You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@velocity.apache.org by Robin Mannering <ro...@hotmail.com> on 2006/10/10 12:07:59 UTC
Velocity Config/Security Issue
Hi all,
I'm new back on this list in a while, please excuse if the following problem
is obvious/has been posted before.
I am transferring an existing site based on Struts/Velocity to a new web
hosting provider. The application runs smoothly on its current host.
However, there seems to be one last stumbling block with the new server in
that the Struts object; 'request' appears not to be in scope within velocity
pages (there may be others not in scope).
I'm using the VelocityLayoutServlet if that helps.
I've attached a snippet of the log file that points to the problem I
mentioned, notable the 'java.security.AccessControlException' and
'$request.contextPath is not a valid reference'
All other velocity directives appear to be functioning as normal.
Has anyone seen this behaviour before? Any help would be greatly
appreciated.
Kind regards
Robin
10-Oct 02:45:21.752 |INFO | [/].log
| Velocity [info] ResourceManager : found /pages/frontend/home.vm
with loader org.apache.velocity.tools.view.servlet.WebappLoader
10-Oct 02:45:21.761 |INFO | [/].log
| Velocity [error] PROGRAMMER ERROR : PropertyExector() :
java.security.AccessControlException: access denied
(java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core)
10-Oct 02:45:21.763 |INFO | [/].log
| Velocity [error] ASTIdentifier.execute() : identifier = contextPath
: java.security.AccessControlException: access denied
(java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core)
10-Oct 02:45:21.764 |INFO | [/].log
| Velocity [error] RHS of #set statement is null. Context will not be
modified. /pages/frontend/home.vm [line 9, column 1]
10-Oct 02:45:21.772 |INFO | [/].log
| Velocity [error] PROGRAMMER ERROR : PropertyExector() :
java.security.AccessControlException: access denied
(java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core)
10-Oct 02:45:21.773 |INFO | [/].log
| Velocity [error] ASTIdentifier.execute() : identifier = contextPath
: java.security.AccessControlException: access denied
(java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core)
10-Oct 02:45:21.774 |INFO | [/].log
| Velocity [warn]
org.apache.velocity.runtime.exception.ReferenceException: reference :
template = /pages/frontend/home.vm [line 32,column 34] :
$request.contextPath is not a valid reference.
_________________________________________________________________
Windows Live Messenger has arrived. Click here to download it for free!
http://imagine-msn.com/messenger/launch80/?locale=en-gb
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Robin Mannering <ro...@hotmail.com>.
Hi Will,
Many thanks for taking the time to look into this issue for me!
It think I'll ask for implementation of the first solution.
Thanks again, I should be able to move forward now.
Cheers
Robin
>From: "Will Glass-Husain" <wg...@forio.com>
>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>To: "Velocity Users List" <ve...@jakarta.apache.org>
>Subject: Re: Velocity Config/Security Issue
>Date: Sun, 15 Oct 2006 01:36:43 -0700
>
>Hi Robin,
>
>I set up a test server and duplicated this issue. Here's the
>specifics of what's going on with a suggested solution (long email).
>
>By default, the Tomcat security manager policy prohibits reflection on
>classes in the org.catalina hierarchy. This prevents web apps from
>instantiating internal classes and doing things it shouldn't be doing.
>
>When you write a JSP page that calls <%= request.getSession().getId()
>%> this is literally compiled into a class. Since the code is called
>directly, it works fine.
>
>As a contrast, when Velocity calls $request.session.id it uses
>reflection. Since the $request reference is actually implemented by
>org.apache.catalina.connector.RequestFacade (in Tomcat 5.5) any method
>calls using reflection throw a security exception.
>
>There are two possible solutions.
>
>(1) Your hosting provider should add the following to the security
>policy. Note it is very specific - just applies to the two velocity
>jars. You'll need to change the path to match your webapp.
>
>grant codeBase
>"file:${catalina.home}/webapps/simple/WEB-INF/lib/velocity-1.4.jar"
>{
> permission java.lang.RuntimePermission
>"accessClassInPackage.org.apache.catalina.connector";
> permission java.lang.RuntimePermission
>"accessClassInPackage.org.apache.catalina.session";
> permission java.lang.RuntimePermission
>"accessClassInPackage.org.apache.catalina.core";
>};
>
>
>grant codeBase
>"file:${catalina.home}/webapps/simple/WEB-INF/lib/velocity-tools-view-1.2.jar"
>{
> permission java.lang.RuntimePermission
>"accessClassInPackage.org.apache.catalina.connector";
> permission java.lang.RuntimePermission
>"accessClassInPackage.org.apache.catalina.session";
> permission java.lang.RuntimePermission
>"accessClassInPackage.org.apache.catalina.core";
>};
>
>(2) You can create your own implementations of HttpServletRequest and
>HttpSession that simply delegate to the app server versions. Since
>your classes are outside of the org.catalina hierarchy there will be
>no reflection-related security issues. Then add your new wrapper to
>the context with the same name "request".
>
>To sum up, this issue is due to the use of reflection by Velocity and
>a strict security policy in Tomcat. Either changing the security
>policy or changing the target of the reflection would solve the
>problem.
>
>I'm going to post a JIRA issue to the Velocity Tools list suggesting
>that the project add a wrapper for $request to eliminate this issue.
>
>Best, WILL
>
>On 10/13/06, Robin Mannering <ro...@hotmail.com> wrote:
>>Hi Will,
>>
>>Originally, any request to the $request object were just being ignored (or
>>were throwing security exceptions). So the Velocity page just output
>>$request into the HTML.
>>
>>He then granted permission on the below package uisng the security manager
>>and the request object was then 'working' although it was putting out the
>>incorrect values. The exceptions in the log then disappeared.
>>
>>Then, he ran the application without the Security manager and the $request
>>object had expected values for methods such $request.contextPath and
>>$request.session.id and everything worked fine.
>>
>>I'm unfamiliar with Security Managers, shall I ask him to apply just this
>>one? (This has no reference to Velocity classes does it?)
>>
>>java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core
>>
>>As an extra, do you know of a hosting company that has established clients
>>using Velocity? I might do well to move somewhere with direct experience
>>of
>>hosting with velocity.
>>
>>Thanks for all your help
>>Robin
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
_________________________________________________________________
Be the first to hear what's new at MSN - sign up to our free newsletters!
http://www.msn.co.uk/newsletters
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Will Glass-Husain <wg...@forio.com>.
Hi Robin,
I set up a test server and duplicated this issue. Here's the
specifics of what's going on with a suggested solution (long email).
By default, the Tomcat security manager policy prohibits reflection on
classes in the org.catalina hierarchy. This prevents web apps from
instantiating internal classes and doing things it shouldn't be doing.
When you write a JSP page that calls <%= request.getSession().getId()
%> this is literally compiled into a class. Since the code is called
directly, it works fine.
As a contrast, when Velocity calls $request.session.id it uses
reflection. Since the $request reference is actually implemented by
org.apache.catalina.connector.RequestFacade (in Tomcat 5.5) any method
calls using reflection throw a security exception.
There are two possible solutions.
(1) Your hosting provider should add the following to the security
policy. Note it is very specific - just applies to the two velocity
jars. You'll need to change the path to match your webapp.
grant codeBase "file:${catalina.home}/webapps/simple/WEB-INF/lib/velocity-1.4.jar"
{
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.connector";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.session";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.core";
};
grant codeBase "file:${catalina.home}/webapps/simple/WEB-INF/lib/velocity-tools-view-1.2.jar"
{
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.connector";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.session";
permission java.lang.RuntimePermission
"accessClassInPackage.org.apache.catalina.core";
};
(2) You can create your own implementations of HttpServletRequest and
HttpSession that simply delegate to the app server versions. Since
your classes are outside of the org.catalina hierarchy there will be
no reflection-related security issues. Then add your new wrapper to
the context with the same name "request".
To sum up, this issue is due to the use of reflection by Velocity and
a strict security policy in Tomcat. Either changing the security
policy or changing the target of the reflection would solve the
problem.
I'm going to post a JIRA issue to the Velocity Tools list suggesting
that the project add a wrapper for $request to eliminate this issue.
Best, WILL
On 10/13/06, Robin Mannering <ro...@hotmail.com> wrote:
> Hi Will,
>
> Originally, any request to the $request object were just being ignored (or
> were throwing security exceptions). So the Velocity page just output
> $request into the HTML.
>
> He then granted permission on the below package uisng the security manager
> and the request object was then 'working' although it was putting out the
> incorrect values. The exceptions in the log then disappeared.
>
> Then, he ran the application without the Security manager and the $request
> object had expected values for methods such $request.contextPath and
> $request.session.id and everything worked fine.
>
> I'm unfamiliar with Security Managers, shall I ask him to apply just this
> one? (This has no reference to Velocity classes does it?)
>
> java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core
>
> As an extra, do you know of a hosting company that has established clients
> using Velocity? I might do well to move somewhere with direct experience of
> hosting with velocity.
>
> Thanks for all your help
> Robin
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Robin Mannering <ro...@hotmail.com>.
Hi Will,
Originally, any request to the $request object were just being ignored (or
were throwing security exceptions). So the Velocity page just output
$request into the HTML.
He then granted permission on the below package uisng the security manager
and the request object was then 'working' although it was putting out the
incorrect values. The exceptions in the log then disappeared.
Then, he ran the application without the Security manager and the $request
object had expected values for methods such $request.contextPath and
$request.session.id and everything worked fine.
I'm unfamiliar with Security Managers, shall I ask him to apply just this
one? (This has no reference to Velocity classes does it?)
java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core
As an extra, do you know of a hosting company that has established clients
using Velocity? I might do well to move somewhere with direct experience of
hosting with velocity.
Thanks for all your help
Robin
>From: "Will Glass-Husain" <wg...@forio.com>
>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>To: "Velocity Users List" <ve...@jakarta.apache.org>
>Subject: Re: Velocity Config/Security Issue
>Date: Fri, 13 Oct 2006 01:13:12 -0700
>
>Robin,
>
>Haven't yet checked this out.
>
>But your IT manager says "have to do more testing to see which
>security grant it needs". Actually, your error log shows this
>clearly. You need
>
>java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core
>
>WILL
>
>On 10/12/06, Robin Mannering <ro...@hotmail.com> wrote:
>>Hi Will,
>>
>>Thanks for your help, let me know if there is anything I can do.
>>
>>I have a fear my hosting provider cannot commit the resources to solving
>>this problem anytime soon.
>>
>>Thanks
>>Robin
>>
>>
>> >From: "Will Glass-Husain" <wg...@forio.com>
>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >Subject: Re: Velocity Config/Security Issue
>> >Date: Thu, 12 Oct 2006 04:59:38 -0700
>> >
>> >I'll play around with this. Might be a day or so.
>> >
>> >On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>> >>
>> >>Hi,
>> >>
>> >>Sorry I forgot the velocity version: Velocity 1.4
>> >>
>> >> >From: "Will Glass-Husain" <wg...@forio.com>
>> >> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >Subject: Re: Velocity Config/Security Issue
>> >> >Date: Wed, 11 Oct 2006 15:54:51 -0700
>> >> >
>> >> >One more question. What's your platform
>> >> >-- version of Tomcat
>> >> >-- version of JDK
>> >> >-- Win, Linux, etc?
>> >> >
>> >> >(and to repeat the last email for redundancy)
>> >> >-- VelocityServlet or VelocityViewServlet (with version)
>> >> >
>> >> >I run an instance of Tomcat with a security policy. I've found
>> >> >numerous inconsistencies even within Tomcat that require security
>> >> >permissions to be opened up. (There was a bug with the 4.1.x series
>> >> >for example for which I had to open up something similar).
>> >> >
>> >> >I tend to think you've hit a Tomcat bug triggered by the way Velocity
>> >> >accesses the request object. Send the info back and we can dig into
>> >> >this.
>> >> >
>> >> >WILL
>> >> >
>> >> >On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>> >> >>Sorry, some more logging that might make it clearer.
