December 2009 - jbossweb-commits - Jboss List Archives

JBossWeb SVN: r1341 - trunk/webapps/docs.

by jbossweb-commits＠lists.jboss.org

Author: remy.maucherat(a)jboss.com Date: 2009-12-15 08:08:47 -0500 (Tue, 15 Dec 2009) New Revision: 1341 Modified: trunk/webapps/docs/changelog.xml Log: - Cleanup changelog a bit, although it doesn't really mean anything. Modified: trunk/webapps/docs/changelog.xml =================================================================== --- trunk/webapps/docs/changelog.xml 2009-12-15 01:59:12 UTC (rev 1340) +++ trunk/webapps/docs/changelog.xml 2009-12-15 13:08:47 UTC (rev 1341) @@ -22,10 +22,13 @@ <update> Servlet 3.0 API. (remm) </update> - <fix> - Fix CVE-2009-3555, man-in-the-middle attack in TLS protocol. (markt) - </fix> <update> + JSP 2.2 API. (remm) + </update> + <update> + EL 1.2 API. (remm) + </update> + <update> Commons Pool 1.5.2. (markt) </update> </changelog> @@ -123,9 +126,6 @@ <fix> <bug>37984</bug>: Strip {MD5} as well as {SHA} from digested passwords. (markt) </fix> - <add> - All other Servlet 3.0 features. (remm) - </add> <fix> <bug>41059</bug>: Reduce one possible source of errors if using ENABLE_CLEAR_REFERENCES=true. Patch by Curt Arnold. (markt) @@ -188,10 +188,19 @@ <fix> <bug>46950</bug>: Fix SSL renegociation problems. (jfclere) </fix> + <fix> + Fix CVE-2009-3555, man-in-the-middle attack in TLS protocol. (markt) + </fix> </changelog> </subsection> <subsection name="Jasper"> <changelog> + <add> + Embedded Jasper, TLDs are now processed by the Servlet container. (remm) + </add> + <update> + Remove Jasper JSP precompiler. (remm) + </update> <fix> <bug>46915</bug>: JSTL issues resolving resource bundle keys. (markt) </fix>

14 years, 4 months

1
0
0 / 0

JBossWeb SVN: r1340 - trunk/java/org/apache/el/parser.

by jbossweb-commits＠lists.jboss.org

Author: remy.maucherat(a)jboss.com Date: 2009-12-14 20:59:12 -0500 (Mon, 14 Dec 2009) New Revision: 1340 Modified: trunk/java/org/apache/el/parser/AstValue.java Log: - Another guard, just in case. Modified: trunk/java/org/apache/el/parser/AstValue.java =================================================================== --- trunk/java/org/apache/el/parser/AstValue.java 2009-12-14 22:51:27 UTC (rev 1339) +++ trunk/java/org/apache/el/parser/AstValue.java 2009-12-15 01:59:12 UTC (rev 1340) @@ -182,7 +182,7 @@ Object[] paramValues) throws ELException { Target t = getTarget(ctx); Object[] params = null; - if (this.children[1] instanceof AstDotSuffix) { + if (jjtGetNumChildren() > 1 && this.children[1] instanceof AstDotSuffix) { params = ((AstDotSuffix) this.children[1]).getParameters(ctx); } Object result = null;

14 years, 4 months

1
0
0 / 0

JBossWeb SVN: r1339 - trunk/java/org/apache/el/parser.

by jbossweb-commits＠lists.jboss.org

Author: remy.maucherat(a)jboss.com Date: 2009-12-14 17:51:27 -0500 (Mon, 14 Dec 2009) New Revision: 1339 Modified: trunk/java/org/apache/el/parser/AstValue.java Log: - Fix NPE regression. Modified: trunk/java/org/apache/el/parser/AstValue.java =================================================================== --- trunk/java/org/apache/el/parser/AstValue.java 2009-12-14 17:42:51 UTC (rev 1338) +++ trunk/java/org/apache/el/parser/AstValue.java 2009-12-14 22:51:27 UTC (rev 1339) @@ -126,7 +126,7 @@ if (this.children[i] instanceof AstDotSuffix) { params = ((AstDotSuffix) this.children[i]).getParameters(ctx); } - if (params.length > 0) { + if (params != null && params.length > 0) { ctx.setPropertyResolved(false); base = resolver.invoke(ctx, base, property, null, params); } else { @@ -186,7 +186,7 @@ params = ((AstDotSuffix) this.children[1]).getParameters(ctx); } Object result = null; - if (params.length > 0) { + if (params != null && params.length > 0) { ELResolver resolver = ctx.getELResolver(); ctx.setPropertyResolved(false); result = resolver.invoke(ctx, t.base, t.property, null, params);

