Re: [VOTE] Release Apache Tomcat 9.0.87

2024-03-12 Thread Tim Funk
No issues noticed via internal testing. -Tim On Mon, Mar 11, 2024 at 7:10 AM Rémy Maucherat wrote: > > The proposed 9.0.87 release is: > [ ] -1, Broken - do not release > [X] +1, Stable - go ahead and release as 9.0.87 > >

Re: [VOTE] Release Apache Tomcat 9.0.78

2023-07-06 Thread Tim Funk
+1 -Tim On Tue, Jul 4, 2023 at 9:28 AM Rémy Maucherat wrote: > The proposed Apache Tomcat 9.0.78 release is now available for voting. > > The notable changes compared to 9.0.76 are: > > The proposed 9.0.78 release is: > [ ] -1, Broken - do not release > [ X ] +1, Stable - go ahead and release

Re: [VOTE] Release Apache Tomcat 9.0.75

2023-05-09 Thread Tim Funk
On Thu, May 4, 2023 at 10:20 AM Rémy Maucherat wrote: > The proposed Apache Tomcat 9.0.75 release is now available for voting. > > The proposed 9.0.75 release is: > [ ] -1, Broken - do not release > [X] +1, Stable - go ahead and release as 9.0.75 > >

Re: [VOTE] Release Apache Tomcat 9.0.74

2023-04-17 Thread Tim Funk
On Thu, Apr 13, 2023 at 4:43 AM Rémy Maucherat wrote: > > The proposed 9.0.74 release is: > [ ] Broken - do not release > [X] Stable - go ahead and release as 9.0.74 > > >

Re: Tomcat 11 - minimum Java version

2023-01-11 Thread Tim Funk
On Wed, Jan 11, 2023 at 6:44 AM Mark Thomas wrote: > On 11/01/2023 11:38, Rémy Maucherat wrote: > > On Wed, Jan 11, 2023 at 12:23 PM Mark Thomas wrote: > > > > Just playing devils advocate for a second, is Java 21 going to be too > big a leap for the majority of users? Might the Tomcat

Re: Do we want to increase the default value of maxHttpHeaderSize?

2022-08-01 Thread Tim Funk
Doubling might be convenient. Let's say a URI is between 4000 and 8000. There is a good chance there could be a Referer header of equal size too. Which can easily push you over the 8192 default. (and that doesn't even include the ever increasing explosion in cookie size) -Tim On Mon, Aug 1,

Re: Any interest in a read-only JMX role?

2022-06-13 Thread Tim Funk
Doing a quick dive and restricting invoke, get, set, query to their own roles looks "easy" since they have their if() checks.(Easier to lock down than I recalled) As for further locking down get() - I guess one could add an init() param to the servlet called get-approve-list which can be a white

Re: Any interest in a read-only JMX role?

2022-06-13 Thread Tim Funk
I think JMXProxy should be eventually deprecated. It's "too powerful" for what it can do. At the time of creation - it was a neat idea that was powerful. But if I had to imagine if we would create such a servlet today, security alarms would be loudly clanging. I think a read only option would

Re: [VOTE] Release Apache Tomcat 9.0.62

2022-03-31 Thread Tim Funk
On Thu, Mar 31, 2022 at 10:56 AM Rémy Maucherat wrote: > > The proposed 9.0.62 release is: > [ ] Broken - do not release > [X] Stable - go ahead and release as 9.0.62 (stable) > >

FAQ Entry added for log4j2 CVE-2021-44228

2021-12-13 Thread Tim Funk
If I've mis-identified anything - let me know. We could point people to this if we continue to get questions: https://cwiki.apache.org/confluence/display/TOMCAT/Security#Security-Q13 -Tim

Re: Request for documentation improvement: changelog UI

2020-09-10 Thread Tim Funk
I think this will do it ... The CSS .sticky { position: fixed; top: 0; right: 20px; left: 210px; margin-top: 0; } And you'll need an event listener ... document.addEventListener( 'scroll', function(){ var h3s =

Re: Finally getting around to switching to Git

2019-04-26 Thread Tim Funk
Or maybe confluence cwiki? -Tim On Fri, Apr 26, 2019 at 8:26 AM Coty Sutherland wrote: > On Fri, Apr 26, 2019 at 3:13 AM Mark Thomas wrote: > ... > > I'd suggest sharing Git experiences is a topic of conversation at the > > Hackathon. > > > > +1, except I won't be there :( Is that something

Re: Wiki migration

2019-03-20 Thread Tim Funk
2019 at 4:12 PM Mark Thomas wrote: > It was a permission issue. I've just fixed that. > > Mark > > > On 17/03/2019 20:02, Tim Funk wrote: > > Hmm ... > > > > Either I don't have permissions to make edits, or I need read a > tutorial. I > > was going to dele

Re: Wiki migration

2019-03-17 Thread Tim Funk
Hmm ... Either I don't have permissions to make edits, or I need read a tutorial. I was going to delete some obvious spam pages which were migrated and then start moving other questionable pages to a sandbox to be debated later. I signed up via my apache email address. -Tim

Re: Wiki migration

2019-03-16 Thread Tim Funk
Thanks Mark. Through the rest of the month, I can try to set aside some time to take a look at fixing the pages Confluence. -Tim On Fri, Mar 15, 2019 at 7:32 PM Mark Thomas wrote: > On 15/03/2019 18:32, Mark Thomas wrote: > > On 15/03/2019 18:05, Konstantin Kolinko wrote: > >> пт, 15 мар.

