Hi Dave --
Thanks for the tips! Regarding your point (2), my roller-
custom.properties defines three paths similar to this:
mediafiles.storage.dir=/opt/db/rollermedia/mediafiles
search.index.dir=/opt/db/rollermedia/searchindex
log4j.appender.roller.File=/opt/db/rollermedia/roller.log
The first two paths work as expected but the roller.log files are being
dropped directly in tomcat/bin. Not sure if this is important for the
moment.
The index files are being created as expected. Some general context:
this blog is running on Tomcat 9.0.112 standalone (no Apache HTTP
server), on Alma Linux 9.8 (5.14.0 kernel). From roller log:
INFO 2026-09-09 08:08:19 [main] SpringSecurityCoreVersion - You are
running with Spring Security Core 5.8.14
No clear errors anywhere but there are a few warnings coming up:
WARN 2026-09-09 08:41:37 [main] RealmVerifier - RP discovery / realm
validation disabled;
WARN 2026-09-09 08:41:47 [main] DefaultExcludedPatternsChecker -
Replacing excluded patterns
[[.*(^|\.|\[|\'|"|get)class(\(\.|\[|\'|").*,
(^|\%\{)((#?)(top(\.|\['|\[")|\[\d\]\.)?)(dojo|struts|session|request|r
esponse|application|servlet(Request|Response|Context)|parameters|contex
t|_memberAccess)(\.|\[).*]] with [[^method:.*, ^action:.*]], be aware
that this affects all instances and safety of your application!
WARN 2026-09-09 08:41:47 [main] PackageBasedActionConfigBuilder - The
includeJars pattern [false] did not match any jars in the classpath
WARN 2026-09-09 08:43:55 [https-jsse-nio-443-exec-2]
SpringFirewallExceptionFilter - request rejected:
https://<hostname>/roller-
ui/styles/roller.css;jsessionid=42678FED7B8998D7B03C7CC5C76A30CF cause:
The request was rejected because the URL contained a potentially
malicious String ";"
WARN 2026-09-09 08:48:02 [https-jsse-nio-443-exec-6] introspection -
Cannot retrieve method notify from object of class
org.apache.roller.weblogger.ui.rendering.util.WeblogEntryCommentForm
due to security restrictions.
The last two look suspicious. Tomcat is enforcing https sitewide but
this is the main page search, in other words, outside of login-
protected pages.
Thanks for your thoughts!
Richard
On Tue, 2026-09-08 at 16:19 -0400, Dave wrote:
> Hi Richard,
>
> I don't think this is a CSP or a 6.1.6 change, but I could be wrong.
>
> To get to the bottom of it:
>
> 1. Turn on search debug logging: in the deployed WAR, edit
> WEB-INF/classes/log4j2.xml and add this inside <Loggers>:
>
> <Logger name="org.apache.roller.weblogger.business.search"
> level="debug"
> additivity="false"><AppenderRef ref="asyncRoller"/></Logger>
>
> Restart, then watch logs/roller.log. You'll see lines like "index
> dir:
> <path>", "search enabled: true", "Rebuilding index in the
> background...",
> or "Failed to open search index...".
>
> 2. Confirm the resolved "index dir:" path from that log is what you
> expect
> (property expansion can surprise you), that it's writable by the
> Tomcat
> user, and that Lucene segment files appear in it after a rebuild.
>
> 3. Force a clean rebuild: stop Roller, delete the contents of the
> search-index directory, start Roller -- it rebuilds automatically
> from
> published entries.
>
> 4. Sanity checks: the entries are published (drafts aren't indexed),
> you're
> searching the weblog that owns them (the index is per-weblog), and
> try a
> single common word first -- the parser ANDs multiple terms together.
>
> If it still returns nothing after that, send me the search-related
> lines
> from roller.log and I'll dig in.
>
> Dave
>
> On Tue, Sep 08, 2026 11:42 AM, Richard via user
> <[email protected]>
> wrote:
>
> > Hi Dave --
> >
> > Thanks for your response on the missing icons. Another issue I'm
> > seeing on 6.1.6 RC1 is the full text search feature is consistently
> > returning zero results. I've done the obvious things like try the
> > "Rebuild Search Index" button in the Weblog Maintenance page and
> > even
> > changed the mediafiles.storage.dir and search.index.dir directories
> > in
> > roller-custom.properties. Could this be related to the CSP
> > changes?
> > If not, could you suggest some troubleshooting tips here (like ways
> > to
> > enable debug logging for search, etc.)?
> >
> > Thanks!
> > Richard
> >
> >
> > [PR] Fix blank Font Awesome icons in preset themes (CSP font-src)
> > and
> > document H2 VALUE workaround [roller]
> >
> > snoopdave opened a new pull request, #183:
> > URL: https://github.com/apache/roller/pull/183
> >
