-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alejandro,

On 7/30/12 5:48 PM, Alejandro Mehring wrote:
> I'm migrating to Tomcat 7 a web system that used to run on Tomcat
> 4...

Been there (though I went through 5.5 and 6.0 to get there in a
relatively short amount of time).

> So far, I've been able to sort out all of the issues I've faced,
> but I'm stuck at one point. When a page loads in Tomcat 4, it goes
> and fetches the stylesheet from the server with a link of the form
> 
> <link type="text/css" href="../lightStyle.css" rel="stylesheet">

Although this should work, I always recommend using context-relative
URLs like this:

<link type="text/css" href="<%=
response.encodeURL(request.getContextPath() + "/lightStyle.css") %>" />

This will ensure that your URLs resolve properly no matter how the
.jsp is being evaluated (for instance, in an include or after a
forward, where the client's URL may not match what your JSP expects).

> But on Tomcat 7, the parent directory indirection is removed, and I
> can't seem to find the way to prevent this from happening!

That doesn't seem right.

> What confuses me more, is that when Tomcat generates the *_jsp.java
> files, both 4 and 7 versions generate a line of code like this
> one:
> 
> out.write("<link rel=\"stylesheet\" href=\"../lightStyle.css\" 
> type=\"text/css\">\r\n\r\n");
> 
> So i can't figure out why the rendering process is removing the
> '../' bit of the link!

I have a hard time believing that Tomcat is modifying anything: in the
case above, Tomcat does not interpret anything at all. As far as
Tomcat is concerned, the above is just a string of characters like
"Hello, World" and has no URL context or anything like that.

Are you sure this isn't being included by another JSP or forwarded
from another URL?

> Has anyone faced this problem before? I haven't found any parent
> directory restriction configuration or something that would point
> me in that direction.

What does the output of the JSP look like? That is, what is the actual
content of the page as seen by the client?

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAlAXLn4ACgkQ9CaO5/Lv0PDiHQCgsxBv7KqRAX7JkpKb2Se0S83R
aQ8AnRpgtWMK7sCy7EDT1uej9ySVStll
=sO4e
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Reply via email to