Re: [VOTE] Migrate to git

2019-02-21 Thread Tim Funk
[X] +1 Go ahead with the migration A huge thanks to all the time, thought and planning to make this possible. -Tim

Re: [VOTE] Migrate to git

2019-02-21 Thread Tim Funk
Sorry for the double email (sending via my apache account so its official) [X] +1 Go ahead with the migration -Tim >

Re: Quick review of outline for Tomcat security presentation?

2019-02-12 Thread Tim Funk
Nice ... Some possible adds .. - Keep your java up to date (companion point to OS update) - Link to OWASP (whole talk to itself) - IP Filtering ... Consider a WAF - IP Filtering ... Where possible - Block all outbound connections - Maybe Lockout realm worth a quick mention? - IIRC: Clustering has

Re: New design for the Tomcat website

2019-01-03 Thread Tim Funk
I noticed that too ... but since the "integrity" attribute is present, it doesn't seem as much a concern. I did notice a few inline "p style="text-align: center;" which seems to be better suited to a class element. But since they seem to be downloads - Keeping them left aligned would work too.

Re: Removal of author tags in trunk

2014-01-24 Thread Tim Funk
Yes - Feel free to remove my name. @author Tim Funk -Tim

Re: svn commit: r1529816 - in /tomcat/trunk: conf/catalina.properties java/org/apache/catalina/startup/Bootstrap.java test/org/apache/catalina/startup/TestBootstrap.java webapps/docs/changelog.xml

2013-10-07 Thread Tim Funk
Will this work with [insert poorly, 'very' poorly name'd 'directory' here] ? -Tim On Mon, Oct 7, 2013 at 6:55 AM, ma...@apache.org wrote: Author: markt Date: Mon Oct 7 10:55:18 2013 New Revision: 1529816 URL: http://svn.apache.org/r1529816 Log: Partial fix for

Re: Code style rules: Line length

2013-08-09 Thread Tim Funk
My opinion only (since I've been pretty inactive lately ... only enough time to lurk) I'm a big fan of long method/class names and 80 character width drives me nuts - unless your IDE is a phone - 80 is not very wide. 100 many times is just enough extra space to limit a lot of wrapping.

Re: [RESULT][VOTE] Tighten up wiki security to reduce spam

2013-04-25 Thread Tim Funk
My wiki id is TimFunk -Tim On Wed, Apr 24, 2013 at 4:38 PM, Konstantin Kolinko knst.koli...@gmail.comwrote: 2013/4/25 Mark Thomas ma...@apache.org: On 24/04/2013 21:23, Mark Thomas wrote: +1 (binding): markt, funkman, rjung, olamy, kkolinko (with regret) +1: Ognjen Blagojevic,

Re: [VOTE] Tighten up wiki security to reduce spam

2013-04-22 Thread Tim Funk
[X] +1 Make it so I'm surprised not to see more discussion ... but it could be due to the word spam in the subject line. So many folks (maybe including me) aren't seeing any of the replies. (or possibly the original vote request so they are unable to reply/vote) -Tim On Fri, Apr 19, 2013 at

Re: Wiki (was: Update of LocalBadContent)

2013-03-20 Thread Tim Funk
+1 for the lock down. [with sadness] If someone would like to add content it can be done via bug report. [Component = Wiki? ] Then if a few are filed by the same person escalate their access as trusted. I can try to keep an eye on these types of bugs flowing through. +1 To removing the powered

Re: Using comments.apache.org for our live docs

2012-11-08 Thread Tim Funk
Nice. +1 -Tim On Wed, Nov 7, 2012 at 5:31 PM, Rainer Jung rainer.j...@kippdata.de wrote: SNIP I prepared a simple demo at: http://people.apache.org/~**rjung/tomcat-docs-comments/**tomcat-8.0-docs/http://people.apache.org/~rjung/tomcat-docs-comments/tomcat-8.0-docs/ It would be nice if

Re: Proposal: use tomcat-version-number in server.xml Server element?

