Author: alex.guizar(a)jboss.com Date: 2009-06-10 08:09:38 -0400 (Wed, 10 Jun 2009) New Revision: 5022 Modified: projects/jsf-console/branches/jsf-console-3.2-soa/console/src/main/webapp/WEB-INF/web.xml projects/jsf-console/branches/jsf-console-3.2-soa/soa/src/main/webapp/WEB-INF/web.xml Log: JBPM-1958: Security issue allows arbitrary java code to be deployed and executed (REOPENED) Reenable upload servlet in SOA overlay and move it back to the secure area Modified: projects/jsf-console/branches/jsf-console-3.2-soa/console/src/main/webapp/WEB-INF/web.xml =================================================================== --- projects/jsf-console/branches/jsf-console-3.2-soa/console/src/main/webapp/WEB-INF/web.xml 2009-06-10 09:53:23 UTC (rev 5021) +++ projects/jsf-console/branches/jsf-console-3.2-soa/console/src/main/webapp/WEB-INF/web.xml 2009-06-10 12:09:38 UTC (rev 5022) @@ -83,7 +83,7 @@ </auth-constraint> </security-constraint> - <!-- Example Login page - lists user names --> + <!-- Example Login page - lists sample users --> <login-config> <auth-method>FORM</auth-method> <form-login-config> @@ -121,10 +121,9 @@ <!-- Bootstrap listener ==> <listener> <description> - Force initialization of the hibernate session factory. - This will create the DB tables on new installations, - provided that the hibernate.hbm2ddl.auto property - is set to "create". + Builds the Hibernate session factory on initialization. + This will create the database tables in new installations, + provided the hibernate.hbm2ddl.auto property is set. </description> <listener-class>org.jbpm.web.BootstrapListener</listener-class> </listener> @@ -132,7 +131,7 @@ <listener> <description> - Closes the jBPM configuration on destruction, releasing application resources. + Closes the jBPM configuration on destruction, releasing resources. This listener should appear after the job executor launcher, to avoid reopening the configuration. </description> Modified: projects/jsf-console/branches/jsf-console-3.2-soa/soa/src/main/webapp/WEB-INF/web.xml =================================================================== --- projects/jsf-console/branches/jsf-console-3.2-soa/soa/src/main/webapp/WEB-INF/web.xml 2009-06-10 09:53:23 UTC (rev 5021) +++ projects/jsf-console/branches/jsf-console-3.2-soa/soa/src/main/webapp/WEB-INF/web.xml 2009-06-10 12:09:38 UTC (rev 5022) @@ -40,12 +40,15 @@ <welcome-file>index.jsp</welcome-file> </welcome-file-list> - <!-- GPD Deployer Servlet ==> <servlet> <description> Server counterpart for the Graphical Process Designer deployment feature. - SECURITY WARNING. GPD deployment is a development aid, not for use in production. - Make sure you either secure or remove this servlet prior to production deployment. + GPD WARNING. The SOA distribution of jBPM is tuned for production deployment + and maps this servlet to a URL pattern in the secured area. In consequence, + the upload servlet is no longer able to accept GPD deployment requests, + as GPD does not support authentication. + To reenable GPD deployment, map the servlet to the path expected by the GPD, + namely "/upload/*". </description> <servlet-name>GPD Deployer Servlet</servlet-name> <servlet-class>org.jbpm.web.ProcessUploadServlet</servlet-class> @@ -54,9 +57,8 @@ <servlet-mapping> <servlet-name>GPD Deployer Servlet</servlet-name> - <url-pattern>/upload/*</url-pattern> + <url-pattern>/app/upload/*</url-pattern> </servlet-mapping> - <!== GPD Deployer Servlet --> <!-- This role list should be changed to include all the relevant roles for your environment. @@ -122,17 +124,16 @@ <listener> <description> - Force initialization of the hibernate session factory. - This will create the DB tables on new installations, - provided that the hibernate.hbm2ddl.auto property - is set to "create". + Builds the Hibernate session factory on initialization. + This will create the database tables in new installations, + provided the hibernate.hbm2ddl.auto property is set. </description> <listener-class>org.jbpm.web.BootstrapListener</listener-class> </listener> <listener> <description> - Closes the jBPM configuration on destruction, releasing application resources. + Closes the jBPM configuration on destruction, releasing resources. This listener should appear after the job executor launcher, to avoid reopening the configuration. </description>