>> >> >>
>> >> >>My local machine uses request objects:
>> >> >>org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce
>> >> >>and
>> >> >>org.apache.catalina.core.ApplicationHttpRequest@1e389b8
>> >> >>
>> >> >>Whereas the hosted server with the problem uses:
>> >> >>org.apache.catalina.connector.RequestFacade@121d818
>> >> >>and
>> >> >>org.apache.catalina.core.ApplicationHttpRequest@76f954
>> >> >>
>> >> >>
>> >> >>
>> >> >>Log 1 - From action class running on hosted server
>> >> >>--------------------------------------------------
>> >> >>11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
>> >> >> | request =
>>'org.apache.catalina.connector.RequestFacade@121d818'
>> >> >>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> >> >> | request.getContextPath() = ''
>> >> >>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> >> >> | request.getMethod() = 'GET'
>> >> >>11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
>> >> >> | request.getSession().getId() =
>> >>'28536F4542A222DC6F0E6DE23442DC6D'
>> >> >>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> >> >> | request.getRequestURI() = '/test.htm'
>> >> >>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> >> >> | request.getRequestURL() =
>> >>'http://www.chaletexplorer.com/test.htm'
>> >> >>11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
>> >> >> | request.getServletPath() = '/test.htm'
>> >> >>
>> >> >>
>> >> >>Log 2 - From VM Template/page running on hosted server
>> >> >>------------------------------------------------------
>> >> >>request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
>> >> >>request.contextPath = '/'
>> >> >>request.method = 'GET'
>> >> >>request.session.id = '$request.session.id'
>> >> >>request.requestURI = '//test.vm'
>> >> >>request.requestURL = 'http://www.chaletexplorer.com//test.vm'
>> >> >>request.servletPath = '/test.vm'
>> >> >>
>> >> >>
>> >> >>Log 3 - From action class (running on my local machine)
>> >> >>-------------------------------------------------------
>> >> >>
>> >> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> >> >> | request =
>> >>'org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce'
>> >> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> >> >> | request.getContextPath() = '/indy'
>> >> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> >> >> | request.getMethod() = 'GET'
>> >> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> >> >> | request.getSession().getId() =
>> >>'79E50B9B3F25A2897BF420521952D51F'
>> >> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> >> >> | request.getRequestURI() = '/indy/test.htm'
>> >> >>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
>> >> >> | request.getRequestURL() =
>>'http://localhost:8080/indy/test.htm'
>> >> >>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
>> >> >> | request.getServletPath() = '/test.htm'
>> >> >>
>> >> >>
>> >> >>Log 4 - From VM Template/page (running on my local machine)
>> >> >>-----------------------------------------------------------
>> >> >>request = 'org.apache.catalina.core.ApplicationHttpRequest@1e389b8'
>> >> >>request.contextPath = '/indy'
>> >> >>request.method = 'GET'
>> >> >>request.session.id = '79E50B9B3F25A2897BF420521952D51F'
>> >> >>request.requestURI = '/indy/test.vm'
>> >> >>request.requestURL = 'http://localhost:8080/indy/test.htm'
>> >> >>request.servletPath = '/test.vm'
>> >> >>
>> >> >>
>> >> >>
>> >> >>--------------------------------------------------
>> >> >>
>> >> >>
>> >> >> >From: "Robin Mannering" <ro...@hotmail.com>
>> >> >> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >> >To: velocity-user@jakarta.apache.org
>> >> >> >Subject: Re: Velocity Config/Security Issue
>> >> >> >Date: Wed, 11 Oct 2006 22:08:29 +0000
>> >> >> >
>> >> >> >Hi all,
>> >> >> >
>> >> >> >Can anyone shed some light? I have some more facts now....
>> >> >> >
>> >> >> >The original problem was Velocity required permission on a core
>> >>package
>> >> >> >within catalina. Is this because it couldn't find the 'correct'
>> >>request
>> >> >> >object.
>> >> >> >
>> >> >> >Here are some logs, the first is from a Struts action class, the
>> >>second
>> >> >>is
>> >> >> >output from the velocity template forwarded to immediately after
>>the
>> >> >>action
>> >> >> >class. They refer to different request objects that ultimately
>>give
>> >> >> >different values. Should the velocity template not also refer to
>> >> >> >org.apache.catalina.connector.RequestFacade@121d818 ??
>> >> >> >
>> >> >> >Any help/clues would be greatly appreciated.
>> >> >> >
>> >> >> >Log 1 - From action class
>> >> >> >----------------------------------
>> >> >> >11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
>> >> >> > | request =
>> >>'org.apache.catalina.connector.RequestFacade@121d818'
>> >> >> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> >> >> > | request.getContextPath() = ''
>> >> >> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> >> >> > | request.getMethod() = 'GET'
>> >> >> >11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
>> >> >> > | request.getSession().getId() =
>> >>'28536F4542A222DC6F0E6DE23442DC6D'
>> >> >> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> >> >> > | request.getRequestURI() = '/test.htm'
>> >> >> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> >> >> > | request.getRequestURL() =
>> >> >>'http://www.chaletexplorer.com/test.htm'
>> >> >> >11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
>> >> >> > | request.getServletPath() = '/test.htm'
>> >> >> >
>> >> >> >Log 2 - From VM Template/page
>> >> >> >-----------------------------
>> >> >> >request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
>> >> >> >
>> >> >> >request.contextPath = '/'
>> >> >> >
>> >> >> >request.method = 'GET'
>> >> >> >
>> >> >> >request.session.id = '$request.session.id'
>> >> >> >
>> >> >> >request.requestURI = '//test.vm'
>> >> >> >
>> >> >> >request.requestURL = 'http://www.chaletexplorer.com//test.vm'
>> >> >> >
>> >> >> >request.servletPath = '/test.vm'
>> >> >> >
>> >> >> >
>> >> >> >
>> >> >> >
>> >> >> >
>> >> >> >
>> >> >> >
>> >> >> >>From: "Will Glass-Husain" <wg...@forio.com>
>> >> >> >>Reply-To: "Velocity Users List"
>><ve...@jakarta.apache.org>
>> >> >> >>To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >> >>Subject: Re: Velocity Config/Security Issue
>> >> >> >>Date: Wed, 11 Oct 2006 06:25:35 -0700
>> >> >> >>
>> >> >> >>I don't think it's Velocity which requires that permission, I'm
>> >> >> >>guessing it's the request object which is ultimately provided by
>> >> >> >>Tomcat...
>> >> >> >>
>> >> >> >>WILL
>> >> >> >>
>> >> >> >>On 10/11/06, Robin Mannering <ro...@hotmail.com>
>>wrote:
>> >> >> >>>Hi Will,
>> >> >> >>>
>> >> >> >>>Thanks for the links, I'll give them a thorough read.
>> >> >> >>>
>> >> >> >>>I've been working with the hosting company who set up the server
>> >> >>config
>> >> >> >>>and
>> >> >> >>>they have give the application permission to
>> >>org.apache.catalina.core
>> >> >> >>>although they are troubled to do so.
>> >> >> >>>
>> >> >> >>>They seem very surprised that velocity requires this permission.
>> >> >> >>>
>> >> >> >>>Since they granted the permission, the problem has cleared up
>>and
>> >> >> >>>$request.contextPath now has a value within a velocity template
>> >> >>(although
>> >> >> >>>this has changed from an empty value to '/' so I need to make
>> >>source
>> >> >> >>>amendments. Not a problem, just worrying it takes on a new
>>value
>> >>in a
>> >> >> >>>different hosting environment.
>> >> >> >>>
>> >> >> >>>Thanks again for your help
>> >> >> >>>Robin
>> >> >> >>>
>> >> >> >>>
>> >> >> >>> >From: "Will Glass-Husain" <wg...@forio.com>
>> >> >> >>> >Reply-To: "Velocity Users List"
>> >><ve...@jakarta.apache.org>
>> >> >> >>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >> >>> >Subject: Re: Velocity Config/Security Issue
>> >> >> >>> >Date: Tue, 10 Oct 2006 15:04:32 -0700
>> >> >> >>> >
>> >> >> >>> >What app server are you using? This is a server configuration
>> >> >>issue.
>> >> >> >>> >If someone else set it up, you might also want to work with
>>them.
>> >> >> >>> >
>> >> >> >>> >If you're using Tomcat, check out:
>> >> >> >>>
>> >> >http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
>> >> >> >>> >
>> >> >> >>> >And you should read the Sun docs at:
>> >> >> >>>
>> >> >http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
>> >> >> >>> >
>> >> >> >>> >WILL
>> >> >> >>> >
>> >> >> >>> >On 10/10/06, Robin Mannering <ro...@hotmail.com>
>> >>wrote:
>> >> >> >>> >>Hi Will,
>> >> >> >>> >>
>> >> >> >>> >>thanks for your help. Sorry. I'm new to permissions, could
>>you
>> >> >>explain
>> >> >> >>>a
>> >> >> >>> >>little more for me please.
>> >> >> >>> >>
>> >> >> >>> >>Thanks
>> >> >> >>> >>Robin
>> >> >> >>> >>
>> >> >> >>> >>
>> >> >> >>> >> >From: "Will Glass-Husain" <wg...@forio.com>
>> >> >> >>> >> >Reply-To: "Velocity Users List"
>> >> >><ve...@jakarta.apache.org>
>> >> >> >>> >> >To: "Velocity Users List"
>><ve...@jakarta.apache.org>
>> >> >> >>> >> >Subject: Re: Velocity Config/Security Issue
>> >> >> >>> >> >Date: Tue, 10 Oct 2006 08:24:57 -0700
>> >> >> >>> >> >
>> >> >> >>> >> >Looks like the security policy on your app server needs to
>>be
>> >> >>tuned.
>> >> >> >>> >> >Have you tried giving the permission
>> >>java.lang.RuntimePermission
>> >> >>for
>> >> >> >>> >> >accessClassInPackage.org.apache.catalina.core?
>> >> >> >>> >> >
>> >> >> >>> >> >WILL
>> >> >> >>> >> >
>> >> >> >>> >> >On 10/10/06, Robin Mannering
>><ro...@hotmail.com>
>> >> >>wrote:
>> >> >> >>> >> >>Hi all,
>> >> >> >>> >> >>
>> >> >> >>> >> >>I'm new back on this list in a while, please excuse if the
>> >> >> >>>following
>> >> >> >>> >> >>problem
>> >> >> >>> >> >>is obvious/has been posted before.
>> >> >> >>> >> >>
>> >> >> >>> >> >>I am transferring an existing site based on
>>Struts/Velocity
>> >>to a
>> >> >> >>>new
>> >> >> >>> >>web
>> >> >> >>> >> >>hosting provider. The application runs smoothly on its
>> >>current
>> >> >> >>>host.
>> >> >> >>> >> >>
>> >> >> >>> >> >>However, there seems to be one last stumbling block with
>>the
>> >>new
>> >> >> >>>server
>> >> >> >>> >>in
>> >> >> >>> >> >>that the Struts object; 'request' appears not to be in
>>scope
>> >> >>within
>> >> >> >>> >> >>velocity
>> >> >> >>> >> >>pages (there may be others not in scope).
>> >> >> >>> >> >>
>> >> >> >>> >> >>I'm using the VelocityLayoutServlet if that helps.
>> >> >> >>> >> >>
>> >> >> >>> >> >>I've attached a snippet of the log file that points to the
>> >> >>problem
>> >> >> >>>I
>> >> >> >>> >> >>mentioned, notable the
>>'java.security.AccessControlException'
>> >> >>and
>> >> >> >>> >> >>'$request.contextPath is not a valid reference'
>> >> >> >>> >> >>
>> >> >> >>> >> >>All other velocity directives appear to be functioning as
>> >> >>normal.
>> >> >> >>> >> >>
>> >> >> >>> >> >>Has anyone seen this behaviour before? Any help would be
>> >>greatly
>> >> >> >>> >> >>appreciated.
>> >> >> >>> >> >>
>> >> >> >>> >> >>Kind regards
>> >> >> >>> >> >>Robin
>> >> >> >>> >> >>
>> >> >> >>> >> >>10-Oct 02:45:21.752 |INFO | [/].log
>> >> >> >>> >> >> | Velocity [info] ResourceManager : found
>> >> >> >>> >>/pages/frontend/home.vm
>> >> >> >>> >> >>with loader
>> >>org.apache.velocity.tools.view.servlet.WebappLoader
>> >> >> >>> >> >>10-Oct 02:45:21.761 |INFO | [/].log
>> >> >> >>> >> >> | Velocity [error] PROGRAMMER ERROR :
>> >>PropertyExector() :
>> >> >> >>> >> >>java.security.AccessControlException: access denied
>> >> >> >>> >> >>(java.lang.RuntimePermission
>> >> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >> >>> >> >>10-Oct 02:45:21.763 |INFO | [/].log
>> >> >> >>> >> >> | Velocity [error] ASTIdentifier.execute() :
>> >>identifier =
>> >> >> >>> >> >>contextPath
>> >> >> >>> >> >>: java.security.AccessControlException: access denied
>> >> >> >>> >> >>(java.lang.RuntimePermission
>> >> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >> >>> >> >>10-Oct 02:45:21.764 |INFO | [/].log
>> >> >> >>> >> >> | Velocity [error] RHS of #set statement is null.
>> >>Context
>> >> >> >>>will
>> >> >> >>> >>not
>> >> >> >>> >> >>be
>> >> >> >>> >> >>modified. /pages/frontend/home.vm [line 9, column 1]
>> >> >> >>> >> >>10-Oct 02:45:21.772 |INFO | [/].log
>> >> >> >>> >> >> | Velocity [error] PROGRAMMER ERROR :
>> >>PropertyExector() :
>> >> >> >>> >> >>java.security.AccessControlException: access denied
>> >> >> >>> >> >>(java.lang.RuntimePermission
>> >> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >> >>> >> >>10-Oct 02:45:21.773 |INFO | [/].log
>> >> >> >>> >> >> | Velocity [error] ASTIdentifier.execute() :
>> >>identifier =
>> >> >> >>> >> >>contextPath
>> >> >> >>> >> >>: java.security.AccessControlException: access denied
>> >> >> >>> >> >>(java.lang.RuntimePermission
>> >> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >> >>> >> >>10-Oct 02:45:21.774 |INFO | [/].log
>> >> >> >>> >> >> | Velocity [warn]
>> >> >> >>> >> >>org.apache.velocity.runtime.exception.ReferenceException:
>> >> >>reference
>> >> >> >>>:
>> >> >> >>> >> >>template = /pages/frontend/home.vm [line 32,column 34] :
>> >> >> >>> >> >>$request.contextPath is not a valid reference.
>> >> >> >>> >> >>
>> >> >> >>> >>
>> >> >> >>_________________________________________________________________
>> >> >> >>> >> >>Windows Liveďż˝ Messenger has arrived. Click here to
>>download
>> >>it
>> >> >>for
>> >> >> >>> >>free!