2011-12-02 Thread Tim Funk
Sounds like a job for a LifeCycleListener. (and therefore easy to backport) -Tim

Re: [RFC] Netmask-based filter and valve

2011-10-11 Thread Tim Funk
Looks ok ... a few comments. RemoteCIDRFilter (most of the below apply to the valve too) setAllow = If nothing passed - This should clear allow setAllow = If a bad allow is passed - throw exception. I'd think throwing an IllegalArgumentException is OK so no catch is needed. Depending on when

Re: svn commit: r1179274 - /tomcat/trunk/java/org/apache/tomcat/util/IntrospectionUtils.java

2011-10-05 Thread Tim Funk
I'm a little confused. On a quick glance of the method ... it appears the method setProperty should be returning true if it did something, and false if not. This would mean the cast is not needed (actually wrong). The fact that the method did NOT throw an exception should mean that we should

Re: svn commit: r1177245 - /tomcat/trunk/java/org/apache/tomcat/util/http/MimeHeaders.java

2011-09-29 Thread Tim Funk
Wouldn't converting the whole method to use StringBuilder be more efficient - as compared instantiating a StringWriter AND PrintWriter? We could probably guess a good default size too of size()*40 which would assume most headers are less than 40 chars (which is typically true except for user-agent

Re: svn commit: r1163643 - /tomcat/tc7.0.x/trunk/java/org/apache/jasper/JspCompilationContext.java

2011-08-31 Thread Tim Funk
/me confused - should this be removed from trunk instead of tc7.0.x? -Tim On Wed, Aug 31, 2011 at 10:31 AM, ma...@apache.org wrote: Author: markt Date: Wed Aug 31 14:31:13 2011 New Revision: 1163643 URL: http://svn.apache.org/viewvc?rev=1163643view=rev Log: As per the comment, remove the

Re: [VOTE] Grant Olivier Lamy commit karma to the Tomcat repo (for the Maven plugin)

2011-08-25 Thread Tim Funk
+1 On Thu, Aug 25, 2011 at 10:44 AM, Mark Thomas ma...@apache.org wrote: Subject says it all. Here is my +1 to start this off.

Re: svn commit: r1156530 - in /tomcat/trunk/java/org/apache/catalina/connector: LocalStrings.properties Response.java

2011-08-11 Thread Tim Funk
It may be overkill ... but should absolute be XML escaped? -Tim On Thu, Aug 11, 2011 at 4:13 AM, ma...@apache.org wrote: Modified: tomcat/trunk/java/org/apache/catalina/connector/Response.java URL:

Re: Servlet 3.1, Tomcat 8 etc.

2011-07-27 Thread Tim Funk
+1 To getting newer ideas in faster. I guess the question to ponder is what are the future changes pending for 7? What are the changes for the servlet spec? I have a feeling that the servlet spec changes are more of a playground for ideas which would bring about lots of change and potential

Re: svn commit: r1140204 - /tomcat/trunk/java/org/apache/tomcat/util/buf/B2CConverter.java

2011-06-27 Thread Tim Funk
The javadocs say it can be an expensive operation. But considering the alternatives [and this is only done once], this seems to be reasonable. What could be worrisome is the JDK does allow for more charsets to be added at run-time. In which case - a user could be out of luck. If we were scared

Re: svn commit: r1136231 - in /tomcat/trunk: java/org/apache/catalina/ssi/ExpressionParseTree.java webapps/docs/changelog.xml

2011-06-16 Thread Tim Funk
** What happens if PatternSyntaxException is thrown? (bad regex is passed in) While it is a RuntimeException - i'd assume you'd want to log.warn(with the regex) and return -1; -Tim On 6/15/2011 6:44 PM, ma...@apache.org wrote: Modified:

Re: svn commit: r1132487 - in /tomcat/trunk: java/org/apache/coyote/http11/AbstractHttp11Processor.java webapps/docs/changelog.xml

2011-06-06 Thread Tim Funk
Ascii.parseInt can throw a NumberFormatException which should probably be caught and a 400 returned. -Tim On Sun, Jun 5, 2011 at 4:26 PM, ma...@apache.org wrote: Author: markt Date: Sun Jun 5 20:26:37 2011 New Revision: 1132487 URL: http://svn.apache.org/viewvc?rev=1132487view=rev Log:

Re: svn commit: r1131263 - in /tomcat/trunk: java/org/apache/catalina/session/JDBCStore.java java/org/apache/catalina/session/LocalStrings.properties webapps/docs/changelog.xml webapps/docs/config/man

2011-06-03 Thread Tim Funk
If NamingExceptionOccurs - should this instead rethrow a SqlException instead of letting the logic keep going? Otherwise wouldn't a SqlException be thrown later in the method? -Tim On Fri, Jun 3, 2011 at 6:13 PM, ma...@apache.org wrote: Author: markt Date: Fri Jun 3 22:13:09 2011 New

Re: Outdated Servlet 3.0 Javadocs available on tomcat.apache.org

2011-06-01 Thread Tim Funk
Is the PDF of the spec which is downloadable up to date with respect to comments? I don't think the pdf version of the spec is CDDL ... but it may have other conditions on it. If the PDF version of the spec is up to date, someone might be able to copy from the PDF and paste into the javadocs and