14 years, 4 months

1
0
0 / 0

JBossWeb SVN: r1338 - tags.

by jbossweb-commits＠lists.jboss.org

Author: remy.maucherat(a)jboss.com Date: 2009-12-14 12:42:51 -0500 (Mon, 14 Dec 2009) New Revision: 1338 Added: tags/JBOSSWEB_3_0_0_ALPHA25/ Log: - EL parameters. - Fixes and additions in Servlets. Copied: tags/JBOSSWEB_3_0_0_ALPHA25 (from rev 1337, trunk)

14 years, 4 months

1
0
0 / 0

JBossWeb SVN: r1332 - in trunk/java/org/apache/catalina: deploy and 1 other directory.

by jbossweb-commits＠lists.jboss.org

Author: remy.maucherat(a)jboss.com Date: 2009-12-11 11:41:24 -0500 (Fri, 11 Dec 2009) New Revision: 1332 Modified: trunk/java/org/apache/catalina/core/StandardWrapper.java trunk/java/org/apache/catalina/deploy/FilterDef.java Log: - Ignore second occurence when the name occurs more than once in the same descriptor. Modified: trunk/java/org/apache/catalina/core/StandardWrapper.java =================================================================== --- trunk/java/org/apache/catalina/core/StandardWrapper.java 2009-12-10 15:15:31 UTC (rev 1331) +++ trunk/java/org/apache/catalina/core/StandardWrapper.java 2009-12-11 16:41:24 UTC (rev 1332) @@ -869,7 +869,8 @@ public void addInitParameter(String name, String value) { synchronized (parameters) { - parameters.put(name, value); + if (!parameters.containsKey(name)) + parameters.put(name, value); } fireContainerEvent("addInitParameter", name); Modified: trunk/java/org/apache/catalina/deploy/FilterDef.java =================================================================== --- trunk/java/org/apache/catalina/deploy/FilterDef.java 2009-12-10 15:15:31 UTC (rev 1331) +++ trunk/java/org/apache/catalina/deploy/FilterDef.java 2009-12-11 16:41:24 UTC (rev 1332) @@ -162,7 +162,8 @@ * @param value The initialization parameter value */ public void addInitParameter(String name, String value) { - parameters.put(name, value); + if (!parameters.containsKey(name)) + parameters.put(name, value); }

14 years, 4 months

1
0
0 / 0

JBossWeb SVN: r1331 - tags.

by jbossweb-commits＠lists.jboss.org

Author: remy.maucherat(a)jboss.com Date: 2009-12-10 10:15:31 -0500 (Thu, 10 Dec 2009) New Revision: 1331 Added: tags/JBOSSWEB_3_0_0_ALPHA23/ Log: - New build. - Servlet fixes. - Revert JSP patch. Copied: tags/JBOSSWEB_3_0_0_ALPHA23 (from rev 1330, trunk)

14 years, 4 months

1
0
0 / 0

JBossWeb SVN: r1330 - trunk/java/org/apache/catalina/deploy.

by jbossweb-commits＠lists.jboss.org

Author: remy.maucherat(a)jboss.com Date: 2009-12-10 09:00:48 -0500 (Thu, 10 Dec 2009) New Revision: 1330 Modified: trunk/java/org/apache/catalina/deploy/SecurityConstraint.java Log: - All roles constraints actually always require authentication. Modified: trunk/java/org/apache/catalina/deploy/SecurityConstraint.java =================================================================== --- trunk/java/org/apache/catalina/deploy/SecurityConstraint.java 2009-12-09 17:11:00 UTC (rev 1329) +++ trunk/java/org/apache/catalina/deploy/SecurityConstraint.java 2009-12-10 14:00:48 UTC (rev 1330) @@ -190,6 +190,7 @@ if (authRole == null) return; + authConstraint = true; if ("*".equals(authRole)) { allRoles = true; return; @@ -199,7 +200,6 @@ results[i] = authRoles[i]; results[authRoles.length] = authRole; authRoles = results; - authConstraint = true; }

