Author: jboynes
Date: Sat Mar 7 15:52:25 2015
New Revision: 1664880
URL: http://svn.apache.org/r1664880
Log:
Update doc and changelist for #57673
Modified:
tomcat/taglibs/standard/trunk/CHANGES.txt
tomcat/taglibs/standard/trunk/README_bin.txt
Modified: tomcat/taglibs/standard/trunk/CHANGES.txt
URL:
http://svn.apache.org/viewvc/tomcat/taglibs/standard/trunk/CHANGES.txt?rev=1664880&r1=1664879&r2=1664880&view=diff
==============================================================================
--- tomcat/taglibs/standard/trunk/CHANGES.txt (original)
+++ tomcat/taglibs/standard/trunk/CHANGES.txt Sat Mar 7 15:52:25 2015
@@ -1,4 +1,5 @@
Changes in 1.2.4 release
+57673 AccessControlException accessing
org.apache.taglibs.standard.xml.accessExternalEntity
37466 Reverted changes that overrode HTTP method when importing local
resources.
Changes in 1.2.3 release
Modified: tomcat/taglibs/standard/trunk/README_bin.txt
URL:
http://svn.apache.org/viewvc/tomcat/taglibs/standard/trunk/README_bin.txt?rev=1664880&r1=1664879&r2=1664880&view=diff
==============================================================================
--- tomcat/taglibs/standard/trunk/README_bin.txt (original)
+++ tomcat/taglibs/standard/trunk/README_bin.txt Sat Mar 7 15:52:25 2015
@@ -92,11 +92,16 @@ The 1.2 version of the Standard Taglib h
and should work in any compliant JSP 2.1 (or later) container.
In version 1.2.3 and later, the XML libraries enable FEATURE_SECURE_PROCESSING
-when parsing and transforming. A new system property
+when parsing and transforming. The system property
+
org.apache.taglibs.standard.xml.accessExternalEntity
+
can be used to further restrict the protocols over which external entities can
be resolved. When a SecurityManager is enabled this will, by default, allow
-access to no protocols.
+access to no protocols. Permission must be granted to the taglibs-standard-impl
+library to read this property.
+
+ permission java.util.PropertyPermission
"org.apache.taglibs.standard.xml.accessExternalEntity", "read";
---------------------------------------------------------------------------
COMMENTS AND QUESTIONS
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