Re: Outdated Servlet 3.0 Javadocs available on tomcat.apache.org

2011-06-01 Thread Tim Funk
Doh - Older specs had the javadocs. I never scrolled to the end to notice it missing from the current spec. -Tim On Wed, Jun 1, 2011 at 11:29 AM, Christopher Schultz ch...@christopherschultz.net wrote: Tim, On 6/1/2011 8:35 AM, Tim Funk wrote: Is the PDF of the spec which is downloadable

Re: Fixing bug 33453

2011-05-23 Thread Tim Funk
How about calling it getDependantsMap() instead of getDependants() ? Then catch the NoSuchMethodException (I in the case where the compiled jsp doesn't have getDependants() and that would force a recompile (and then the new version would be OK) -Tim On 5/20/2011 12:31 PM, Mark Thomas wrote:

Re: [PROPOSAL] Move to svnpubsub for /dist/tomcat

2011-05-18 Thread Tim Funk
+1 On Wed, May 18, 2011 at 9:38 AM, Mark Thomas ma...@apache.org wrote: We have the option to move to svnpubsub for managing our releases. Rather than copying artefacts to people.a.o and then waiting for rsync (every around 2 hours) we would commit the artefacts to svn and a commit hook

Re: BIO performance issues

2011-05-04 Thread Tim Funk
Solution B and disabling keepalive when a threshold is reached looks to be the way to go. If people have issue with that, that's why the other connectors exist. -Tim On Tue, May 3, 2011 at 4:02 PM, Mark Thomas ma...@apache.org wrote: SNIP Solution B -- Return to the Tomcat 6

Re: svn commit: r1087128 - in /tomcat/trunk: java/org/apache/catalina/util/SessionIdGenerator.java webapps/docs/changelog.xml

2011-03-31 Thread Tim Funk
Would it be more efficient to do this instead? -/** Node identifier when in a cluster. Defaults to the empty string. */ -private String jvmRoute = ; +/** Node identifier when in a cluster. */ +private String jvmRoute = null; ... public void setJvmRoute(String jvmRoute) {

Re: Reaching ulimit values for open files can generate huge log files

2011-02-23 Thread Tim Funk
... that is their problem. -Tim On 2/23/2011 5:48 AM, Mark Thomas wrote: On 21/02/2011 17:33, Tim Funk wrote: Do you want to limit the try/catch scope to just serverSocketFactory.acceptSocket since setSocketOptions() can also throw IOException? A couple of people have mentioned this and while

Re: Reaching ulimit values for open files can generate huge log files

2011-02-21 Thread Tim Funk
Do you want to limit the try/catch scope to just serverSocketFactory.acceptSocket since setSocketOptions() can also throw IOException? Is there a case where a client can induce an exception while setSocketOptions() is processing? -Tim On 2/21/2011 10:21 AM, Mark Thomas wrote: The ASF

Re: svn commit: r1060627 - in /tomcat/trunk/webapps: docs/changelog.xml host-manager/META-INF/context.xml manager/META-INF/context.xml

2011-01-19 Thread Tim Funk
My bad - I meant +1 to having it for real. -Tim On 1/19/2011 1:48 PM, Mark Thomas wrote: On 19/01/2011 01:18, Tim Funk wrote: +1 - It might be nice to match 127.0.0.[0-9]{1,3} so it is more virtual machine friendly for those who map localhost to an alternate loopback address. +1 to having

Re: Tomcat 7.0.x. still CTR?

2011-01-18 Thread Tim Funk
My preference is to remain CTR on the idea the anything of significance be proposed so there would be consensus to push it into 7.0 or branch to 7.X -Tim On 1/18/2011 1:41 PM, Christopher Schultz wrote: All, Since Tomcat 7.0.x went stable, does that change the commit policy, or are we still

Re: svn commit: r1060627 - in /tomcat/trunk/webapps: docs/changelog.xml host-manager/META-INF/context.xml manager/META-INF/context.xml

2011-01-18 Thread Tim Funk
+1 - It might be nice to match 127.0.0.[0-9]{1,3} so it is more virtual machine friendly for those who map localhost to an alternate loopback address. -Tim On 1/18/2011 7:04 PM, Mark Thomas wrote: On 19/01/2011 00:00, ma...@apache.org wrote: Author: markt Date: Wed Jan 19 00:00:59 2011 New

Re: [VOTE] Release Apache Tomcat 7.0.6

2011-01-12 Thread Tim Funk
[X] Stable - go ahead and release as 7.0.6 Stable -Tim On 1/10/2011 1:54 PM, Mark Thomas wrote: The proposed Apache Tomcat 7.0.6 release is now available for voting. It can be obtained from: http://people.apache.org/~markt/dev/tomcat-7/v7.0.6/ The svn tag is:

