The only problem I see by removing the package org.apache.jsp is that when Tomcat run under the security manager, it is no longer possible to protect an application from package insertion/access (dangerous).

It is still possible to protect the application by manually adding the new package name under the conf/tomcat.properties file. This will have to be documented somewhere.

-- Jeanfrancois


Remy Maucherat wrote:

Hans Bergsten wrote:

Remy Maucherat wrote:
See my previous mail; you do _not_ need to have a package statement
for the generated servlet class. Adding it just complicates life.

Ooops, sorry, I'm trying to do plenty of things at once, and misunderstood your reply.
I'll remove the org.apache.jsp since it's not needed.

As long as there's no prefix added to the package name, yes. If you
add a package name prefix, the JspC in TC 4.1.18 (with the patch we're
talking about here) generates "package org.apache.jsp.foo;" for a
JSP page in the context-relative dir "foo" and places the class file
in "<JspC-outdir>/foo". Hence, a structure mismatch that will cause
confusion.

Indeed.

Remy


--
To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>



--
To unsubscribe, e-mail:   <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>

Reply via email to