Jakarta Tomcat 4.1 XSS vulnerability

2003-09-28 Thread Kan Ogawa
Hi, Jakarta Tomcat 4.1 cross-site scripting vulnerability, which was reported last year, is not yet resolved. http://www.securityfocus.com/archive/82/288502/2002-08-16/2002-08-22/0 I verified this vulnerability on Tomcat 4.1.27 with Coyote HTTP/1.1 connector.

cvs commit: jakarta-tomcat-5 build.xml

2003-09-28 Thread remm
remm2003/09/28 05:23:27 Modified:.build.xml Log: - Package the Manager class, which is supposedly needed by the deployer. Revision ChangesPath 1.160 +1 -0 jakarta-tomcat-5/build.xml Index: build.xml

DO NOT REPLY [Bug 23463] - Deployer ValidationTask not work! Missing Classes...

2003-09-28 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23463. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE.

Bug report for Tomcat 3 [2003/09/28]

2003-09-28 Thread bugzilla
+---+ | Bugzilla Bug ID | | +-+ | | Status: UNC=Unconfirmed NEW=New ASS=Assigned

Bug report for Tomcat 4 [2003/09/28]

2003-09-28 Thread bugzilla
+---+ | Bugzilla Bug ID | | +-+ | | Status: UNC=Unconfirmed NEW=New ASS=Assigned

Bug report for Watchdog [2003/09/28]

2003-09-28 Thread bugzilla
+---+ | Bugzilla Bug ID | | +-+ | | Status: UNC=Unconfirmed NEW=New ASS=Assigned

DO NOT REPLY [Bug 12428] - request.getUserPrincipal(): Misinterpretation of specification?

2003-09-28 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT http://nagoya.apache.org/bugzilla/show_bug.cgi?id=12428. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE.

DO NOT REPLY [Bug 12428] - request.getUserPrincipal(): Misinterpretation of specification?

2003-09-28 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT http://nagoya.apache.org/bugzilla/show_bug.cgi?id=12428. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE.

DO NOT REPLY [Bug 12428] - request.getUserPrincipal(): Misinterpretation of specification?

2003-09-28 Thread bugzilla
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT http://nagoya.apache.org/bugzilla/show_bug.cgi?id=12428. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE.

Container level authentication

2003-09-28 Thread Bill Barker
I'm a bit confused by the scope for authentication. For purposes of discussion, assume that there is a sub-section of my web-app that is protected via: security-constraint web-resource-collection web-resource-nameProtected Area/web-resource-name