Re: [VOTE] Release build 6.0.30

2011-01-12 Thread Tim Funk
[X] Stable -Tim On 1/10/2011 12:18 PM, jean-frederic clere wrote: The candidates binaries are available here: http://people.apache.org/~jfclere/tomcat-6/v6.0.30/ According to the release process, the 6.0.30 build corresponding to the tag TOMCAT_6_0_30 is: [ ] Broken [ ] Alpha [ ] Beta [ ]

Re: svn commit: r1058102 - in /tomcat/trunk: java/org/apache/jasper/compiler/Generator.java java/org/apache/jasper/compiler/JspUtil.java webapps/docs/changelog.xml

2011-01-12 Thread Tim Funk
I don't understand what this change other than provide noise. It doesn't fix anything. -Tim On 1/12/2011 7:08 AM, ma...@apache.org wrote: Author: markt Date: Wed Jan 12 12:08:16 2011 New Revision: 1058102 URL: http://svn.apache.org/viewvc?rev=1058102view=rev Log: Fix

Re: svn commit: r1058102 - in /tomcat/trunk: java/org/apache/jasper/compiler/Generator.java java/org/apache/jasper/compiler/JspUtil.java webapps/docs/changelog.xml

2011-01-12 Thread Tim Funk
JspFactory is in package javax.servlet.jsp which is one of the packages that has * import. If a user tried to create a class called JspFactory and tried to import it - he'd get a compile error on his import statement. -Tim On 1/12/2011 10:04 AM, Mark Thomas wrote: On 12/01/2011 14:51, Tim

Re: svn commit: r1058102 - in /tomcat/trunk: java/org/apache/jasper/compiler/Generator.java java/org/apache/jasper/compiler/JspUtil.java webapps/docs/changelog.xml

2011-01-12 Thread Tim Funk
Interesting. Nice nugget to know. -Tim On 1/12/2011 10:09 AM, Mark Thomas wrote: On 12/01/2011 15:08, Tim Funk wrote: JspFactory is in package javax.servlet.jsp which is one of the packages that has * import. If a user tried to create a class called JspFactory and tried to import it - he'd

Re: Tomcat 7 regex

2010-12-25 Thread Tim Funk
Thomas wrote: On 25/12/2010 01:49, Tim Funk wrote: +0.5 - I wonder if in some cases - it may be preferable to use a property called split which lets the user define the separator which we can pass to String.split(). [Which OTOH may be more confusing (yet powerful) since the user is using a regex

Re: Tomcat 7 regex

2010-12-24 Thread Tim Funk
+0.5 - I wonder if in some cases - it may be preferable to use a property called split which lets the user define the separator which we can pass to String.split(). [Which OTOH may be more confusing (yet powerful) since the user is using a regex to split get a list of regex] -Tim On

Re: svn commit: r1036595 - in /tomcat/trunk: java/org/apache/catalina/ java/org/apache/catalina/ha/session/ java/org/apache/catalina/session/ test/org/apache/catalina/session/

2010-11-29 Thread Tim Funk
I checked the svn history of why MD5 (hashing was used) and the picture is incomplete. (unless someone asks craig since I think he was the author) But it appears like this ... Tomcat 3.X use Math.random() and some misc crap to generate its session id. It had a comment (paraphrased), not secure

Re: svn commit: r1036595 - in /tomcat/trunk: java/org/apache/catalina/ java/org/apache/catalina/ha/session/ java/org/apache/catalina/session/ test/org/apache/catalina/session/

2010-11-29 Thread Tim Funk
Sorry for the additional noise ... my svn emails are in a different folder from dev emails. I just noticed ... svn commit: r1039882 - /tomcat/trunk/java/org/apache/catalina/session/ManagerBase.java -Tim On 11/29/2010 7:40 AM, Tim Funk wrote: I checked the svn history of why MD5 (hashing

Re: svn commit: r1036150 - /tomcat/trunk/webapps/docs/changelog.xml

2010-11-18 Thread Tim Funk
If the Random number generator is sufficiently random could we avoid the digesting? Or should it be an option? Since java1.6 has SecureRandom - is its current implementation good enough to avoid all the extra tricks currently being done and we can just use that as a default? [Or maybe - we

Re: [PATCH] Parallel deployment

2010-11-06 Thread Tim Funk
This might cause a problem of using == instead of equals() for strcmp if (version == (request.getContext().getWebappVersion())) { mapRequired = false; } When running mod_jk with sticky session, but not using tomcat clustering ... Will adding a new version append the version number to the

Re: configtest

2010-11-04 Thread Tim Funk
svn diff -x -w version uploaded. I always wondered how to ignore whitespace in svn ignore. (It bugged me, but never enough to rtfm) Thanks for the tip! -Tim On 11/3/2010 6:46 PM, Konstantin Kolinko wrote: Too many unneeded whitespace changes. It is hard to read. Try svn diff -x -w In

configtest

2010-11-03 Thread Tim Funk
A possible nice to have is trying to test whether a new config will be OK or not.I have a patch which will allow a new arg for catalina.sh called configtest. It will try to load the catalina config but log everything to standard output. It will try to exit with a non zero status code if bad