14 years, 4 months

1
0
0 / 0

JBossWeb SVN: r1329 - trunk/java/org/apache/catalina/startup.

by jbossweb-commits＠lists.jboss.org

Author: remy.maucherat(a)jboss.com Date: 2009-12-09 12:11:00 -0500 (Wed, 09 Dec 2009) New Revision: 1329 Modified: trunk/java/org/apache/catalina/startup/ContextConfig.java Log: - Fix big ooops: empty roles permit means allRoles only if there are really no roles ... Modified: trunk/java/org/apache/catalina/startup/ContextConfig.java =================================================================== --- trunk/java/org/apache/catalina/startup/ContextConfig.java 2009-12-09 12:37:21 UTC (rev 1328) +++ trunk/java/org/apache/catalina/startup/ContextConfig.java 2009-12-09 17:11:00 UTC (rev 1329) @@ -2133,7 +2133,7 @@ if (methodDA) { constraint.setAuthConstraint(true); } - if (methodPA) { + if (methodPA && (methodRA == null || methodRA.length == 0)) { constraint.addAuthRole("*"); } if (methodRA != null) { @@ -2169,7 +2169,7 @@ { // Define a constraint for the class SecurityConstraint constraint = new SecurityConstraint(); - if (classPA) { + if (classPA && (classRA == null || classRA.length == 0)) { constraint.addAuthRole("*"); } if (classDA) {

14 years, 4 months

1
0
0 / 0

JBossWeb SVN: r1328 - in trunk/java/org/apache/catalina: realm and 1 other directory.