>> >> >> >>> >> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
>> >> >> >>> >> >>
>> >> >> >>> >> >>
>> >> >> >>> >>
>> >> >> >>>
>> >> >>
>> >>
>> >>---------------------------------------------------------------------
>> >> >> >>> >> >>To unsubscribe, e-mail:
>> >> >> >>>velocity-user-unsubscribe@jakarta.apache.org
>> >> >> >>> >> >>For additional commands, e-mail:
>> >> >> >>>velocity-user-help@jakarta.apache.org
>> >> >> >>> >> >>
>> >> >> >>> >> >>
>> >> >> >>> >> >
>> >> >> >>> >> >
>> >> >> >>> >> >--
>> >> >> >>> >> >Forio Business Simulations
>> >> >> >>> >> >
>> >> >> >>> >> >Will Glass-Husain
>> >> >> >>> >> >wglass@forio.com
>> >> >> >>> >> >www.forio.com
>> >> >> >>> >> >
>> >> >> >>> >>
>> >> >> >>>
>> >> >>
>> >---------------------------------------------------------------------
>> >> >> >>> >> >To unsubscribe, e-mail:
>> >> >>velocity-user-unsubscribe@jakarta.apache.org
>> >> >> >>> >> >For additional commands, e-mail:
>> >> >> >>>velocity-user-help@jakarta.apache.org
>> >> >> >>> >> >
>> >> >> >>> >>
>> >> >> >>>
>> >> >>_________________________________________________________________
>> >> >> >>> >>Be the first to hear what's new at MSN - sign up to our free
>> >> >> >>>newsletters!
>> >> >> >>> >>http://www.msn.co.uk/newsletters
>> >> >> >>> >>
>> >> >> >>> >>
>> >> >> >>>
>> >> >>
>> >>
>> >>---------------------------------------------------------------------
>> >> >> >>> >>To unsubscribe, e-mail:
>> >> >>velocity-user-unsubscribe@jakarta.apache.org
>> >> >> >>> >>For additional commands, e-mail:
>> >> >>velocity-user-help@jakarta.apache.org
>> >> >> >>> >>
>> >> >> >>> >>
>> >> >> >>> >
>> >> >> >>> >
>> >> >> >>> >--
>> >> >> >>> >Forio Business Simulations
>> >> >> >>> >
>> >> >> >>> >Will Glass-Husain
>> >> >> >>> >wglass@forio.com
>> >> >> >>> >www.forio.com
>> >> >> >>> >
>> >> >> >>>
>> >> >>
>> >---------------------------------------------------------------------
>> >> >> >>> >To unsubscribe, e-mail:
>> >>velocity-user-unsubscribe@jakarta.apache.org
>> >> >> >>> >For additional commands, e-mail:
>> >> >>velocity-user-help@jakarta.apache.org
>> >> >> >>> >
>> >> >> >>>
>> >> >>
>> >>>_________________________________________________________________
>> >> >> >>>Download the new Windows Live Toolbar, including Desktop search!
>> >> >> >>>http://toolbar.live.com/?mkt=en-gb
>> >> >> >>>
>> >> >> >>>
>> >> >>
>> >>
>> >>>---------------------------------------------------------------------
>> >> >> >>>To unsubscribe, e-mail:
>> >>velocity-user-unsubscribe@jakarta.apache.org
>> >> >> >>>For additional commands, e-mail:
>> >>velocity-user-help@jakarta.apache.org
>> >> >> >>>
>> >> >> >>>
>> >> >> >>
>> >> >> >>
>> >> >> >>--
>> >> >> >>Forio Business Simulations
>> >> >> >>
>> >> >> >>Will Glass-Husain
>> >> >> >>wglass@forio.com
>> >> >> >>www.forio.com
>> >> >> >>
>> >> >>
>> >>
>> >>---------------------------------------------------------------------
>> >> >> >>To unsubscribe, e-mail:
>>velocity-user-unsubscribe@jakarta.apache.org
>> >> >> >>For additional commands, e-mail:
>> >>velocity-user-help@jakarta.apache.org
>> >> >> >>
>> >> >> >
>> >> >> >_________________________________________________________________
>> >> >> >Windows Liveďż˝ Messenger has arrived. Click here to download it
>>for
>> >> >>free!
>> >> >> >http://imagine-msn.com/messenger/launch80/?locale=en-gb
>> >> >> >
>> >> >> >
>> >> >>
>> >---------------------------------------------------------------------
>> >> >> >To unsubscribe, e-mail:
>>velocity-user-unsubscribe@jakarta.apache.org
>> >> >> >For additional commands, e-mail:
>> >>velocity-user-help@jakarta.apache.org
>> >> >> >
>> >> >>
>> >> >>_________________________________________________________________
>> >> >>Be the first to hear what's new at MSN - sign up to our free
>> >>newsletters!
>> >> >>http://www.msn.co.uk/newsletters
>> >> >>
>> >> >>
>> >>
>> >>---------------------------------------------------------------------
>> >> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >> >>For additional commands, e-mail:
>>velocity-user-help@jakarta.apache.org
>> >> >>
>> >> >>
>> >> >
>> >> >
>> >> >--
>> >> >Forio Business Simulations
>> >> >
>> >> >Will Glass-Husain
>> >> >wglass@forio.com
>> >> >www.forio.com
>> >>
>> >>_________________________________________________________________
>> >>Windows Liveďż˝ Messenger has arrived. Click here to download it for
>>free!
>> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
>> >>
>> >>
>> >>---------------------------------------------------------------------
>> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >>
>> >>
>> >
>> >
>> >--
>> >Forio Business Simulations
>> >
>> >Will Glass-Husain
>> >wglass@forio.com
>> >www.forio.com
>>
>>_________________________________________________________________
>>The new Windows Live Toolbar helps you guard against viruses
>>http://toolbar.live.com/?mkt=en-gb
>>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>>
>>
>
>
>--
>Forio Business Simulations
>
>Will Glass-Husain
>wglass@forio.com
>www.forio.com
_________________________________________________________________
Windows Live Messenger has arrived. Click here to download it for free!
http://imagine-msn.com/messenger/launch80/?locale=en-gb
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Will Glass-Husain <wg...@forio.com>.
Robin,
Haven't yet checked this out.
But your IT manager says "have to do more testing to see which
security grant it needs". Actually, your error log shows this
clearly. You need
java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core
WILL
On 10/12/06, Robin Mannering <ro...@hotmail.com> wrote:
> Hi Will,
>
> Thanks for your help, let me know if there is anything I can do.
>
> I have a fear my hosting provider cannot commit the resources to solving
> this problem anytime soon.
>
> Thanks
> Robin
>
>
> >From: "Will Glass-Husain" <wg...@forio.com>
> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >Subject: Re: Velocity Config/Security Issue
> >Date: Thu, 12 Oct 2006 04:59:38 -0700
> >
> >I'll play around with this. Might be a day or so.
> >
> >On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
> >>
> >>Hi,
> >>
> >>Sorry I forgot the velocity version: Velocity 1.4
> >>
> >> >From: "Will Glass-Husain" <wg...@forio.com>
> >> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >Subject: Re: Velocity Config/Security Issue
> >> >Date: Wed, 11 Oct 2006 15:54:51 -0700
> >> >
> >> >One more question. What's your platform
> >> >-- version of Tomcat
> >> >-- version of JDK
> >> >-- Win, Linux, etc?
> >> >
> >> >(and to repeat the last email for redundancy)
> >> >-- VelocityServlet or VelocityViewServlet (with version)
> >> >
> >> >I run an instance of Tomcat with a security policy. I've found
> >> >numerous inconsistencies even within Tomcat that require security
> >> >permissions to be opened up. (There was a bug with the 4.1.x series
> >> >for example for which I had to open up something similar).
> >> >
> >> >I tend to think you've hit a Tomcat bug triggered by the way Velocity
> >> >accesses the request object. Send the info back and we can dig into
> >> >this.
> >> >
> >> >WILL
> >> >
> >> >On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
> >> >>Sorry, some more logging that might make it clearer.
> >> >>
> >> >>My local machine uses request objects:
> >> >>org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce
> >> >>and
> >> >>org.apache.catalina.core.ApplicationHttpRequest@1e389b8
> >> >>
> >> >>Whereas the hosted server with the problem uses:
> >> >>org.apache.catalina.connector.RequestFacade@121d818
> >> >>and
> >> >>org.apache.catalina.core.ApplicationHttpRequest@76f954
> >> >>
> >> >>
> >> >>
> >> >>Log 1 - From action class running on hosted server
> >> >>--------------------------------------------------
> >> >>11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
> >> >> | request = 'org.apache.catalina.connector.RequestFacade@121d818'
> >> >>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> >> >> | request.getContextPath() = ''
> >> >>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> >> >> | request.getMethod() = 'GET'
> >> >>11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
> >> >> | request.getSession().getId() =
> >>'28536F4542A222DC6F0E6DE23442DC6D'
> >> >>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> >> >> | request.getRequestURI() = '/test.htm'
> >> >>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> >> >> | request.getRequestURL() =
> >>'http://www.chaletexplorer.com/test.htm'
> >> >>11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
> >> >> | request.getServletPath() = '/test.htm'
> >> >>
> >> >>
> >> >>Log 2 - From VM Template/page running on hosted server
> >> >>------------------------------------------------------
> >> >>request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
> >> >>request.contextPath = '/'
> >> >>request.method = 'GET'
> >> >>request.session.id = '$request.session.id'
> >> >>request.requestURI = '//test.vm'
> >> >>request.requestURL = 'http://www.chaletexplorer.com//test.vm'
> >> >>request.servletPath = '/test.vm'
> >> >>
> >> >>
> >> >>Log 3 - From action class (running on my local machine)
> >> >>-------------------------------------------------------
> >> >>
> >> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> >> >> | request =
> >>'org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce'
> >> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> >> >> | request.getContextPath() = '/indy'
> >> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> >> >> | request.getMethod() = 'GET'
> >> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> >> >> | request.getSession().getId() =
> >>'79E50B9B3F25A2897BF420521952D51F'
> >> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> >> >> | request.getRequestURI() = '/indy/test.htm'
> >> >>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
> >> >> | request.getRequestURL() = 'http://localhost:8080/indy/test.htm'
> >> >>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
> >> >> | request.getServletPath() = '/test.htm'
> >> >>
> >> >>
> >> >>Log 4 - From VM Template/page (running on my local machine)
> >> >>-----------------------------------------------------------
> >> >>request = 'org.apache.catalina.core.ApplicationHttpRequest@1e389b8'
> >> >>request.contextPath = '/indy'
> >> >>request.method = 'GET'
> >> >>request.session.id = '79E50B9B3F25A2897BF420521952D51F'
> >> >>request.requestURI = '/indy/test.vm'
> >> >>request.requestURL = 'http://localhost:8080/indy/test.htm'
> >> >>request.servletPath = '/test.vm'
> >> >>
> >> >>
> >> >>
> >> >>--------------------------------------------------
> >> >>
> >> >>
> >> >> >From: "Robin Mannering" <ro...@hotmail.com>
> >> >> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >> >To: velocity-user@jakarta.apache.org
> >> >> >Subject: Re: Velocity Config/Security Issue
> >> >> >Date: Wed, 11 Oct 2006 22:08:29 +0000
> >> >> >
> >> >> >Hi all,
> >> >> >
> >> >> >Can anyone shed some light? I have some more facts now....
> >> >> >
> >> >> >The original problem was Velocity required permission on a core
> >>package
> >> >> >within catalina. Is this because it couldn't find the 'correct'
> >>request
> >> >> >object.
> >> >> >
> >> >> >Here are some logs, the first is from a Struts action class, the
> >>second
> >> >>is
> >> >> >output from the velocity template forwarded to immediately after the
> >> >>action
> >> >> >class. They refer to different request objects that ultimately give
> >> >> >different values. Should the velocity template not also refer to
> >> >> >org.apache.catalina.connector.RequestFacade@121d818 ??
> >> >> >
> >> >> >Any help/clues would be greatly appreciated.
> >> >> >
> >> >> >Log 1 - From action class
> >> >> >----------------------------------
> >> >> >11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
> >> >> > | request =
> >>'org.apache.catalina.connector.RequestFacade@121d818'
> >> >> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> >> >> > | request.getContextPath() = ''
> >> >> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> >> >> > | request.getMethod() = 'GET'
> >> >> >11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
> >> >> > | request.getSession().getId() =
> >>'28536F4542A222DC6F0E6DE23442DC6D'
> >> >> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> >> >> > | request.getRequestURI() = '/test.htm'
> >> >> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> >> >> > | request.getRequestURL() =
> >> >>'http://www.chaletexplorer.com/test.htm'
> >> >> >11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
> >> >> > | request.getServletPath() = '/test.htm'
> >> >> >
> >> >> >Log 2 - From VM Template/page
> >> >> >-----------------------------
> >> >> >request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
> >> >> >
> >> >> >request.contextPath = '/'
> >> >> >
> >> >> >request.method = 'GET'
> >> >> >
> >> >> >request.session.id = '$request.session.id'
> >> >> >
> >> >> >request.requestURI = '//test.vm'
> >> >> >
> >> >> >request.requestURL = 'http://www.chaletexplorer.com//test.vm'
> >> >> >
> >> >> >request.servletPath = '/test.vm'
> >> >> >
> >> >> >
> >> >> >
> >> >> >
> >> >> >
> >> >> >
> >> >> >
> >> >> >>From: "Will Glass-Husain" <wg...@forio.com>
> >> >> >>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >> >>To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >> >>Subject: Re: Velocity Config/Security Issue
> >> >> >>Date: Wed, 11 Oct 2006 06:25:35 -0700
> >> >> >>
> >> >> >>I don't think it's Velocity which requires that permission, I'm
> >> >> >>guessing it's the request object which is ultimately provided by
> >> >> >>Tomcat...