Re: svn commit: r1028521 - in /tomcat/trunk: java/org/apache/catalina/ java/org/apache/catalina/connector/ java/org/apache/catalina/core/ java/org/apache/tomcat/util/http/mapper/ test/org/apache/tomca

2010-10-29 Thread Tim Funk
Should we add trim()? (in case the user has a new line or spaces after the ,) this.resourceOnlyServlets.add(servletName.trim()); -Tim Modified: tomcat/trunk/java/org/apache/catalina/core/StandardContext.java URL:

Re: [PROPOSAL] Parallel deployment

2010-10-22 Thread Tim Funk
Cool. Some notes ... (1) Since we already have - effectiveMajorVersion - effectiveMinorVersion Is Context.version a good name to use? Since the name version is also used by the servlet spec? Would revision be a less confusing name? (Or webappRevision). (2) [I thought of this as a side

Re: [PROPOSAL] Parallel deployment

2010-10-22 Thread Tim Funk
On 10/22/2010 7:39 AM, Mark Thomas wrote: On 22/10/2010 06:27, Tim Funk wrote: (1) Since we already have - effectiveMajorVersion - effectiveMinorVersion Is Context.version a good name to use? Since the name version is also used by the servlet spec? Would revision be a less confusing name

Re: [VOTE] Release Apache Tomcat 7.0.4

2010-10-19 Thread Tim Funk
[X] Beta - go ahead and release as 7.0.4 Beta -Tim On 10/15/2010 4:47 AM, Mark Thomas wrote: The proposed Apache Tomcat 7.0.4 release is now available for voting. It can be obtained from: http://people.apache.org/~markt/dev/tomcat-7/v7.0.4/ The svn tag is:

Re: svn commit: r1005789 - in /tomcat/trunk/java/org/apache/naming: NamingContext.java NamingContextBindingsEnumeration.java

2010-10-08 Thread Tim Funk
FYI ... There was a similar fix applied here but reverted ... https://issues.apache.org/bugzilla/show_bug.cgi?id=47512#c4 http://svn.apache.org/viewvc?view=revisionrevision=832792 http://svn.apache.org/viewvc?view=revisionrevision=832638 -Tim On 10/8/2010 7:57 AM, ma...@apache.org wrote:

Re: Site redesign

2010-10-04 Thread Tim Funk
Nice work ... I think a link needs to be added to report a bug. http://tomcat.apache.org/bugreport.html -Tim - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail:

Re: Draft blog entry for review

2010-09-15 Thread Tim Funk
Looks good. It would be really cool to supplement this with a YouTube video of a screen walking through the steps laid out while playing with JConsole. -Tim On 9/15/2010 11:07 AM, Mark Thomas wrote: As I mention recently, JMX is now looking pretty good. I have drafted a blog entry [1] on

Re: JSP:includes parameter passing vulnerability

2010-09-15 Thread Tim Funk
There is no issue. If there is a typo in the developer code, there is a typo in the code. And sometimes typos cause security issues. As a general rule, any code which is user provided should validated and output escaped. This is a topic which should be discussed on the user list. -Tim On

Re: Links to Sun/Oracle on welcome page

2010-08-27 Thread Tim Funk
+1 To intermediate page on wiki to allow newbies to understand what the JCP is -Tim On 8/27/2010 6:28 AM, Konstantin Kolinko wrote: Maybe create a Wiki page to list the relevant specification links? (I don't have time now, but maybe later).

Re: Links to Sun/Oracle on welcome page

2010-08-26 Thread Tim Funk
-1 To removing spec links. We should be linking to the JCP since that is what Tomcat implements and we WANT developers to know and download the spec. It would be nice if we can just put the spec in as part of the docs, but IIRC - that is against the licensing terms of the docs. If we could put

Re: Links to Sun/Oracle on welcome page

2010-08-26 Thread Tim Funk
In that case ... +1 for removing links to http://java.sun.com/products/servlets and http://java.sun.com/products/jsp (or any http://java.sun.com page) -Tim On 8/26/2010 10:04 AM, Mladen Turk wrote: On 08/26/2010 03:14 PM, Tim Funk wrote: -1 To removing spec links. We should be linking

Re: svn commit: r988459 - in /tomcat/trunk: java/org/apache/coyote/http11/ java/org/apache/coyote/http11/filters/ test/org/apache/coyote/http11/ webapps/docs/

2010-08-24 Thread Tim Funk
log is protected (instead of private) is intentional? -Tim On 8/24/2010 6:02 AM, ma...@apache.org wrote: + +/** + * Logger. + */ +protected static org.apache.juli.logging.Log log += org.apache.juli.logging.LogFactory.getLog(AbstractOutputBuffer.class);

Update of legal.html to say oracle?