by jbossweb-commits＠lists.jboss.org

Author: remy.maucherat(a)jboss.com Date: 2009-12-09 07:37:21 -0500 (Wed, 09 Dec 2009) New Revision: 1328 Modified: trunk/java/org/apache/catalina/authenticator/BasicAuthenticator.java trunk/java/org/apache/catalina/authenticator/Constants.java trunk/java/org/apache/catalina/authenticator/DigestAuthenticator.java trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java trunk/java/org/apache/catalina/authenticator/SSLAuthenticator.java trunk/java/org/apache/catalina/authenticator/SingleSignOnEntry.java trunk/java/org/apache/catalina/realm/JAASMemoryLoginModule.java trunk/java/org/apache/catalina/realm/JAASRealm.java Log: - Set the auth type using the API's constant, as the javadoc says they should be comparable with ==. (??) Modified: trunk/java/org/apache/catalina/authenticator/BasicAuthenticator.java =================================================================== --- trunk/java/org/apache/catalina/authenticator/BasicAuthenticator.java 2009-12-08 22:19:08 UTC (rev 1327) +++ trunk/java/org/apache/catalina/authenticator/BasicAuthenticator.java 2009-12-09 12:37:21 UTC (rev 1328) @@ -22,6 +22,7 @@ import java.io.IOException; import java.security.Principal; +import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.apache.catalina.connector.Request; @@ -178,7 +179,7 @@ principal = context.getRealm().authenticate(username, password); if (principal != null) { - register(request, response, principal, Constants.BASIC_METHOD, + register(request, response, principal, HttpServletRequest.BASIC_AUTH, username, password); return (true); } Modified: trunk/java/org/apache/catalina/authenticator/Constants.java =================================================================== --- trunk/java/org/apache/catalina/authenticator/Constants.java 2009-12-08 22:19:08 UTC (rev 1327) +++ trunk/java/org/apache/catalina/authenticator/Constants.java 2009-12-09 12:37:21 UTC (rev 1328) @@ -24,10 +24,6 @@ public static final String Package = "org.apache.catalina.authenticator"; // Authentication methods for login configuration - public static final String BASIC_METHOD = "BASIC"; - public static final String CERT_METHOD = "CLIENT_CERT"; - public static final String DIGEST_METHOD = "DIGEST"; - public static final String FORM_METHOD = "FORM"; public static final String LOGIN_METHOD = "LOGIN"; // User data constraints for transport guarantee Modified: trunk/java/org/apache/catalina/authenticator/DigestAuthenticator.java =================================================================== --- trunk/java/org/apache/catalina/authenticator/DigestAuthenticator.java 2009-12-08 22:19:08 UTC (rev 1327) +++ trunk/java/org/apache/catalina/authenticator/DigestAuthenticator.java 2009-12-09 12:37:21 UTC (rev 1328) @@ -25,6 +25,7 @@ import java.security.Principal; import java.util.StringTokenizer; +import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.apache.catalina.Realm; @@ -174,7 +175,7 @@ if (principal != null) { String username = parseUsername(authorization); register(request, response, principal, - Constants.DIGEST_METHOD, + HttpServletRequest.DIGEST_AUTH, username, null); return (true); } Modified: trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java =================================================================== --- trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java 2009-12-08 22:19:08 UTC (rev 1327) +++ trunk/java/org/apache/catalina/authenticator/FormAuthenticator.java 2009-12-09 12:37:21 UTC (rev 1328) @@ -28,6 +28,7 @@ import javax.servlet.RequestDispatcher; import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.apache.catalina.Realm; @@ -172,7 +173,7 @@ session.setNote(Constants.FORM_PRINCIPAL_NOTE, principal); if (!matchRequest(request)) { register(request, response, principal, - Constants.FORM_METHOD, + HttpServletRequest.FORM_AUTH, username, password); return (true); } @@ -192,7 +193,7 @@ + "'"); principal = (Principal) session.getNote(Constants.FORM_PRINCIPAL_NOTE); - register(request, response, principal, Constants.FORM_METHOD, + register(request, response, principal, HttpServletRequest.FORM_AUTH, (String) session.getNote(Constants.SESS_USERNAME_NOTE), (String) session.getNote(Constants.SESS_PASSWORD_NOTE)); // If we're caching principals we no longer need the username Modified: trunk/java/org/apache/catalina/authenticator/SSLAuthenticator.java =================================================================== --- trunk/java/org/apache/catalina/authenticator/SSLAuthenticator.java 2009-12-08 22:19:08 UTC (rev 1327) +++ trunk/java/org/apache/catalina/authenticator/SSLAuthenticator.java 2009-12-09 12:37:21 UTC (rev 1328) @@ -23,6 +23,7 @@ import java.security.Principal; import java.security.cert.X509Certificate; +import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.apache.catalina.Globals; @@ -155,7 +156,7 @@ } // Cache the principal (if requested) and record this authentication - register(request, response, principal, Constants.CERT_METHOD, + register(request, response, principal, HttpServletRequest.CLIENT_CERT_AUTH, null, null); return (true); Modified: trunk/java/org/apache/catalina/authenticator/SingleSignOnEntry.java =================================================================== --- trunk/java/org/apache/catalina/authenticator/SingleSignOnEntry.java 2009-12-08 22:19:08 UTC (rev 1327) +++ trunk/java/org/apache/catalina/authenticator/SingleSignOnEntry.java 2009-12-09 12:37:21 UTC (rev 1328) @@ -18,8 +18,9 @@ import java.security.Principal; +import javax.servlet.http.HttpServletRequest; + import org.apache.catalina.Session; -import org.apache.catalina.authenticator.Constants; /** * A class that represents entries in the cache of authenticated users. @@ -183,8 +184,8 @@ this.username = username; this.password = password; this.canReauthenticate = - (Constants.BASIC_METHOD.equals(authType) - || Constants.FORM_METHOD.equals(authType)); + (HttpServletRequest.BASIC_AUTH.equals(authType) + || HttpServletRequest.FORM_AUTH.equals(authType)); } } Modified: trunk/java/org/apache/catalina/realm/JAASMemoryLoginModule.java =================================================================== --- trunk/java/org/apache/catalina/realm/JAASMemoryLoginModule.java 2009-12-08 22:19:08 UTC (rev 1327) +++ trunk/java/org/apache/catalina/realm/JAASMemoryLoginModule.java 2009-12-09 12:37:21 UTC (rev 1328) @@ -36,6 +36,7 @@ import javax.security.auth.login.FailedLoginException; import javax.security.auth.login.LoginException; import javax.security.auth.spi.LoginModule; +import javax.servlet.http.HttpServletRequest; import org.apache.catalina.Context; import org.apache.catalina.Realm; @@ -354,10 +355,10 @@ if (authMethod == null) { // BASIC or FORM principal = super.authenticate(username, password); - } else if (authMethod.equals(Constants.DIGEST_METHOD)) { + } else if (authMethod.equals(HttpServletRequest.DIGEST_AUTH)) { principal = super.authenticate(username, password, nonce, nc, cnonce, qop, realmName, md5a2); - } else if (authMethod.equals(Constants.CERT_METHOD)) { + } else if (authMethod.equals(HttpServletRequest.CLIENT_CERT_AUTH)) { principal = super.getPrincipal(username); } else { throw new LoginException("Unknown authentication method"); Modified: trunk/java/org/apache/catalina/realm/JAASRealm.java =================================================================== --- trunk/java/org/apache/catalina/realm/JAASRealm.java 2009-12-08 22:19:08 UTC (rev 1327) +++ trunk/java/org/apache/catalina/realm/JAASRealm.java 2009-12-09 12:37:21 UTC (rev 1328) @@ -31,6 +31,7 @@ import javax.security.auth.login.FailedLoginException; import javax.security.auth.login.LoginContext; import javax.security.auth.login.LoginException; +import javax.servlet.http.HttpServletRequest; import org.apache.catalina.Container; import org.apache.catalina.LifecycleException; @@ -345,7 +346,7 @@ return authenticate(username, new JAASCallbackHandler(this, username, clientDigest, nonce, nc, cnonce, qop, realmName, md5a2, - Constants.DIGEST_METHOD)); + HttpServletRequest.DIGEST_AUTH)); } @@ -471,7 +472,7 @@ return authenticate(username, new JAASCallbackHandler(this, username, null, null, null, null, - null, null, null, Constants.CERT_METHOD)); + null, null, null, HttpServletRequest.CLIENT_CERT_AUTH)); }