> >> >> >>
> >> >> >>WILL
> >> >> >>
> >> >> >>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
> >> >> >>>Hi Will,
> >> >> >>>
> >> >> >>>Thanks for the links, I'll give them a thorough read.
> >> >> >>>
> >> >> >>>I've been working with the hosting company who set up the server
> >> >>config
> >> >> >>>and
> >> >> >>>they have give the application permission to
> >>org.apache.catalina.core
> >> >> >>>although they are troubled to do so.
> >> >> >>>
> >> >> >>>They seem very surprised that velocity requires this permission.
> >> >> >>>
> >> >> >>>Since they granted the permission, the problem has cleared up and
> >> >> >>>$request.contextPath now has a value within a velocity template
> >> >>(although
> >> >> >>>this has changed from an empty value to '/' so I need to make
> >>source
> >> >> >>>amendments. Not a problem, just worrying it takes on a new value
> >>in a
> >> >> >>>different hosting environment.
> >> >> >>>
> >> >> >>>Thanks again for your help
> >> >> >>>Robin
> >> >> >>>
> >> >> >>>
> >> >> >>> >From: "Will Glass-Husain" <wg...@forio.com>
> >> >> >>> >Reply-To: "Velocity Users List"
> >><ve...@jakarta.apache.org>
> >> >> >>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >> >>> >Subject: Re: Velocity Config/Security Issue
> >> >> >>> >Date: Tue, 10 Oct 2006 15:04:32 -0700
> >> >> >>> >
> >> >> >>> >What app server are you using? This is a server configuration
> >> >>issue.
> >> >> >>> >If someone else set it up, you might also want to work with them.
> >> >> >>> >
> >> >> >>> >If you're using Tomcat, check out:
> >> >> >>>
> >> >http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
> >> >> >>> >
> >> >> >>> >And you should read the Sun docs at:
> >> >> >>>
> >> >http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
> >> >> >>> >
> >> >> >>> >WILL
> >> >> >>> >
> >> >> >>> >On 10/10/06, Robin Mannering <ro...@hotmail.com>
> >>wrote:
> >> >> >>> >>Hi Will,
> >> >> >>> >>
> >> >> >>> >>thanks for your help. Sorry. I'm new to permissions, could you
> >> >>explain
> >> >> >>>a
> >> >> >>> >>little more for me please.
> >> >> >>> >>
> >> >> >>> >>Thanks
> >> >> >>> >>Robin
> >> >> >>> >>
> >> >> >>> >>
> >> >> >>> >> >From: "Will Glass-Husain" <wg...@forio.com>
> >> >> >>> >> >Reply-To: "Velocity Users List"
> >> >><ve...@jakarta.apache.org>
> >> >> >>> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >> >>> >> >Subject: Re: Velocity Config/Security Issue
> >> >> >>> >> >Date: Tue, 10 Oct 2006 08:24:57 -0700
> >> >> >>> >> >
> >> >> >>> >> >Looks like the security policy on your app server needs to be
> >> >>tuned.
> >> >> >>> >> >Have you tried giving the permission
> >>java.lang.RuntimePermission
> >> >>for
> >> >> >>> >> >accessClassInPackage.org.apache.catalina.core?
> >> >> >>> >> >
> >> >> >>> >> >WILL
> >> >> >>> >> >
> >> >> >>> >> >On 10/10/06, Robin Mannering <ro...@hotmail.com>
> >> >>wrote:
> >> >> >>> >> >>Hi all,
> >> >> >>> >> >>
> >> >> >>> >> >>I'm new back on this list in a while, please excuse if the
> >> >> >>>following
> >> >> >>> >> >>problem
> >> >> >>> >> >>is obvious/has been posted before.
> >> >> >>> >> >>
> >> >> >>> >> >>I am transferring an existing site based on Struts/Velocity
> >>to a
> >> >> >>>new
> >> >> >>> >>web
> >> >> >>> >> >>hosting provider. The application runs smoothly on its
> >>current
> >> >> >>>host.
> >> >> >>> >> >>
> >> >> >>> >> >>However, there seems to be one last stumbling block with the
> >>new
> >> >> >>>server
> >> >> >>> >>in
> >> >> >>> >> >>that the Struts object; 'request' appears not to be in scope
> >> >>within
> >> >> >>> >> >>velocity
> >> >> >>> >> >>pages (there may be others not in scope).
> >> >> >>> >> >>
> >> >> >>> >> >>I'm using the VelocityLayoutServlet if that helps.
> >> >> >>> >> >>
> >> >> >>> >> >>I've attached a snippet of the log file that points to the
> >> >>problem
> >> >> >>>I
> >> >> >>> >> >>mentioned, notable the 'java.security.AccessControlException'
> >> >>and
> >> >> >>> >> >>'$request.contextPath is not a valid reference'
> >> >> >>> >> >>
> >> >> >>> >> >>All other velocity directives appear to be functioning as
> >> >>normal.
> >> >> >>> >> >>
> >> >> >>> >> >>Has anyone seen this behaviour before? Any help would be
> >>greatly
> >> >> >>> >> >>appreciated.
> >> >> >>> >> >>
> >> >> >>> >> >>Kind regards
> >> >> >>> >> >>Robin
> >> >> >>> >> >>
> >> >> >>> >> >>10-Oct 02:45:21.752 |INFO | [/].log
> >> >> >>> >> >> | Velocity [info] ResourceManager : found
> >> >> >>> >>/pages/frontend/home.vm
> >> >> >>> >> >>with loader
> >>org.apache.velocity.tools.view.servlet.WebappLoader
> >> >> >>> >> >>10-Oct 02:45:21.761 |INFO | [/].log
> >> >> >>> >> >> | Velocity [error] PROGRAMMER ERROR :
> >>PropertyExector() :
> >> >> >>> >> >>java.security.AccessControlException: access denied
> >> >> >>> >> >>(java.lang.RuntimePermission
> >> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >> >>> >> >>10-Oct 02:45:21.763 |INFO | [/].log
> >> >> >>> >> >> | Velocity [error] ASTIdentifier.execute() :
> >>identifier =
> >> >> >>> >> >>contextPath
> >> >> >>> >> >>: java.security.AccessControlException: access denied
> >> >> >>> >> >>(java.lang.RuntimePermission
> >> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >> >>> >> >>10-Oct 02:45:21.764 |INFO | [/].log
> >> >> >>> >> >> | Velocity [error] RHS of #set statement is null.
> >>Context
> >> >> >>>will
> >> >> >>> >>not
> >> >> >>> >> >>be
> >> >> >>> >> >>modified. /pages/frontend/home.vm [line 9, column 1]
> >> >> >>> >> >>10-Oct 02:45:21.772 |INFO | [/].log
> >> >> >>> >> >> | Velocity [error] PROGRAMMER ERROR :
> >>PropertyExector() :
> >> >> >>> >> >>java.security.AccessControlException: access denied
> >> >> >>> >> >>(java.lang.RuntimePermission
> >> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >> >>> >> >>10-Oct 02:45:21.773 |INFO | [/].log
> >> >> >>> >> >> | Velocity [error] ASTIdentifier.execute() :
> >>identifier =
> >> >> >>> >> >>contextPath
> >> >> >>> >> >>: java.security.AccessControlException: access denied
> >> >> >>> >> >>(java.lang.RuntimePermission
> >> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >> >>> >> >>10-Oct 02:45:21.774 |INFO | [/].log
> >> >> >>> >> >> | Velocity [warn]
> >> >> >>> >> >>org.apache.velocity.runtime.exception.ReferenceException:
> >> >>reference
> >> >> >>>:
> >> >> >>> >> >>template = /pages/frontend/home.vm [line 32,column 34] :
> >> >> >>> >> >>$request.contextPath is not a valid reference.
> >> >> >>> >> >>
> >> >> >>> >>
> >> >> >>_________________________________________________________________
> >> >> >>> >> >>Windows Live� Messenger has arrived. Click here to download
> >>it
> >> >>for
> >> >> >>> >>free!
> >> >> >>> >> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
> >> >> >>> >> >>
> >> >> >>> >> >>
> >> >> >>> >>
> >> >> >>>
> >> >>
> >> >>---------------------------------------------------------------------
> >> >> >>> >> >>To unsubscribe, e-mail:
> >> >> >>>velocity-user-unsubscribe@jakarta.apache.org
> >> >> >>> >> >>For additional commands, e-mail:
> >> >> >>>velocity-user-help@jakarta.apache.org
> >> >> >>> >> >>
> >> >> >>> >> >>
> >> >> >>> >> >
> >> >> >>> >> >
> >> >> >>> >> >--
> >> >> >>> >> >Forio Business Simulations
> >> >> >>> >> >
> >> >> >>> >> >Will Glass-Husain
> >> >> >>> >> >wglass@forio.com
> >> >> >>> >> >www.forio.com
> >> >> >>> >> >
> >> >> >>> >>
> >> >> >>>
> >> >> >---------------------------------------------------------------------
> >> >> >>> >> >To unsubscribe, e-mail:
> >> >>velocity-user-unsubscribe@jakarta.apache.org
> >> >> >>> >> >For additional commands, e-mail:
> >> >> >>>velocity-user-help@jakarta.apache.org
> >> >> >>> >> >
> >> >> >>> >>
> >> >> >>>
> >> >>_________________________________________________________________
> >> >> >>> >>Be the first to hear what's new at MSN - sign up to our free
> >> >> >>>newsletters!
> >> >> >>> >>http://www.msn.co.uk/newsletters
> >> >> >>> >>
> >> >> >>> >>
> >> >> >>>
> >> >>
> >> >>---------------------------------------------------------------------
> >> >> >>> >>To unsubscribe, e-mail:
> >> >>velocity-user-unsubscribe@jakarta.apache.org
> >> >> >>> >>For additional commands, e-mail:
> >> >>velocity-user-help@jakarta.apache.org
> >> >> >>> >>
> >> >> >>> >>
> >> >> >>> >
> >> >> >>> >
> >> >> >>> >--
> >> >> >>> >Forio Business Simulations
> >> >> >>> >
> >> >> >>> >Will Glass-Husain
> >> >> >>> >wglass@forio.com
> >> >> >>> >www.forio.com
> >> >> >>> >
> >> >> >>>
> >> >> >---------------------------------------------------------------------
> >> >> >>> >To unsubscribe, e-mail:
> >>velocity-user-unsubscribe@jakarta.apache.org
> >> >> >>> >For additional commands, e-mail:
> >> >>velocity-user-help@jakarta.apache.org
> >> >> >>> >
> >> >> >>>
> >> >> >>>_________________________________________________________________
> >> >> >>>Download the new Windows Live Toolbar, including Desktop search!
> >> >> >>>http://toolbar.live.com/?mkt=en-gb
> >> >> >>>
> >> >> >>>
> >> >>
> >> >>>---------------------------------------------------------------------
> >> >> >>>To unsubscribe, e-mail:
> >>velocity-user-unsubscribe@jakarta.apache.org
> >> >> >>>For additional commands, e-mail:
> >>velocity-user-help@jakarta.apache.org
> >> >> >>>
> >> >> >>>
> >> >> >>
> >> >> >>
> >> >> >>--
> >> >> >>Forio Business Simulations
> >> >> >>
> >> >> >>Will Glass-Husain
> >> >> >>wglass@forio.com
> >> >> >>www.forio.com
> >> >> >>
> >> >>
> >> >>---------------------------------------------------------------------
> >> >> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >> >> >>For additional commands, e-mail:
> >>velocity-user-help@jakarta.apache.org
> >> >> >>
> >> >> >
> >> >> >_________________________________________________________________
> >> >> >Windows Live� Messenger has arrived. Click here to download it for
> >> >>free!
> >> >> >http://imagine-msn.com/messenger/launch80/?locale=en-gb
> >> >> >
> >> >> >
> >> >> >---------------------------------------------------------------------
> >> >> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >> >> >For additional commands, e-mail:
> >>velocity-user-help@jakarta.apache.org
> >> >> >
> >> >>
> >> >>_________________________________________________________________
> >> >>Be the first to hear what's new at MSN - sign up to our free
> >>newsletters!
> >> >>http://www.msn.co.uk/newsletters
> >> >>
> >> >>
> >> >>---------------------------------------------------------------------
> >> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >> >>
> >> >>
> >> >
> >> >
> >> >--
> >> >Forio Business Simulations
> >> >
> >> >Will Glass-Husain
> >> >wglass@forio.com
> >> >www.forio.com
> >>
> >>_________________________________________________________________
> >>Windows Live� Messenger has arrived. Click here to download it for free!
> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
> >>
> >>
> >>---------------------------------------------------------------------
> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>
> >>
> >
> >
> >--
> >Forio Business Simulations
> >
> >Will Glass-Husain
> >wglass@forio.com
> >www.forio.com
>
> _________________________________________________________________
> The new Windows Live Toolbar helps you guard against viruses
> http://toolbar.live.com/?mkt=en-gb
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
>
--
Forio Business Simulations
Will Glass-Husain
wglass@forio.com
www.forio.com
Re: Velocity Config/Security Issue
Posted by Robin Mannering <ro...@hotmail.com>.
Hi Will,
Thanks for your help, let me know if there is anything I can do.
