On Tue, 20 Mar 2001, Glenn Nielsen wrote:
> "Craig R. McClanahan" wrote:
> >
> > There have been a large number of feature additions and bug fixes to the
> > Tomcat 4.0 code base since Tomcat 4.0-beta-1 was published in
> > January. This includes implementation of some changes to the servlet API
> > that have been approved by the JSR-053 expert group, and a fix for a cross
> > site JavaScript vulnerability that was reported over the weekend.
> >
>
> More items for the B2 changes document:
>
> Implemented the Java SecurityManager.
>
> Added the <DefaultContext .. /> element for configuration of defaults
> for a Context which can be used in either the Engine or Host scope.
>
Hmm, I thought I said both of these (under "new features"), but can make
them more explicit. One of my personal TODOs is to catch up on the rest
of the server.xml configuration docs.
> Switched Jasper over to using the URLClassLoader, put JSP java source
> code and compiled class files in a directory hierarchy and simplified
> the class and file naming. This improved Jasper compilation performance
> by 33% and runtime performance by 25%.
>
Thanks, I'll include the actual numbers as well.
> > I propose that we cut a Tomcat 4.0-Beta-2 release that reflects these
> > changes and improvements. The proposed schedule:
> > * Release manager: Craig McClanahan
> > * Code freeze in the "jakarta-tomcat-4.0" repository, except for approved
> > but fixes, through Thursday (March 22, 2001).
> > * Tag and release 4.0-beta-2 on Thursday night.
> > * Open repository for further enhancements on Friday.
> >
> > Before voting, you might want to see my subsequent message on overall
> > Tomcat 4.0 planning and strategy.
> >
> > ----- Clip and Return This Portion -----
> >
> > +1 [ ] I support the proposed release, and will work to support it
> > +0 [ ] I support the proposed release, but cannot work on it
> > at this time
> > -0 [ ] I do not support the proposed release, but do not have an
> > alternative to propose
> > -1 [ ] I do not support the proposed release, for reasons specified
> > below.
> >
> > Craig McClanahan (who votes +1)
>
> -1 This is pretty short notice to release Beta 2. I haven't had a chance
> yet to test the new mod_webapp code. I also would like to get my proposed
> changes to how Tomcat unpacks web apps and the manager servlet done, I consider
> some of this to be a bug fix. I should have these changes done in 2-4 days.
> I would suggest waiting until the 27-30'th, get it out before ApacheCon.
>
Are we willing to wait for the security bugfix? You can have the fix now
by downloading the nightly build, but most people wait for betas.
I need to add a note about mod_webapp to the "Known Issues" section. It's
getting better, but still not at the same quality level as the rest of
4.0.
> Regards,
>
> Glenn
>
Craig