2010-08-23 Thread Tim Funk
Not sure if this belongs on legal mailing list or not ... Since Sun is no more and owned by Oracle ... does this page need changed to say Oracle? http://tomcat.apache.org/legal.html -Tim - To unsubscribe, e-mail:

Re: [PROPOSAL] Change the name of the default host in server.xml

2010-07-15 Thread Tim Funk
-0 Since the host name should be a valid dns name(ok it doesn't need to be a valid dns name if Alias is used), choosing a default which doesn't have a valid dns name may cause woes. But if someone came up with a fantastic alternate default name, then I could be swayed. -Tim On 7/15/2010

Re: [PROPOSAL] Change the name of the default host in server.xml

2010-07-15 Thread Tim Funk
in various places instead of IP addresses due to relying on DNS. -Tim On 7/15/2010 11:11 AM, Mark Thomas wrote: On 15/07/2010 15:16, Tim Funk wrote: -0 Since the host name should be a valid dns name(ok it doesn't need to be a valid dns name if Alias is used), choosing a default which doesn't

Re: [VOTE] Release Apache Tomcat 7.0.0 as beta

2010-06-15 Thread Tim Funk
[X] Beta - go ahead and release as 7.0.0 Beta -Tim - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org

JIKESPATH in setclasspath.sh

2010-06-08 Thread Tim Funk
Is this needed anymore in setclasspath.sh ? # OSX hack to CLASSPATH JIKESPATH= if [ `uname -s` = Darwin ]; then OSXHACK=/System/Library/Frameworks/JavaVM.framework/Versions/CurrentJDK/Classes if [ -d $OSXHACK ]; then for i in $OSXHACK/*.jar; do JIKESPATH=$JIKESPATH:$i done fi

Re: JIKESPATH in setclasspath.sh

2010-06-08 Thread Tim Funk
/2010 18:14, Tim Funk wrote: Is this needed anymore in setclasspath.sh ? Works for me with that commented out. Mark # OSX hack to CLASSPATH JIKESPATH= if [ `uname -s` = Darwin ]; then OSXHACK=/System/Library/Frameworks/JavaVM.framework/Versions/CurrentJDK/Classes if [ -d $OSXHACK

Re: Donation: Want to donate a robust HTTP ProxyServlet to tomcat

2010-06-04 Thread Tim Funk
-0 (or +1) (Well that was clear ... wasn't it?) The core consideration is the scope of the Tomcat project. If its to deliver a spec compliant servlet/jsp engine. Then I would say (-0 or -1) If the scope is to increase to also act as a repository for generic servlets, then we are in different

Re: svn commit: r950587 - in /tomcat/trunk: java/org/apache/catalina/AccessLog.java java/org/apache/catalina/connector/CoyoteAdapter.java java/org/apache/catalina/valves/AccessLogValve.java webapps/do

2010-06-02 Thread Tim Funk
Cool - One (very minor) nit ... A safer size might be 500. A typical User agent string by itself is 100+ characters which will easily take the log line over 128 characters. StringBuilder result = new StringBuilder(128); -Tim On 6/2/2010 11:12 AM, ma...@apache.org wrote: Author: markt Date:

Re: CSRF prevention filter and Tomcat 5/6

2010-05-11 Thread Tim Funk
+1 to E -Tim On 5/10/2010 11:47 AM, Mark Thomas wrote: On 10/05/2010 13:25, Konstantin Kolinko wrote: Thoughts? It is possible to combine A+C: E. Use a different name for the new role that allows access to GUI interface only, manager-gui, as well as new manager-script, manager-jmx,

Re: CSRF prevention filter and Tomcat 5/6

2010-05-07 Thread Tim Funk
D (and possibly B) In the case of B - instead of commenting out - wrap a filter around it that has default behavior of not being enabled. So it would look like this: boolean allowTextInterface = false; init(FilterConfig) { String s=System.getProperty(manager.allowTextInterface);

Re: Comet API incompatibility between TC 6 and TC 7

2010-04-30 Thread Tim Funk
Would it be possible to just create an optional package that has all the old class names and their implementation is just an extends of the new version? (As well as being marked deprecated) -Tim On 4/30/2010 2:51 AM, Konstantin Kolinko wrote: There is a difference in Comet API that will

Re: Access logging for requests rejected by CoyoteAdaptor

2010-04-30 Thread Tim Funk
I think I am changing my mind, I am leaning towards 1. There are cases where I think we can use the regular access log (where I like solution 2). But with solution 1. You can also log oddness. Connections which timeout, or never present a request, etc. So the format of the CoyoteAdaptor log

Re: Access logging for requests rejected by CoyoteAdaptor

2010-04-29 Thread Tim Funk
I like case 2. In the case of the malformed request. We might not be able to determine the host or the path (and therefore the appropriate webapp (or host)) In the common case (admin), I would hope that there is an AccessLog at the EngineLevel. So we might be able to do the following ... -

Re: svn commit: r937975 - /tomcat/trunk/java/org/apache/catalina/core/StandardContext.java