I have a fear my hosting provider cannot commit the resources to solving
this problem anytime soon.
Thanks
Robin
>From: "Will Glass-Husain" <wg...@forio.com>
>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>To: "Velocity Users List" <ve...@jakarta.apache.org>
>Subject: Re: Velocity Config/Security Issue
>Date: Thu, 12 Oct 2006 04:59:38 -0700
>
>I'll play around with this. Might be a day or so.
>
>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>>
>>Hi,
>>
>>Sorry I forgot the velocity version: Velocity 1.4
>>
>> >From: "Will Glass-Husain" <wg...@forio.com>
>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >Subject: Re: Velocity Config/Security Issue
>> >Date: Wed, 11 Oct 2006 15:54:51 -0700
>> >
>> >One more question. What's your platform
>> >-- version of Tomcat
>> >-- version of JDK
>> >-- Win, Linux, etc?
>> >
>> >(and to repeat the last email for redundancy)
>> >-- VelocityServlet or VelocityViewServlet (with version)
>> >
>> >I run an instance of Tomcat with a security policy. I've found
>> >numerous inconsistencies even within Tomcat that require security
>> >permissions to be opened up. (There was a bug with the 4.1.x series
>> >for example for which I had to open up something similar).
>> >
>> >I tend to think you've hit a Tomcat bug triggered by the way Velocity
>> >accesses the request object. Send the info back and we can dig into
>> >this.
>> >
>> >WILL
>> >
>> >On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>> >>Sorry, some more logging that might make it clearer.
>> >>
>> >>My local machine uses request objects:
>> >>org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce
>> >>and
>> >>org.apache.catalina.core.ApplicationHttpRequest@1e389b8
>> >>
>> >>Whereas the hosted server with the problem uses:
>> >>org.apache.catalina.connector.RequestFacade@121d818
>> >>and
>> >>org.apache.catalina.core.ApplicationHttpRequest@76f954
>> >>
>> >>
>> >>
>> >>Log 1 - From action class running on hosted server
>> >>--------------------------------------------------
>> >>11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
>> >> | request = 'org.apache.catalina.connector.RequestFacade@121d818'
>> >>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> >> | request.getContextPath() = ''
>> >>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> >> | request.getMethod() = 'GET'
>> >>11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
>> >> | request.getSession().getId() =
>>'28536F4542A222DC6F0E6DE23442DC6D'
>> >>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> >> | request.getRequestURI() = '/test.htm'
>> >>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> >> | request.getRequestURL() =
>>'http://www.chaletexplorer.com/test.htm'
>> >>11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
>> >> | request.getServletPath() = '/test.htm'
>> >>
>> >>
>> >>Log 2 - From VM Template/page running on hosted server
>> >>------------------------------------------------------
>> >>request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
>> >>request.contextPath = '/'
>> >>request.method = 'GET'
>> >>request.session.id = '$request.session.id'
>> >>request.requestURI = '//test.vm'
>> >>request.requestURL = 'http://www.chaletexplorer.com//test.vm'
>> >>request.servletPath = '/test.vm'
>> >>
>> >>
>> >>Log 3 - From action class (running on my local machine)
>> >>-------------------------------------------------------
>> >>
>> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> >> | request =
>>'org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce'
>> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> >> | request.getContextPath() = '/indy'
>> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> >> | request.getMethod() = 'GET'
>> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> >> | request.getSession().getId() =
>>'79E50B9B3F25A2897BF420521952D51F'
>> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> >> | request.getRequestURI() = '/indy/test.htm'
>> >>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
>> >> | request.getRequestURL() = 'http://localhost:8080/indy/test.htm'
>> >>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
>> >> | request.getServletPath() = '/test.htm'
>> >>
>> >>
>> >>Log 4 - From VM Template/page (running on my local machine)
>> >>-----------------------------------------------------------
>> >>request = 'org.apache.catalina.core.ApplicationHttpRequest@1e389b8'
>> >>request.contextPath = '/indy'
>> >>request.method = 'GET'
>> >>request.session.id = '79E50B9B3F25A2897BF420521952D51F'
>> >>request.requestURI = '/indy/test.vm'
>> >>request.requestURL = 'http://localhost:8080/indy/test.htm'
>> >>request.servletPath = '/test.vm'
>> >>
>> >>
>> >>
>> >>--------------------------------------------------
>> >>
>> >>
>> >> >From: "Robin Mannering" <ro...@hotmail.com>
>> >> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >To: velocity-user@jakarta.apache.org
>> >> >Subject: Re: Velocity Config/Security Issue
>> >> >Date: Wed, 11 Oct 2006 22:08:29 +0000
>> >> >
>> >> >Hi all,
>> >> >
>> >> >Can anyone shed some light? I have some more facts now....
>> >> >
>> >> >The original problem was Velocity required permission on a core
>>package
>> >> >within catalina. Is this because it couldn't find the 'correct'
>>request
>> >> >object.
>> >> >
>> >> >Here are some logs, the first is from a Struts action class, the
>>second
>> >>is
>> >> >output from the velocity template forwarded to immediately after the
>> >>action
>> >> >class. They refer to different request objects that ultimately give
>> >> >different values. Should the velocity template not also refer to
>> >> >org.apache.catalina.connector.RequestFacade@121d818 ??
>> >> >
>> >> >Any help/clues would be greatly appreciated.
>> >> >
>> >> >Log 1 - From action class
>> >> >----------------------------------
>> >> >11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
>> >> > | request =
>>'org.apache.catalina.connector.RequestFacade@121d818'
>> >> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> >> > | request.getContextPath() = ''
>> >> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> >> > | request.getMethod() = 'GET'
>> >> >11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
>> >> > | request.getSession().getId() =
>>'28536F4542A222DC6F0E6DE23442DC6D'
>> >> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> >> > | request.getRequestURI() = '/test.htm'
>> >> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> >> > | request.getRequestURL() =
>> >>'http://www.chaletexplorer.com/test.htm'
>> >> >11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
>> >> > | request.getServletPath() = '/test.htm'
>> >> >
>> >> >Log 2 - From VM Template/page
>> >> >-----------------------------
>> >> >request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
>> >> >
>> >> >request.contextPath = '/'
>> >> >
>> >> >request.method = 'GET'
>> >> >
>> >> >request.session.id = '$request.session.id'
>> >> >
>> >> >request.requestURI = '//test.vm'
>> >> >
>> >> >request.requestURL = 'http://www.chaletexplorer.com//test.vm'
>> >> >
>> >> >request.servletPath = '/test.vm'
>> >> >
>> >> >
>> >> >
>> >> >
>> >> >
>> >> >
>> >> >
>> >> >>From: "Will Glass-Husain" <wg...@forio.com>
>> >> >>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >>To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >>Subject: Re: Velocity Config/Security Issue
>> >> >>Date: Wed, 11 Oct 2006 06:25:35 -0700
>> >> >>
>> >> >>I don't think it's Velocity which requires that permission, I'm
>> >> >>guessing it's the request object which is ultimately provided by
>> >> >>Tomcat...
>> >> >>
>> >> >>WILL
>> >> >>
>> >> >>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>> >> >>>Hi Will,
>> >> >>>
>> >> >>>Thanks for the links, I'll give them a thorough read.
>> >> >>>
>> >> >>>I've been working with the hosting company who set up the server
>> >>config
>> >> >>>and
>> >> >>>they have give the application permission to
>>org.apache.catalina.core
>> >> >>>although they are troubled to do so.
>> >> >>>
>> >> >>>They seem very surprised that velocity requires this permission.
>> >> >>>
>> >> >>>Since they granted the permission, the problem has cleared up and
>> >> >>>$request.contextPath now has a value within a velocity template
>> >>(although
>> >> >>>this has changed from an empty value to '/' so I need to make
>>source
>> >> >>>amendments. Not a problem, just worrying it takes on a new value
>>in a
>> >> >>>different hosting environment.
>> >> >>>
>> >> >>>Thanks again for your help
>> >> >>>Robin
>> >> >>>
>> >> >>>
>> >> >>> >From: "Will Glass-Husain" <wg...@forio.com>
>> >> >>> >Reply-To: "Velocity Users List"
>><ve...@jakarta.apache.org>
>> >> >>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >>> >Subject: Re: Velocity Config/Security Issue
>> >> >>> >Date: Tue, 10 Oct 2006 15:04:32 -0700
>> >> >>> >
>> >> >>> >What app server are you using? This is a server configuration
>> >>issue.
>> >> >>> >If someone else set it up, you might also want to work with them.
>> >> >>> >
>> >> >>> >If you're using Tomcat, check out:
>> >> >>>
>> >http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
>> >> >>> >
>> >> >>> >And you should read the Sun docs at:
>> >> >>>
>> >http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
>> >> >>> >
>> >> >>> >WILL
>> >> >>> >
>> >> >>> >On 10/10/06, Robin Mannering <ro...@hotmail.com>
>>wrote:
>> >> >>> >>Hi Will,
>> >> >>> >>
>> >> >>> >>thanks for your help. Sorry. I'm new to permissions, could you
>> >>explain
>> >> >>>a
>> >> >>> >>little more for me please.
>> >> >>> >>
>> >> >>> >>Thanks
>> >> >>> >>Robin
>> >> >>> >>
>> >> >>> >>
>> >> >>> >> >From: "Will Glass-Husain" <wg...@forio.com>
>> >> >>> >> >Reply-To: "Velocity Users List"
>> >><ve...@jakarta.apache.org>
>> >> >>> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >>> >> >Subject: Re: Velocity Config/Security Issue
>> >> >>> >> >Date: Tue, 10 Oct 2006 08:24:57 -0700
>> >> >>> >> >
>> >> >>> >> >Looks like the security policy on your app server needs to be
>> >>tuned.
>> >> >>> >> >Have you tried giving the permission
>>java.lang.RuntimePermission
>> >>for
>> >> >>> >> >accessClassInPackage.org.apache.catalina.core?
>> >> >>> >> >
>> >> >>> >> >WILL
>> >> >>> >> >
>> >> >>> >> >On 10/10/06, Robin Mannering <ro...@hotmail.com>
>> >>wrote:
>> >> >>> >> >>Hi all,
>> >> >>> >> >>
>> >> >>> >> >>I'm new back on this list in a while, please excuse if the
>> >> >>>following
>> >> >>> >> >>problem
>> >> >>> >> >>is obvious/has been posted before.
>> >> >>> >> >>
>> >> >>> >> >>I am transferring an existing site based on Struts/Velocity
>>to a
>> >> >>>new
>> >> >>> >>web
>> >> >>> >> >>hosting provider. The application runs smoothly on its
>>current
>> >> >>>host.
>> >> >>> >> >>
>> >> >>> >> >>However, there seems to be one last stumbling block with the
>>new
>> >> >>>server
>> >> >>> >>in
>> >> >>> >> >>that the Struts object; 'request' appears not to be in scope
>> >>within
>> >> >>> >> >>velocity
>> >> >>> >> >>pages (there may be others not in scope).
>> >> >>> >> >>
>> >> >>> >> >>I'm using the VelocityLayoutServlet if that helps.
>> >> >>> >> >>
>> >> >>> >> >>I've attached a snippet of the log file that points to the
>> >>problem
>> >> >>>I
>> >> >>> >> >>mentioned, notable the 'java.security.AccessControlException'
>> >>and
>> >> >>> >> >>'$request.contextPath is not a valid reference'
>> >> >>> >> >>
>> >> >>> >> >>All other velocity directives appear to be functioning as
>> >>normal.
>> >> >>> >> >>
>> >> >>> >> >>Has anyone seen this behaviour before? Any help would be
>>greatly
>> >> >>> >> >>appreciated.
>> >> >>> >> >>
>> >> >>> >> >>Kind regards
>> >> >>> >> >>Robin
>> >> >>> >> >>
>> >> >>> >> >>10-Oct 02:45:21.752 |INFO | [/].log
>> >> >>> >> >> | Velocity [info] ResourceManager : found
>> >> >>> >>/pages/frontend/home.vm
>> >> >>> >> >>with loader
>>org.apache.velocity.tools.view.servlet.WebappLoader
>> >> >>> >> >>10-Oct 02:45:21.761 |INFO | [/].log
>> >> >>> >> >> | Velocity [error] PROGRAMMER ERROR :
>>PropertyExector() :
>> >> >>> >> >>java.security.AccessControlException: access denied
>> >> >>> >> >>(java.lang.RuntimePermission
>> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >>> >> >>10-Oct 02:45:21.763 |INFO | [/].log
>> >> >>> >> >> | Velocity [error] ASTIdentifier.execute() :
>>identifier =
>> >> >>> >> >>contextPath
>> >> >>> >> >>: java.security.AccessControlException: access denied
>> >> >>> >> >>(java.lang.RuntimePermission
>> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >>> >> >>10-Oct 02:45:21.764 |INFO | [/].log
>> >> >>> >> >> | Velocity [error] RHS of #set statement is null.