14 years, 4 months

1
0
0 / 0

JBossWeb SVN: r1327 - branches/JBOSSWEB_2_0_0_GA_CP11_JBPAPP-3233/src/share/classes/org/apache/catalina/connector.

by jbossweb-commits＠lists.jboss.org

Author: mmillson Date: 2009-12-08 17:19:08 -0500 (Tue, 08 Dec 2009) New Revision: 1327 Modified: branches/JBOSSWEB_2_0_0_GA_CP11_JBPAPP-3233/src/share/classes/org/apache/catalina/connector/CoyoteAdapter.java Log: Fix parent context cookie overwriting URL encoded cookie for [JBWEB-153] Modified: branches/JBOSSWEB_2_0_0_GA_CP11_JBPAPP-3233/src/share/classes/org/apache/catalina/connector/CoyoteAdapter.java =================================================================== --- branches/JBOSSWEB_2_0_0_GA_CP11_JBPAPP-3233/src/share/classes/org/apache/catalina/connector/CoyoteAdapter.java 2009-12-08 22:18:50 UTC (rev 1326) +++ branches/JBOSSWEB_2_0_0_GA_CP11_JBPAPP-3233/src/share/classes/org/apache/catalina/connector/CoyoteAdapter.java 2009-12-08 22:19:08 UTC (rev 1327) @@ -500,6 +500,13 @@ */ protected void parseSessionCookiesId(org.apache.coyote.Request req, Request request) { + // If session tracking via cookies has been disabled for the current + // context, don't go looking for a session ID in a cookie as a cookie + // from a parent context with a session ID may be present which would + // overwrite the valid session ID encoded in the URL + if (!((Context)request.getMappingData().context).getCookies()) + return; + // Parse session id from cookies Cookies serverCookies = req.getCookies(); int count = serverCookies.getCookieCount();

14 years, 5 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

jbossweb-commits December 2009