Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread David Rees
On Tue, Aug 14, 2001 at 11:49:43PM -0400, Keith Wannamaker wrote: Try ap_escape_uri That does the trick. Here's the patch which gets things working again, thanks for all the help. Hopefully this will get applied soon. Is there any 3.2.4 release planned to fix the small number of

RE: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread Keith Wannamaker
I am concerned that the loss of original escaping will break somebody. For instance: r-unparsed_uri = fe%3afi%40fo%3ffum r-uri= fe:fi@fo?fum ap_escape_uri(r-uri) = fe:fi@fo%3ffum Magically authentication information appears in my request to an oddly-named server. Maybe

Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread Justin Erenkrantz
On Wed, Aug 15, 2001 at 08:56:45AM -0400, Keith Wannamaker wrote: I am concerned that the loss of original escaping will break somebody. For instance: As Costin pointed out, the escaping of a URI does not change its semantics - they should be treated as identical by anyone who follows the URI

Native configuration changes.

2001-08-15 Thread cmanolache
Hi, Playing with the JNI connector, I found few simple ways to make it easier to set it up. Larry, Mike - let me know if you're ok ( and if you can take care of the doc part ). 1. JniConnector will be included in server.xml ( un-commented ). I added code inside to detect if tomcat is started in

Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread cmanolache
On Wed, 15 Aug 2001, Justin Erenkrantz wrote: On Wed, Aug 15, 2001 at 08:56:45AM -0400, Keith Wannamaker wrote: I am concerned that the loss of original escaping will break somebody. For instance: As Costin pointed out, the escaping of a URI does not change its semantics - they should

Re: cvs commit: jakarta-tomcat-4.0/jasper/src/share/org/apache/jasper/runtimeJspRuntimeLibrary.java PageContextImpl.java

2001-08-15 Thread Christopher Cain
:-) Craig R. McClanahan wrote: On Wed, 15 Aug 2001, Pier P. Fumagalli wrote: [EMAIL PROTECTED] at [EMAIL PROTECTED] wrote: Fix a spec-compliance bug in the implementation of PageContext.include(), which was not flushing the output stream even though this is explicitly required

Re: Native configuration changes.

2001-08-15 Thread Mike Anderson
[EMAIL PROTECTED] 08/15/01 09:51AM Hi, Playing with the JNI connector, I found few simple ways to make it easier to set it up. Larry, Mike - let me know if you're ok ( and if you can take care of the doc part ). 1. JniConnector will be included in server.xml ( un-commented ). I added code

RE: Native configuration changes.

2001-08-15 Thread Larry Isaacs
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 15, 2001 11:51 AM To: [EMAIL PROTECTED] Subject: Native configuration changes. Hi, Playing with the JNI connector, I found few simple ways to make it easier to set it up. Larry,

Re: Native configuration changes.

2001-08-15 Thread cmanolache
On Wed, 15 Aug 2001, Mike Anderson wrote: The problem with this is that when you start tomcat outside of Apache, it isn't really doing anything but generating the auto-config files. They whole idea of the JNI connector is that the web server starts its own version of Tomcat by instantiating

RE: Native configuration changes.

2001-08-15 Thread Larry Isaacs
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 15, 2001 1:20 PM To: [EMAIL PROTECTED] Subject: Re: Native configuration changes. On Wed, 15 Aug 2001, Mike Anderson wrote: The problem with this is that when you start tomcat

Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread Bill Barker
Personally, I agree with Justin and Costin that mod_jk should be able to use the uri field. Having said that, I'd like to point out that the mod_jk.c in j-t-c is flat-out broken. It doesn't handle the case where the '?' itself is encoded. Since this case is part of a currently popular attack

Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread cmanolache
On Wed, 15 Aug 2001, Bill Barker wrote: Personally, I agree with Justin and Costin that mod_jk should be able to use the uri field. Having said that, I'd like to point out that the mod_jk.c in j-t-c is flat-out broken. It doesn't handle the case where the '?' itself is encoded. Since

cvs commit: jakarta-tomcat/src/doc tomcat-ug.html

2001-08-15 Thread larryi
larryi 01/08/15 12:53:20 Modified:src/doc tomcat-ug.html Log: Mostly updates on configuring Tomcat Revision ChangesPath 1.10 +100 -24 jakarta-tomcat/src/doc/tomcat-ug.html Index: tomcat-ug.html

Fw: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread Bill Barker
- Original Message - From: Bill Barker [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, August 15, 2001 12:15 PM Subject: Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix It is actually worse than that. TC3.3B1 (with the mod_jk that it ships with, I haven't tried j-t-c yet)

Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread David Rees
On Wed, Aug 15, 2001 at 08:58:00AM -0700, [EMAIL PROTECTED] wrote: And, the whole question is what does Tomcat see the request as? I could make a case that it should never know about the unparsed_uri, but only the uri that httpd finally resolved to and that mod_jk picked up. -- justin

Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread cmanolache
On Wed, 15 Aug 2001, Bill Barker wrote: It is actually worse than that. TC3.3B1 (with the mod_jk that it ships with, I haven't tried j-t-c yet) gives a directory listing in response to: http://myserver/%3f%41%3d%42.jsp If I translate this corectly, your request is http://myserver/?a=b.jsp

Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread cmanolache
Apache2.0 + mod_jk + JNI + tc3.3 gives me the correct answer, 404 ( with the correct URI - /?A=B.jsp ). Note that typing the unencoded version is returning the correct answer too, i.e. index.html. What version of apache are you using ? Costin On Wed, 15 Aug 2001, Bill Barker wrote: It is

Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread Bill Barker
Actually, I have an index.jsp file. According to the logs (I haven't turned up the logging level yet, so the information in mininal), I get: Ctx() : Compiling: /?A=B.jsp to _0003fA_0003dB_0 The corresponding .java file just prints static HTML with a base

Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix

2001-08-15 Thread Bill Barker
1.3.17 (with negotiation_module removed to prevent that problem). - Original Message - From: [EMAIL PROTECTED] To: Bill Barker [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Sent: Wednesday, August 15, 2001 1:01 PM Subject: Re: [TC3.2.3][PATCH] mod_jk / mod_rewrite bug fix Apache2.0 + mod_jk

[PATCH] Potential security problem with '?' in jsp file name TC3.3B1

2001-08-15 Thread William Barker
Using: Apache 1.3.17 TC3.3 B1 Ajp13 Java 1.3.1 making the request http://myserver/%3f%41%3d%42.jsp was interpreted as a request for the file /?A=B.jsp. JspInterceptor then happily creates a page containing the contents of the ROOT directory. The attached patch forbids such silliness.

cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/util RequestUtil.java

2001-08-15 Thread craigmcc
craigmcc01/08/15 16:19:55 Modified:catalina/src/share/org/apache/catalina/connector HttpRequestBase.java catalina/src/share/org/apache/catalina/util RequestUtil.java Log: Fix 2 bugs in the implementation of

cvs commit: jakarta-tomcat-4.0/tester/web/WEB-INF web.xml

2001-08-15 Thread craigmcc
craigmcc01/08/15 16:44:24 Modified:tester/src/bin tester.xml tester/web/WEB-INF web.xml Added: tester/src/tester/org/apache/tester Forward09.java Include09.java Log: Add unit tests for ServletRequest.getRequestDispatcher(), with both

cvs commit: jakarta-tomcat-4.0/tester/src/tester/org/apache/tester Jndi01.java Jndi02.java

2001-08-15 Thread craigmcc
craigmcc01/08/15 17:01:34 Modified:tester/src/tester/org/apache/tester Jndi01.java Jndi02.java Log: Add references to application level beans from init() and destroy() methods. The beans are accessed from: * /WEB-INF/classes via webapp class loader * /WEB-INF/lib/*.jar via

cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/util/io FileUtil.java

2001-08-15 Thread costin
costin 01/08/15 17:19:20 Modified:src/share/org/apache/tomcat/util/io FileUtil.java Log: Fix for 2033. Thanks to [EMAIL PROTECTED] (James Thomas) for the fix Revision ChangesPath 1.6 +10 -4 jakarta-tomcat/src/share/org/apache/tomcat/util/io/FileUtil.java

cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/util/compat Jdk11Compat.java Jdk12Support.java

2001-08-15 Thread costin
costin 01/08/15 17:20:47 Modified:src/share/org/apache/tomcat/util/compat Jdk11Compat.java Jdk12Support.java Log: Added getParentLoader to the jdk compat package. It's used in few places, better have a 1.1 compatible way. Revision ChangesPath

cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/util/depend DependClassLoader.java

2001-08-15 Thread costin
costin 01/08/15 17:22:17 Modified:src/share/org/apache/tomcat/util/depend DependClassLoader.java Log: Fix for reloading bug reported by Ovidiu Predescu. Now DependClassLoader will be used to define the classes instead of the wrapped classloader, and all

cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/modules/server JNIConnectionHandler.java

2001-08-15 Thread costin
costin 01/08/15 17:26:14 Modified:src/share/org/apache/tomcat/modules/server JNIConnectionHandler.java Log: Few fixes and usability enhancements to JNIConnectionHandler. The native library is loaded only if we're in native mode, the module is

cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/modules/config ApacheConfig.java

2001-08-15 Thread costin
costin 01/08/15 17:27:07 Modified:src/share/org/apache/tomcat/modules/config ApacheConfig.java Log: Added 'inprocess' to the list of jkProtocols. Revision ChangesPath 1.24 +3 -3 jakarta-tomcat/src/share/org/apache/tomcat/modules/config/ApacheConfig.java

cvs commit: jakarta-tomcat/src/native/mod_jk/apache2.0 Makefile.linux

2001-08-15 Thread costin
costin 01/08/15 17:33:52 Modified:src/native/mod_jk/apache2.0 Makefile.linux Log: Uncomment ifdef APXS, some people may use different locations. ( this is a local fix, j-t-c uses configure already ) Revision ChangesPath 1.6 +2 -2

cvs commit: jakarta-tomcat/src/etc jni_server.xml

2001-08-15 Thread costin
costin 01/08/15 17:34:50 Removed: src/etc jni_server.xml Log: Removed jni_server.xml, it's no longer needed.