>>Context
>> >> >>>will
>> >> >>> >>not
>> >> >>> >> >>be
>> >> >>> >> >>modified. /pages/frontend/home.vm [line 9, column 1]
>> >> >>> >> >>10-Oct 02:45:21.772 |INFO | [/].log
>> >> >>> >> >> | Velocity [error] PROGRAMMER ERROR :
>>PropertyExector() :
>> >> >>> >> >>java.security.AccessControlException: access denied
>> >> >>> >> >>(java.lang.RuntimePermission
>> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >>> >> >>10-Oct 02:45:21.773 |INFO | [/].log
>> >> >>> >> >> | Velocity [error] ASTIdentifier.execute() :
>>identifier =
>> >> >>> >> >>contextPath
>> >> >>> >> >>: java.security.AccessControlException: access denied
>> >> >>> >> >>(java.lang.RuntimePermission
>> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >>> >> >>10-Oct 02:45:21.774 |INFO | [/].log
>> >> >>> >> >> | Velocity [warn]
>> >> >>> >> >>org.apache.velocity.runtime.exception.ReferenceException:
>> >>reference
>> >> >>>:
>> >> >>> >> >>template = /pages/frontend/home.vm [line 32,column 34] :
>> >> >>> >> >>$request.contextPath is not a valid reference.
>> >> >>> >> >>
>> >> >>> >>
>> >> >>_________________________________________________________________
>> >> >>> >> >>Windows Live� Messenger has arrived. Click here to download
>>it
>> >>for
>> >> >>> >>free!
>> >> >>> >> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
>> >> >>> >> >>
>> >> >>> >> >>
>> >> >>> >>
>> >> >>>
>> >>
>> >>---------------------------------------------------------------------
>> >> >>> >> >>To unsubscribe, e-mail:
>> >> >>>velocity-user-unsubscribe@jakarta.apache.org
>> >> >>> >> >>For additional commands, e-mail:
>> >> >>>velocity-user-help@jakarta.apache.org
>> >> >>> >> >>
>> >> >>> >> >>
>> >> >>> >> >
>> >> >>> >> >
>> >> >>> >> >--
>> >> >>> >> >Forio Business Simulations
>> >> >>> >> >
>> >> >>> >> >Will Glass-Husain
>> >> >>> >> >wglass@forio.com
>> >> >>> >> >www.forio.com
>> >> >>> >> >
>> >> >>> >>
>> >> >>>
>> >> >---------------------------------------------------------------------
>> >> >>> >> >To unsubscribe, e-mail:
>> >>velocity-user-unsubscribe@jakarta.apache.org
>> >> >>> >> >For additional commands, e-mail:
>> >> >>>velocity-user-help@jakarta.apache.org
>> >> >>> >> >
>> >> >>> >>
>> >> >>>
>> >>_________________________________________________________________
>> >> >>> >>Be the first to hear what's new at MSN - sign up to our free
>> >> >>>newsletters!
>> >> >>> >>http://www.msn.co.uk/newsletters
>> >> >>> >>
>> >> >>> >>
>> >> >>>
>> >>
>> >>---------------------------------------------------------------------
>> >> >>> >>To unsubscribe, e-mail:
>> >>velocity-user-unsubscribe@jakarta.apache.org
>> >> >>> >>For additional commands, e-mail:
>> >>velocity-user-help@jakarta.apache.org
>> >> >>> >>
>> >> >>> >>
>> >> >>> >
>> >> >>> >
>> >> >>> >--
>> >> >>> >Forio Business Simulations
>> >> >>> >
>> >> >>> >Will Glass-Husain
>> >> >>> >wglass@forio.com
>> >> >>> >www.forio.com
>> >> >>> >
>> >> >>>
>> >> >---------------------------------------------------------------------
>> >> >>> >To unsubscribe, e-mail:
>>velocity-user-unsubscribe@jakarta.apache.org
>> >> >>> >For additional commands, e-mail:
>> >>velocity-user-help@jakarta.apache.org
>> >> >>> >
>> >> >>>
>> >> >>>_________________________________________________________________
>> >> >>>Download the new Windows Live Toolbar, including Desktop search!
>> >> >>>http://toolbar.live.com/?mkt=en-gb
>> >> >>>
>> >> >>>
>> >>
>> >>>---------------------------------------------------------------------
>> >> >>>To unsubscribe, e-mail:
>>velocity-user-unsubscribe@jakarta.apache.org
>> >> >>>For additional commands, e-mail:
>>velocity-user-help@jakarta.apache.org
>> >> >>>
>> >> >>>
>> >> >>
>> >> >>
>> >> >>--
>> >> >>Forio Business Simulations
>> >> >>
>> >> >>Will Glass-Husain
>> >> >>wglass@forio.com
>> >> >>www.forio.com
>> >> >>
>> >>
>> >>---------------------------------------------------------------------
>> >> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >> >>For additional commands, e-mail:
>>velocity-user-help@jakarta.apache.org
>> >> >>
>> >> >
>> >> >_________________________________________________________________
>> >> >Windows Live� Messenger has arrived. Click here to download it for
>> >>free!
>> >> >http://imagine-msn.com/messenger/launch80/?locale=en-gb
>> >> >
>> >> >
>> >> >---------------------------------------------------------------------
>> >> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >> >For additional commands, e-mail:
>>velocity-user-help@jakarta.apache.org
>> >> >
>> >>
>> >>_________________________________________________________________
>> >>Be the first to hear what's new at MSN - sign up to our free
>>newsletters!
>> >>http://www.msn.co.uk/newsletters
>> >>
>> >>
>> >>---------------------------------------------------------------------
>> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >>
>> >>
>> >
>> >
>> >--
>> >Forio Business Simulations
>> >
>> >Will Glass-Husain
>> >wglass@forio.com
>> >www.forio.com
>>
>>_________________________________________________________________
>>Windows Live� Messenger has arrived. Click here to download it for free!
>>http://imagine-msn.com/messenger/launch80/?locale=en-gb
>>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>>
>>
>
>
>--
>Forio Business Simulations
>
>Will Glass-Husain
>wglass@forio.com
>www.forio.com
_________________________________________________________________
The new Windows Live Toolbar helps you guard against viruses
http://toolbar.live.com/?mkt=en-gb
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Will Glass-Husain <wg...@forio.com>.
I'll play around with this. Might be a day or so.
On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>
> Hi,
>
> Sorry I forgot the velocity version: Velocity 1.4
>
> >From: "Will Glass-Husain" <wg...@forio.com>
> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >Subject: Re: Velocity Config/Security Issue
> >Date: Wed, 11 Oct 2006 15:54:51 -0700
> >
> >One more question. What's your platform
> >-- version of Tomcat
> >-- version of JDK
> >-- Win, Linux, etc?
> >
> >(and to repeat the last email for redundancy)
> >-- VelocityServlet or VelocityViewServlet (with version)
> >
> >I run an instance of Tomcat with a security policy. I've found
> >numerous inconsistencies even within Tomcat that require security
> >permissions to be opened up. (There was a bug with the 4.1.x series
> >for example for which I had to open up something similar).
> >
> >I tend to think you've hit a Tomcat bug triggered by the way Velocity
> >accesses the request object. Send the info back and we can dig into
> >this.
> >
> >WILL
> >
> >On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
> >>Sorry, some more logging that might make it clearer.
> >>
> >>My local machine uses request objects:
> >>org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce
> >>and
> >>org.apache.catalina.core.ApplicationHttpRequest@1e389b8
> >>
> >>Whereas the hosted server with the problem uses:
> >>org.apache.catalina.connector.RequestFacade@121d818
> >>and
> >>org.apache.catalina.core.ApplicationHttpRequest@76f954
> >>
> >>
> >>
> >>Log 1 - From action class running on hosted server
> >>--------------------------------------------------
> >>11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
> >> | request = 'org.apache.catalina.connector.RequestFacade@121d818'
> >>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> >> | request.getContextPath() = ''
> >>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> >> | request.getMethod() = 'GET'
> >>11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
> >> | request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
> >>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> >> | request.getRequestURI() = '/test.htm'
> >>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> >> | request.getRequestURL() = 'http://www.chaletexplorer.com/test.htm'
> >>11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
> >> | request.getServletPath() = '/test.htm'
> >>
> >>
> >>Log 2 - From VM Template/page running on hosted server
> >>------------------------------------------------------
> >>request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
> >>request.contextPath = '/'
> >>request.method = 'GET'
> >>request.session.id = '$request.session.id'
> >>request.requestURI = '//test.vm'
> >>request.requestURL = 'http://www.chaletexplorer.com//test.vm'
> >>request.servletPath = '/test.vm'
> >>
> >>
> >>Log 3 - From action class (running on my local machine)
> >>-------------------------------------------------------
> >>
> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> >> | request = 'org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce'
> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> >> | request.getContextPath() = '/indy'
> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> >> | request.getMethod() = 'GET'
> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> >> | request.getSession().getId() = '79E50B9B3F25A2897BF420521952D51F'
> >>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> >> | request.getRequestURI() = '/indy/test.htm'
> >>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
> >> | request.getRequestURL() = 'http://localhost:8080/indy/test.htm'
> >>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
> >> | request.getServletPath() = '/test.htm'
> >>
> >>
> >>Log 4 - From VM Template/page (running on my local machine)
> >>-----------------------------------------------------------
> >>request = 'org.apache.catalina.core.ApplicationHttpRequest@1e389b8'
> >>request.contextPath = '/indy'
> >>request.method = 'GET'
> >>request.session.id = '79E50B9B3F25A2897BF420521952D51F'
> >>request.requestURI = '/indy/test.vm'
> >>request.requestURL = 'http://localhost:8080/indy/test.htm'
> >>request.servletPath = '/test.vm'
> >>
> >>
> >>
> >>--------------------------------------------------
> >>
> >>
> >> >From: "Robin Mannering" <ro...@hotmail.com>
> >> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >To: velocity-user@jakarta.apache.org
> >> >Subject: Re: Velocity Config/Security Issue
> >> >Date: Wed, 11 Oct 2006 22:08:29 +0000
> >> >
> >> >Hi all,
> >> >
> >> >Can anyone shed some light? I have some more facts now....
> >> >
> >> >The original problem was Velocity required permission on a core package
> >> >within catalina. Is this because it couldn't find the 'correct' request
> >> >object.
> >> >
> >> >Here are some logs, the first is from a Struts action class, the second
> >>is
> >> >output from the velocity template forwarded to immediately after the
> >>action
> >> >class. They refer to different request objects that ultimately give
> >> >different values. Should the velocity template not also refer to
> >> >org.apache.catalina.connector.RequestFacade@121d818 ??
> >> >
> >> >Any help/clues would be greatly appreciated.
> >> >
> >> >Log 1 - From action class
> >> >----------------------------------
> >> >11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
> >> > | request = 'org.apache.catalina.connector.RequestFacade@121d818'
> >> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> >> > | request.getContextPath() = ''
> >> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> >> > | request.getMethod() = 'GET'
> >> >11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
> >> > | request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
> >> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> >> > | request.getRequestURI() = '/test.htm'
> >> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> >> > | request.getRequestURL() =
> >>'http://www.chaletexplorer.com/test.htm'
> >> >11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
> >> > | request.getServletPath() = '/test.htm'
> >> >
> >> >Log 2 - From VM Template/page
> >> >-----------------------------
> >> >request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
> >> >
> >> >request.contextPath = '/'
> >> >
> >> >request.method = 'GET'
> >> >
> >> >request.session.id = '$request.session.id'
> >> >
> >> >request.requestURI = '//test.vm'
> >> >
> >> >request.requestURL = 'http://www.chaletexplorer.com//test.vm'
> >> >
> >> >request.servletPath = '/test.vm'
> >> >
> >> >
> >> >
> >> >
> >> >
> >> >
> >> >
> >> >>From: "Will Glass-Husain" <wg...@forio.com>
> >> >>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >>To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >>Subject: Re: Velocity Config/Security Issue
> >> >>Date: Wed, 11 Oct 2006 06:25:35 -0700
> >> >>
> >> >>I don't think it's Velocity which requires that permission, I'm
> >> >>guessing it's the request object which is ultimately provided by
> >> >>Tomcat...
> >> >>
> >> >>WILL
> >> >>
> >> >>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
> >> >>>Hi Will,
> >> >>>
> >> >>>Thanks for the links, I'll give them a thorough read.
> >> >>>
> >> >>>I've been working with the hosting company who set up the server
> >>config
> >> >>>and
> >> >>>they have give the application permission to org.apache.catalina.core
> >> >>>although they are troubled to do so.
> >> >>>
> >> >>>They seem very surprised that velocity requires this permission.
> >> >>>
> >> >>>Since they granted the permission, the problem has cleared up and
> >> >>>$request.contextPath now has a value within a velocity template
> >>(although
> >> >>>this has changed from an empty value to '/' so I need to make source
> >> >>>amendments. Not a problem, just worrying it takes on a new value in a
> >> >>>different hosting environment.
> >> >>>
> >> >>>Thanks again for your help
> >> >>>Robin
> >> >>>
> >> >>>
> >> >>> >From: "Will Glass-Husain" <wg...@forio.com>
> >> >>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >>> >Subject: Re: Velocity Config/Security Issue
> >> >>> >Date: Tue, 10 Oct 2006 15:04:32 -0700
> >> >>> >
> >> >>> >What app server are you using? This is a server configuration
> >>issue.
> >> >>> >If someone else set it up, you might also want to work with them.
> >> >>> >
> >> >>> >If you're using Tomcat, check out:
> >> >>> >http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
> >> >>> >
> >> >>> >And you should read the Sun docs at:
> >> >>> >http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
> >> >>> >
> >> >>> >WILL
> >> >>> >
> >> >>> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
> >> >>> >>Hi Will,
> >> >>> >>
> >> >>> >>thanks for your help. Sorry. I'm new to permissions, could you
> >>explain
> >> >>>a
> >> >>> >>little more for me please.
