POST: data truncated
>  [Sat May 22 14:50:08 2004] check: Malformed multipart POST
>
>  2004-05-22T14:41:28Z 200 7054 na /usr/local/validator/httpd/cgi-bin/check xxx.xxx.xxx.xxx - "POST /check HTTP/1.1" "http://validator.w3.org/" "text/html" "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)" "validator.w3.org"
>  2004-05-22T14:41:28Z 200 265 na /usr/local/validator/httpd/cgi-bin/check yyy.yyy.yyy.yyy - "POST /check HTTP/1.1" "-" "text/html" "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) Opera 7.23  [en]" "validator.w3.org"
>  2004-05-22T14:50:08Z 200 249 na /usr/local/validator/httpd/cgi-bin/check xxx.xxx.xxx.xxx - "POST /check HTTP/1.1" "http://validator.w3.org/" "text/html" "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)" "validator.w3.org"
>
>Note that the response status has been 200 for all those POSTs.  There
>are also quite a few some weird error log entries, not necessarily near
>the above, like:
>
>  [Sat May 22 16:22:12 2004] [error] [client zzz.zzz.zzz.zzz] request failed: erroneous characters after protocol string: t reproduce in part or whole without permission.<br>

Thanks to Leevi Seinälä I was able to track this down (assuming that's
the same issue) and filed Opera bug #208912; the problem is that, when
uploading a file, changing the file, and re-load the page so Opera re-
uploads the document, it sets the Content-Length incorrectly. I hope
this will be fixed before Opera9 is released; we should probably check
the logs some time again for malformed POSTs that do not originate from
Opera. And btw, the Webmaster probably does not get any more mails about
this because we don't specify a contact address anymore...
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Weinh. Str. 22 · Telefon: +49(0)621/4309674 · http://www.bjoernsworld.de
68309 Mannheim · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

Received on Tuesday, 16 May 2006 18:01:47 UTC