Log an error when setting a custom header on "Not Modified" responses

Signed-off-by: Joas Schilling <coding@schilljs.com>

Author: nickvergessen

lib/public/AppFramework/Http/Response.php

@@ -38,6 +38,8 @@
 
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\IConfig;
+use Psr\Log\LoggerInterface;
 
 /**
  * Base class for responses. Also used to just send headers.
@@ -203,6 +205,18 @@ public function addHeader($name, $value) {
 		// to be able to reliably check for security
 		// headers
 
+		if (stripos($name, 'x-') === 0
+			&& in_array($this->status, [Http::STATUS_NO_CONTENT, Http::STATUS_NOT_MODIFIED], true)) {
+			/** @var IConfig $config */
+			$config = \OC::$server->get(IConfig::class);
+
+			if ($config->getSystemValueBool('debug', false)) {
+				\OC::$server->get(LoggerInterface::class)->error(
+					'Setting a custom header on a 204 or 304 is not supported'
+				);
+			}
+		}
+
 		if (is_null($value)) {
 			unset($this->headers[$name]);
 		} else {