> >> >>> >>
> >> >>> >>Thanks
> >> >>> >>Robin
> >> >>> >>
> >> >>> >>
> >> >>> >> >From: "Will Glass-Husain" <wg...@forio.com>
> >> >>> >> >Reply-To: "Velocity Users List"
> >><ve...@jakarta.apache.org>
> >> >>> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >>> >> >Subject: Re: Velocity Config/Security Issue
> >> >>> >> >Date: Tue, 10 Oct 2006 08:24:57 -0700
> >> >>> >> >
> >> >>> >> >Looks like the security policy on your app server needs to be
> >>tuned.
> >> >>> >> >Have you tried giving the permission java.lang.RuntimePermission
> >>for
> >> >>> >> >accessClassInPackage.org.apache.catalina.core?
> >> >>> >> >
> >> >>> >> >WILL
> >> >>> >> >
> >> >>> >> >On 10/10/06, Robin Mannering <ro...@hotmail.com>
> >>wrote:
> >> >>> >> >>Hi all,
> >> >>> >> >>
> >> >>> >> >>I'm new back on this list in a while, please excuse if the
> >> >>>following
> >> >>> >> >>problem
> >> >>> >> >>is obvious/has been posted before.
> >> >>> >> >>
> >> >>> >> >>I am transferring an existing site based on Struts/Velocity to a
> >> >>>new
> >> >>> >>web
> >> >>> >> >>hosting provider. The application runs smoothly on its current
> >> >>>host.
> >> >>> >> >>
> >> >>> >> >>However, there seems to be one last stumbling block with the new
> >> >>>server
> >> >>> >>in
> >> >>> >> >>that the Struts object; 'request' appears not to be in scope
> >>within
> >> >>> >> >>velocity
> >> >>> >> >>pages (there may be others not in scope).
> >> >>> >> >>
> >> >>> >> >>I'm using the VelocityLayoutServlet if that helps.
> >> >>> >> >>
> >> >>> >> >>I've attached a snippet of the log file that points to the
> >>problem
> >> >>>I
> >> >>> >> >>mentioned, notable the 'java.security.AccessControlException'
> >>and
> >> >>> >> >>'$request.contextPath is not a valid reference'
> >> >>> >> >>
> >> >>> >> >>All other velocity directives appear to be functioning as
> >>normal.
> >> >>> >> >>
> >> >>> >> >>Has anyone seen this behaviour before? Any help would be greatly
> >> >>> >> >>appreciated.
> >> >>> >> >>
> >> >>> >> >>Kind regards
> >> >>> >> >>Robin
> >> >>> >> >>
> >> >>> >> >>10-Oct 02:45:21.752 |INFO | [/].log
> >> >>> >> >> | Velocity [info] ResourceManager : found
> >> >>> >>/pages/frontend/home.vm
> >> >>> >> >>with loader org.apache.velocity.tools.view.servlet.WebappLoader
> >> >>> >> >>10-Oct 02:45:21.761 |INFO | [/].log
> >> >>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> >> >>> >> >>java.security.AccessControlException: access denied
> >> >>> >> >>(java.lang.RuntimePermission
> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >>> >> >>10-Oct 02:45:21.763 |INFO | [/].log
> >> >>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
> >> >>> >> >>contextPath
> >> >>> >> >>: java.security.AccessControlException: access denied
> >> >>> >> >>(java.lang.RuntimePermission
> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >>> >> >>10-Oct 02:45:21.764 |INFO | [/].log
> >> >>> >> >> | Velocity [error] RHS of #set statement is null. Context
> >> >>>will
> >> >>> >>not
> >> >>> >> >>be
> >> >>> >> >>modified. /pages/frontend/home.vm [line 9, column 1]
> >> >>> >> >>10-Oct 02:45:21.772 |INFO | [/].log
> >> >>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> >> >>> >> >>java.security.AccessControlException: access denied
> >> >>> >> >>(java.lang.RuntimePermission
> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >>> >> >>10-Oct 02:45:21.773 |INFO | [/].log
> >> >>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
> >> >>> >> >>contextPath
> >> >>> >> >>: java.security.AccessControlException: access denied
> >> >>> >> >>(java.lang.RuntimePermission
> >> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >>> >> >>10-Oct 02:45:21.774 |INFO | [/].log
> >> >>> >> >> | Velocity [warn]
> >> >>> >> >>org.apache.velocity.runtime.exception.ReferenceException:
> >>reference
> >> >>>:
> >> >>> >> >>template = /pages/frontend/home.vm [line 32,column 34] :
> >> >>> >> >>$request.contextPath is not a valid reference.
> >> >>> >> >>
> >> >>> >>
> >> >>_________________________________________________________________
> >> >>> >> >>Windows Live� Messenger has arrived. Click here to download it
> >>for
> >> >>> >>free!
> >> >>> >> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
> >> >>> >> >>
> >> >>> >> >>
> >> >>> >>
> >> >>>
> >> >>---------------------------------------------------------------------
> >> >>> >> >>To unsubscribe, e-mail:
> >> >>>velocity-user-unsubscribe@jakarta.apache.org
> >> >>> >> >>For additional commands, e-mail:
> >> >>>velocity-user-help@jakarta.apache.org
> >> >>> >> >>
> >> >>> >> >>
> >> >>> >> >
> >> >>> >> >
> >> >>> >> >--
> >> >>> >> >Forio Business Simulations
> >> >>> >> >
> >> >>> >> >Will Glass-Husain
> >> >>> >> >wglass@forio.com
> >> >>> >> >www.forio.com
> >> >>> >> >
> >> >>> >>
> >> >>>
> >> >---------------------------------------------------------------------
> >> >>> >> >To unsubscribe, e-mail:
> >>velocity-user-unsubscribe@jakarta.apache.org
> >> >>> >> >For additional commands, e-mail:
> >> >>>velocity-user-help@jakarta.apache.org
> >> >>> >> >
> >> >>> >>
> >> >>> >>_________________________________________________________________
> >> >>> >>Be the first to hear what's new at MSN - sign up to our free
> >> >>>newsletters!
> >> >>> >>http://www.msn.co.uk/newsletters
> >> >>> >>
> >> >>> >>
> >> >>>
> >> >>---------------------------------------------------------------------
> >> >>> >>To unsubscribe, e-mail:
> >>velocity-user-unsubscribe@jakarta.apache.org
> >> >>> >>For additional commands, e-mail:
> >>velocity-user-help@jakarta.apache.org
> >> >>> >>
> >> >>> >>
> >> >>> >
> >> >>> >
> >> >>> >--
> >> >>> >Forio Business Simulations
> >> >>> >
> >> >>> >Will Glass-Husain
> >> >>> >wglass@forio.com
> >> >>> >www.forio.com
> >> >>> >
> >> >>>
> >> >---------------------------------------------------------------------
> >> >>> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >> >>> >For additional commands, e-mail:
> >>velocity-user-help@jakarta.apache.org
> >> >>> >
> >> >>>
> >> >>>_________________________________________________________________
> >> >>>Download the new Windows Live Toolbar, including Desktop search!
> >> >>>http://toolbar.live.com/?mkt=en-gb
> >> >>>
> >> >>>
> >> >>>---------------------------------------------------------------------
> >> >>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >> >>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >> >>>
> >> >>>
> >> >>
> >> >>
> >> >>--
> >> >>Forio Business Simulations
> >> >>
> >> >>Will Glass-Husain
> >> >>wglass@forio.com
> >> >>www.forio.com
> >> >>
> >> >>---------------------------------------------------------------------
> >> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >> >>
> >> >
> >> >_________________________________________________________________
> >> >Windows Live� Messenger has arrived. Click here to download it for
> >>free!
> >> >http://imagine-msn.com/messenger/launch80/?locale=en-gb
> >> >
> >> >
> >> >---------------------------------------------------------------------
> >> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >> >
> >>
> >>_________________________________________________________________
> >>Be the first to hear what's new at MSN - sign up to our free newsletters!
> >>http://www.msn.co.uk/newsletters
> >>
> >>
> >>---------------------------------------------------------------------
> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>
> >>
> >
> >
> >--
> >Forio Business Simulations
> >
> >Will Glass-Husain
> >wglass@forio.com
> >www.forio.com
>
> _________________________________________________________________
> Windows Live� Messenger has arrived. Click here to download it for free!
> http://imagine-msn.com/messenger/launch80/?locale=en-gb
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
>
--
Forio Business Simulations
Will Glass-Husain
wglass@forio.com
www.forio.com
Re: Velocity Config/Security Issue
Posted by Robin Mannering <ro...@hotmail.com>.
Hi,
Sorry I forgot the velocity version: Velocity 1.4
>From: "Will Glass-Husain" <wg...@forio.com>
>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>To: "Velocity Users List" <ve...@jakarta.apache.org>
>Subject: Re: Velocity Config/Security Issue
>Date: Wed, 11 Oct 2006 15:54:51 -0700
>
>One more question. What's your platform
>-- version of Tomcat
>-- version of JDK
>-- Win, Linux, etc?
>
>(and to repeat the last email for redundancy)
>-- VelocityServlet or VelocityViewServlet (with version)
>
>I run an instance of Tomcat with a security policy. I've found
>numerous inconsistencies even within Tomcat that require security
>permissions to be opened up. (There was a bug with the 4.1.x series
>for example for which I had to open up something similar).
>
>I tend to think you've hit a Tomcat bug triggered by the way Velocity
>accesses the request object. Send the info back and we can dig into
>this.
>
>WILL
>
>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>>Sorry, some more logging that might make it clearer.
>>
>>My local machine uses request objects:
>>org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce
>>and
>>org.apache.catalina.core.ApplicationHttpRequest@1e389b8
>>
>>Whereas the hosted server with the problem uses:
>>org.apache.catalina.connector.RequestFacade@121d818
>>and
>>org.apache.catalina.core.ApplicationHttpRequest@76f954
>>
>>
>>
>>Log 1 - From action class running on hosted server
>>--------------------------------------------------
>>11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
>> | request = 'org.apache.catalina.connector.RequestFacade@121d818'
>>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> | request.getContextPath() = ''
>>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> | request.getMethod() = 'GET'
>>11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
>> | request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
>>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> | request.getRequestURI() = '/test.htm'
>>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> | request.getRequestURL() = 'http://www.chaletexplorer.com/test.htm'
>>11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
>> | request.getServletPath() = '/test.htm'
>>
>>
>>Log 2 - From VM Template/page running on hosted server
>>------------------------------------------------------
>>request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
>>request.contextPath = '/'
>>request.method = 'GET'
>>request.session.id = '$request.session.id'
>>request.requestURI = '//test.vm'
>>request.requestURL = 'http://www.chaletexplorer.com//test.vm'
>>request.servletPath = '/test.vm'
>>
>>
>>Log 3 - From action class (running on my local machine)
>>-------------------------------------------------------
>>
>>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> | request = 'org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce'
>>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> | request.getContextPath() = '/indy'
>>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> | request.getMethod() = 'GET'
>>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> | request.getSession().getId() = '79E50B9B3F25A2897BF420521952D51F'
>>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> | request.getRequestURI() = '/indy/test.htm'
>>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
>> | request.getRequestURL() = 'http://localhost:8080/indy/test.htm'
>>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
>> | request.getServletPath() = '/test.htm'
>>
>>
>>Log 4 - From VM Template/page (running on my local machine)
>>-----------------------------------------------------------
>>request = 'org.apache.catalina.core.ApplicationHttpRequest@1e389b8'
>>request.contextPath = '/indy'
>>request.method = 'GET'
>>request.session.id = '79E50B9B3F25A2897BF420521952D51F'
>>request.requestURI = '/indy/test.vm'
>>request.requestURL = 'http://localhost:8080/indy/test.htm'
>>request.servletPath = '/test.vm'
>>
>>
>>
>>--------------------------------------------------
>>
>>
>> >From: "Robin Mannering" <ro...@hotmail.com>
>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >To: velocity-user@jakarta.apache.org
>> >Subject: Re: Velocity Config/Security Issue
>> >Date: Wed, 11 Oct 2006 22:08:29 +0000
>> >
>> >Hi all,
>> >
>> >Can anyone shed some light? I have some more facts now....
>> >
>> >The original problem was Velocity required permission on a core package
>> >within catalina. Is this because it couldn't find the 'correct' request
>> >object.
>> >
>> >Here are some logs, the first is from a Struts action class, the second
>>is
>> >output from the velocity template forwarded to immediately after the
>>action
>> >class. They refer to different request objects that ultimately give
>> >different values. Should the velocity template not also refer to
>> >org.apache.catalina.connector.RequestFacade@121d818 ??
>> >
>> >Any help/clues would be greatly appreciated.
>> >
>> >Log 1 - From action class
>> >----------------------------------
>> >11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
>> > | request = 'org.apache.catalina.connector.RequestFacade@121d818'
>> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> > | request.getContextPath() = ''
>> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> > | request.getMethod() = 'GET'
>> >11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
>> > | request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
>> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> > | request.getRequestURI() = '/test.htm'
>> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> > | request.getRequestURL() =
>>'http://www.chaletexplorer.com/test.htm'
>> >11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
>> > | request.getServletPath() = '/test.htm'
>> >
>> >Log 2 - From VM Template/page
>> >-----------------------------
>> >request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
>> >
>> >request.contextPath = '/'
>> >
>> >request.method = 'GET'
>> >
>> >request.session.id = '$request.session.id'
>> >
>> >request.requestURI = '//test.vm'
>> >
>> >request.requestURL = 'http://www.chaletexplorer.com//test.vm'
>> >
>> >request.servletPath = '/test.vm'
>> >
>> >
>> >
>> >
>> >
>> >
>> >
>> >>From: "Will Glass-Husain" <wg...@forio.com>
>> >>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >>To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >>Subject: Re: Velocity Config/Security Issue
>> >>Date: Wed, 11 Oct 2006 06:25:35 -0700
>> >>
>> >>I don't think it's Velocity which requires that permission, I'm
>> >>guessing it's the request object which is ultimately provided by
>> >>Tomcat...