2010-04-26 Thread Tim Funk
I'm feeling stupid at the moment. (Or need more coffee) But why do the parenthesis make a difference? (Since only addition/subtraction is done and no multiplication - I can't tell why this fixes it) -Tim On 4/26/2010 5:17 AM, ma...@apache.org wrote: Author: markt Date: Mon Apr 26 09:17:46

Re: svn commit: r937975 - /tomcat/trunk/java/org/apache/catalina/core/StandardContext.java

2010-04-26 Thread Tim Funk
slap forehead='mine'Got it/slap thanks -Tim On 4/26/2010 6:36 AM, Mark Thomas wrote: On 26/04/2010 11:33, Tim Funk wrote: I'm feeling stupid at the moment. (Or need more coffee) But why do the parenthesis make a difference? (Since only addition/subtraction is done and no multiplication - I

Re: svn commit: r933165 - /tomcat/trunk/java/org/apache/catalina/tribes/io/ChannelData.java

2010-04-12 Thread Tim Funk
This seems like an odd thing to make a constant. (Is something else setting this or was there an intention for this to be set? Especially since it is used only once in this file) -Tim On 4/12/2010 5:35 AM, ma...@apache.org wrote: Author: markt Date: Mon Apr 12 09:35:52 2010 New Revision:

Re: Chunked encoding should be used also when not using keepalive

2010-04-01 Thread Tim Funk
Doing this would be bad. When serving JSP's (or anything dynamic greater than the buffer size) - the content length is not sent to the client. So when the end of the request is sent - there is no signal to the client to let them know the request is over and they can start a new request over

Re: Chunked encoding should be used also when not using keepalive

2010-04-01 Thread Tim Funk
Wait a sec ... not enough coffee. I might have answered a totally different question (and incorrectly too) -Tim On 4/1/2010 6:42 AM, Tim Funk wrote: Doing this would be bad. When serving JSP's (or anything dynamic greater than the buffer size) - the content length is not sent to the client

Re: Chunked encoding should be used also when not using keepalive

2010-04-01 Thread Tim Funk
Agree with Remy. If 'connection: close' is sent by the client, then tomcat needs to close the connection on the end of the response. So sending the results via chunked encoding is extra overhead which is not needed. A good argument to add is chunked encoding would that it gives the client

Re: Chunked encoding should be used also when not using keepalive

2010-04-01 Thread Tim Funk
effect might be good) -Tim On 4/1/2010 6:54 AM, Tim Funk wrote: A good argument to add is chunked encoding would that it gives the client the best guess on whether the entire response was returned (by receiving the last full chunk). But that argument is weak

Re: [ANN] New Tomcat Committer: Keiichi Fujino (kfujino)

2010-03-31 Thread Tim Funk
congratulations! -Tim On 3/31/2010 3:29 PM, Filip Hanik - Dev Lists wrote: On behalf of the Tomcat committers I am pleased to announce that Keiichi Fujino (kfujino) has been voted in as a new Tomcat committer. Please join me in welcoming him.

Re: Tomcat 7 windows installer image

2010-03-26 Thread Tim Funk
I'm not a fan of the line backgrounds behind both logos. From a marketing point of view, I would prefer to see the feather above the cat. It might be nice to see the cat and feather swapped and without the lines in background, just using the gradient. But otherwise conceptually, it would

Re: Using JIRA instead STATUS.txt

2010-03-15 Thread Tim Funk
-0.5 It might seem moving to JIRA from Bugzilla would be a better first step. Then if commit messages follow a naming convention - the commit could automagically update the JIRA bug with the commit message. This might fix the tracking desire yet keeping the simplicity of the STATUS file.

Re: svn commit: r921464 - in /tomcat/trunk/java/org/apache/jasper: JspCompilationContext.java servlet/JspServletWrapper.java

2010-03-11 Thread Tim Funk
FWIW ... Broken JSP's in production can be a very common issue. Or worse - folks who misuse fragments (meant for includes) and leave them in an area which may be allowed to be requested directly. -Tim On 3/10/2010 12:54 PM, Mark Thomas wrote: I did consider that but I was working on the

Re: [VOTE] C-T-R for any translation fixes

2010-03-09 Thread Tim Funk
On 3/8/2010 2:00 PM, Konstantin Kolinko wrote: I propose to relax our RTC policy and use CTR for the types of changes listed below: 2010/3/8 Konstantin Kolinkoknst.koli...@gmail.com: 1. We already have Commit-Then-Review for any documentation, including JavaDoc and code comments. Already

Re: [VOTE] Release build 6.0.25

2010-02-25 Thread Tim Funk
So far all looks OK - but due to the version issue - I vote: [X] Broken I believe rebuilding with an updated properties (no retag needed) should fix the issue. -Tim On 2/25/2010 6:07 AM, Konstantin Kolinko wrote: 2010/2/24 jean-frederic clerejfcl...@gmail.com: The candidates binaries are

  1   2   3   >