cvs commit: jakarta-tomcat/src/etc modules.xml

2001-08-15 Thread costin
costin 01/08/15 17:35:40 Modified:src/etc modules.xml Log: Added module definitions for the connectors. Typing the class name requires too many keystrokes :-) Revision ChangesPath 1.11 +8 -0 jakarta-tomcat/src/etc/modules.xml Index: modules.xml

cvs commit: jakarta-tomcat/src/etc server.xml

2001-08-15 Thread costin
costin 01/08/15 17:38:06 Modified:src/etc server.xml Log: Uncomment JniConnector, it'll now sit inactive unless jni mode is detected. Use the short module name instead of class=, for consistency. Revision ChangesPath 1.86 +10 -19

FW: catalina SSL

2001-08-15 Thread Pier P. Fumagalli
OH SSL GURU! :) :) Do you have any clue (Reply to all so it'll go in tomcat-users too!) Pier -- Forwarded Message From: cib [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 15 Aug 2001 20:17:58 +0200 To: Tomcat User Mail list [EMAIL PROTECTED] Subject: catalina SSL Hi I'm

Re: catalina SSL

2001-08-15 Thread Pier P. Fumagalli
Pier P. Fumagalli at [EMAIL PROTECTED] wrote: OH SSL GURU! :) :) Do you have any clue (Reply to all so it'll go in tomcat-users too!) Darn, I placed tomcat-dev instead of tomcat user... :) Me big dope :) Pier

cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/apache/naming/resources FileDirContext.java

2001-08-15 Thread craigmcc
craigmcc01/08/15 17:57:18 Modified:catalina/src/share/org/apache/naming/resources FileDirContext.java Log: Sort the directory listing returned when there is no welcome page (and directory listings are not suppressed) for webapps that are unpacked into a

cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/apache/naming/resources WARDirContext.java

2001-08-15 Thread craigmcc
craigmcc01/08/15 18:20:05 Modified:catalina/src/share/org/apache/naming/resources WARDirContext.java Log: Sort entries in directory lists for WAR-based webapps also. PR: Bugzilla #3104 Submitted by: [EMAIL PROTECTED] Revision ChangesPath

Re: FW: catalina SSL

2001-08-15 Thread Craig R. McClanahan
On Thu, 16 Aug 2001, Pier P. Fumagalli wrote: OH SSL GURU! :) :) Do you have any clue (Reply to all so it'll go in tomcat-users too!) Pier -- Forwarded Message From: cib [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Wed, 15 Aug 2001 20:17:58 +0200 To: Tomcat User

Re: FW: catalina SSL

2001-08-15 Thread Christopher Cain
Quoting Craig R. McClanahan [EMAIL PROTECTED]: On Thu, 16 Aug 2001, Pier P. Fumagalli wrote: OH SSL GURU! :) :) Do you have any clue (Reply to all so it'll go in tomcat-users too!) Don't worry, baby. The SSL doctor is in session ;-) Hi I'm getting used to Tomcat but not enough

cvs commit: jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/core StandardWrapper.java

2001-08-15 Thread craigmcc
craigmcc01/08/15 19:46:52 Modified:catalina/src/share/org/apache/catalina/core StandardWrapper.java Log: Do not allow an unload() operation to begin if there are any current requests executing within this servlet. This fixes a potential race condition

cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/core Context.java

2001-08-15 Thread larryi
larryi 01/08/15 21:50:30 Modified:src/share/org/apache/tomcat/core Context.java Log: Still figurine out virtual hosts, but I think virtual host ip address will be needed for writing config files should the host name not be an ip address. Revision ChangesPath 1.147

cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/modules/config ContextXmlReader.java

2001-08-15 Thread larryi
larryi 01/08/15 21:52:56 Modified:src/share/org/apache/tomcat/modules/config ContextXmlReader.java Log: Add rule for address parameter on Host tag. It will set a Context's hostAddress property. Revision ChangesPath 1.9 +3 -0

cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/modules/config ApacheConfig.java

2001-08-15 Thread larryi
larryi 01/08/15 22:22:41 Modified:src/share/org/apache/tomcat/modules/config ApacheConfig.java Log: Update to avoid writing duplicate NameVirtualHost directives. Also, if the context's host name is an ip address, or a host ip address is specified, then that address is used

cvs commit: jakarta-tomcat/src/share/org/apache/tomcat/modules/config JservConfig.java

2001-08-15 Thread larryi
larryi 01/08/15 22:24:14 Modified:src/share/org/apache/tomcat/modules/config JservConfig.java Log: Updated to have features similar to ApacheConfig. Revision ChangesPath 1.3 +467 -199 jakarta-tomcat/src/share/org/apache/tomcat/modules/config/JservConfig.java