>> >>
>> >>WILL
>> >>
>> >>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>> >>>Hi Will,
>> >>>
>> >>>Thanks for the links, I'll give them a thorough read.
>> >>>
>> >>>I've been working with the hosting company who set up the server
>>config
>> >>>and
>> >>>they have give the application permission to org.apache.catalina.core
>> >>>although they are troubled to do so.
>> >>>
>> >>>They seem very surprised that velocity requires this permission.
>> >>>
>> >>>Since they granted the permission, the problem has cleared up and
>> >>>$request.contextPath now has a value within a velocity template
>>(although
>> >>>this has changed from an empty value to '/' so I need to make source
>> >>>amendments. Not a problem, just worrying it takes on a new value in a
>> >>>different hosting environment.
>> >>>
>> >>>Thanks again for your help
>> >>>Robin
>> >>>
>> >>>
>> >>> >From: "Will Glass-Husain" <wg...@forio.com>
>> >>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >>> >Subject: Re: Velocity Config/Security Issue
>> >>> >Date: Tue, 10 Oct 2006 15:04:32 -0700
>> >>> >
>> >>> >What app server are you using? This is a server configuration
>>issue.
>> >>> >If someone else set it up, you might also want to work with them.
>> >>> >
>> >>> >If you're using Tomcat, check out:
>> >>> >http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
>> >>> >
>> >>> >And you should read the Sun docs at:
>> >>> >http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
>> >>> >
>> >>> >WILL
>> >>> >
>> >>> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
>> >>> >>Hi Will,
>> >>> >>
>> >>> >>thanks for your help. Sorry. I'm new to permissions, could you
>>explain
>> >>>a
>> >>> >>little more for me please.
>> >>> >>
>> >>> >>Thanks
>> >>> >>Robin
>> >>> >>
>> >>> >>
>> >>> >> >From: "Will Glass-Husain" <wg...@forio.com>
>> >>> >> >Reply-To: "Velocity Users List"
>><ve...@jakarta.apache.org>
>> >>> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >>> >> >Subject: Re: Velocity Config/Security Issue
>> >>> >> >Date: Tue, 10 Oct 2006 08:24:57 -0700
>> >>> >> >
>> >>> >> >Looks like the security policy on your app server needs to be
>>tuned.
>> >>> >> >Have you tried giving the permission java.lang.RuntimePermission
>>for
>> >>> >> >accessClassInPackage.org.apache.catalina.core?
>> >>> >> >
>> >>> >> >WILL
>> >>> >> >
>> >>> >> >On 10/10/06, Robin Mannering <ro...@hotmail.com>
>>wrote:
>> >>> >> >>Hi all,
>> >>> >> >>
>> >>> >> >>I'm new back on this list in a while, please excuse if the
>> >>>following
>> >>> >> >>problem
>> >>> >> >>is obvious/has been posted before.
>> >>> >> >>
>> >>> >> >>I am transferring an existing site based on Struts/Velocity to a
>> >>>new
>> >>> >>web
>> >>> >> >>hosting provider. The application runs smoothly on its current
>> >>>host.
>> >>> >> >>
>> >>> >> >>However, there seems to be one last stumbling block with the new
>> >>>server
>> >>> >>in
>> >>> >> >>that the Struts object; 'request' appears not to be in scope
>>within
>> >>> >> >>velocity
>> >>> >> >>pages (there may be others not in scope).
>> >>> >> >>
>> >>> >> >>I'm using the VelocityLayoutServlet if that helps.
>> >>> >> >>
>> >>> >> >>I've attached a snippet of the log file that points to the
>>problem
>> >>>I
>> >>> >> >>mentioned, notable the 'java.security.AccessControlException'
>>and
>> >>> >> >>'$request.contextPath is not a valid reference'
>> >>> >> >>
>> >>> >> >>All other velocity directives appear to be functioning as
>>normal.
>> >>> >> >>
>> >>> >> >>Has anyone seen this behaviour before? Any help would be greatly
>> >>> >> >>appreciated.
>> >>> >> >>
>> >>> >> >>Kind regards
>> >>> >> >>Robin
>> >>> >> >>
>> >>> >> >>10-Oct 02:45:21.752 |INFO | [/].log
>> >>> >> >> | Velocity [info] ResourceManager : found
>> >>> >>/pages/frontend/home.vm
>> >>> >> >>with loader org.apache.velocity.tools.view.servlet.WebappLoader
>> >>> >> >>10-Oct 02:45:21.761 |INFO | [/].log
>> >>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>> >>> >> >>java.security.AccessControlException: access denied
>> >>> >> >>(java.lang.RuntimePermission
>> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >>> >> >>10-Oct 02:45:21.763 |INFO | [/].log
>> >>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
>> >>> >> >>contextPath
>> >>> >> >>: java.security.AccessControlException: access denied
>> >>> >> >>(java.lang.RuntimePermission
>> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >>> >> >>10-Oct 02:45:21.764 |INFO | [/].log
>> >>> >> >> | Velocity [error] RHS of #set statement is null. Context
>> >>>will
>> >>> >>not
>> >>> >> >>be
>> >>> >> >>modified. /pages/frontend/home.vm [line 9, column 1]
>> >>> >> >>10-Oct 02:45:21.772 |INFO | [/].log
>> >>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>> >>> >> >>java.security.AccessControlException: access denied
>> >>> >> >>(java.lang.RuntimePermission
>> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >>> >> >>10-Oct 02:45:21.773 |INFO | [/].log
>> >>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
>> >>> >> >>contextPath
>> >>> >> >>: java.security.AccessControlException: access denied
>> >>> >> >>(java.lang.RuntimePermission
>> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >>> >> >>10-Oct 02:45:21.774 |INFO | [/].log
>> >>> >> >> | Velocity [warn]
>> >>> >> >>org.apache.velocity.runtime.exception.ReferenceException:
>>reference
>> >>>:
>> >>> >> >>template = /pages/frontend/home.vm [line 32,column 34] :
>> >>> >> >>$request.contextPath is not a valid reference.
>> >>> >> >>
>> >>> >>
>> >>_________________________________________________________________
>> >>> >> >>Windows Liveďż˝ Messenger has arrived. Click here to download it
>>for
>> >>> >>free!
>> >>> >> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
>> >>> >> >>
>> >>> >> >>
>> >>> >>
>> >>>
>> >>---------------------------------------------------------------------
>> >>> >> >>To unsubscribe, e-mail:
>> >>>velocity-user-unsubscribe@jakarta.apache.org
>> >>> >> >>For additional commands, e-mail:
>> >>>velocity-user-help@jakarta.apache.org
>> >>> >> >>
>> >>> >> >>
>> >>> >> >
>> >>> >> >
>> >>> >> >--
>> >>> >> >Forio Business Simulations
>> >>> >> >
>> >>> >> >Will Glass-Husain
>> >>> >> >wglass@forio.com
>> >>> >> >www.forio.com
>> >>> >> >
>> >>> >>
>> >>>
>> >---------------------------------------------------------------------
>> >>> >> >To unsubscribe, e-mail:
>>velocity-user-unsubscribe@jakarta.apache.org
>> >>> >> >For additional commands, e-mail:
>> >>>velocity-user-help@jakarta.apache.org
>> >>> >> >
>> >>> >>
>> >>> >>_________________________________________________________________
>> >>> >>Be the first to hear what's new at MSN - sign up to our free
>> >>>newsletters!
>> >>> >>http://www.msn.co.uk/newsletters
>> >>> >>
>> >>> >>
>> >>>
>> >>---------------------------------------------------------------------
>> >>> >>To unsubscribe, e-mail:
>>velocity-user-unsubscribe@jakarta.apache.org
>> >>> >>For additional commands, e-mail:
>>velocity-user-help@jakarta.apache.org
>> >>> >>
>> >>> >>
>> >>> >
>> >>> >
>> >>> >--
>> >>> >Forio Business Simulations
>> >>> >
>> >>> >Will Glass-Husain
>> >>> >wglass@forio.com
>> >>> >www.forio.com
>> >>> >
>> >>>
>> >---------------------------------------------------------------------
>> >>> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >>> >For additional commands, e-mail:
>>velocity-user-help@jakarta.apache.org
>> >>> >
>> >>>
>> >>>_________________________________________________________________
>> >>>Download the new Windows Live Toolbar, including Desktop search!
>> >>>http://toolbar.live.com/?mkt=en-gb
>> >>>
>> >>>
>> >>>---------------------------------------------------------------------
>> >>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >>>
>> >>>
>> >>
>> >>
>> >>--
>> >>Forio Business Simulations
>> >>
>> >>Will Glass-Husain
>> >>wglass@forio.com
>> >>www.forio.com
>> >>
>> >>---------------------------------------------------------------------
>> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >>
>> >
>> >_________________________________________________________________
>> >Windows Liveďż˝ Messenger has arrived. Click here to download it for
>>free!
>> >http://imagine-msn.com/messenger/launch80/?locale=en-gb
>> >
>> >
>> >---------------------------------------------------------------------
>> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >
>>
>>_________________________________________________________________
>>Be the first to hear what's new at MSN - sign up to our free newsletters!
>>http://www.msn.co.uk/newsletters
>>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>>
>>
>
>
>--
>Forio Business Simulations
>
>Will Glass-Husain
>wglass@forio.com
>www.forio.com
_________________________________________________________________
Windows Live Messenger has arrived. Click here to download it for free!
http://imagine-msn.com/messenger/launch80/?locale=en-gb
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Robin Mannering <ro...@hotmail.com>.
Hi Will,
Thanks for your time on this one!
I'm using VelocityLayoutServlet btw.
Here are the details of my local machine and that of my hosted environment.
The technician I have been working with me has just sent me this email which
may be of help too:
------------------------
I've established that this is a security manager problem. When I turn off
the security manager, your test page shows a meaningful value for
request.session.id. I'll need to do more testing to determine which security
grant it needs though. Even with full debugging turned on I don't see any
access denied errors. I'll have to see whether Velocity has any
documentation on what it needs.
------------------------
Local Machine:
org.apache.velocity.tools.view.servlet.VelocityLayoutServlet
Tomcat 5.0
j2sdk1.4.2_05
Apache is NOT installed.
Win XP
Hosted server
org.apache.velocity.tools.view.servlet.VelocityLayoutServlet
Tomcat 5.5.17 (Standard install)
JDK 5
Apache
Linux
>From: "Will Glass-Husain" <wg...@forio.com>
>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>To: "Velocity Users List" <ve...@jakarta.apache.org>
>Subject: Re: Velocity Config/Security Issue
>Date: Wed, 11 Oct 2006 15:54:51 -0700
>
>One more question. What's your platform
>-- version of Tomcat
>-- version of JDK
>-- Win, Linux, etc?
>
>(and to repeat the last email for redundancy)
>-- VelocityServlet or VelocityViewServlet (with version)
>
>I run an instance of Tomcat with a security policy. I've found
>numerous inconsistencies even within Tomcat that require security
>permissions to be opened up. (There was a bug with the 4.1.x series
>for example for which I had to open up something similar).
>
>I tend to think you've hit a Tomcat bug triggered by the way Velocity
>accesses the request object. Send the info back and we can dig into
>this.
>
>WILL
>
>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>>Sorry, some more logging that might make it clearer.
>>
>>My local machine uses request objects:
>>org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce
>>and
>>org.apache.catalina.core.ApplicationHttpRequest@1e389b8
>>
>>Whereas the hosted server with the problem uses:
>>org.apache.catalina.connector.RequestFacade@121d818
>>and
>>org.apache.catalina.core.ApplicationHttpRequest@76f954
>>
>>
>>
>>Log 1 - From action class running on hosted server
>>--------------------------------------------------
>>11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
>> | request = 'org.apache.catalina.connector.RequestFacade@121d818'
>>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> | request.getContextPath() = ''
>>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> | request.getMethod() = 'GET'
>>11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
>> | request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
>>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> | request.getRequestURI() = '/test.htm'
>>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> | request.getRequestURL() = 'http://www.chaletexplorer.com/test.htm'
>>11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
>> | request.getServletPath() = '/test.htm'
>>
>>
>>Log 2 - From VM Template/page running on hosted server
>>------------------------------------------------------
>>request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
>>request.contextPath = '/'
>>request.method = 'GET'
>>request.session.id = '$request.session.id'
>>request.requestURI = '//test.vm'
>>request.requestURL = 'http://www.chaletexplorer.com//test.vm'
>>request.servletPath = '/test.vm'
>>
>>
>>Log 3 - From action class (running on my local machine)
>>-------------------------------------------------------
>>
>>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> | request = 'org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce'
>>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> | request.getContextPath() = '/indy'
>>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> | request.getMethod() = 'GET'
>>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> | request.getSession().getId() = '79E50B9B3F25A2897BF420521952D51F'
>>12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
>> | request.getRequestURI() = '/indy/test.htm'
>>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
>> | request.getRequestURL() = 'http://localhost:8080/indy/test.htm'
>>12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
>> | request.getServletPath() = '/test.htm'
>>
>>
>>Log 4 - From VM Template/page (running on my local machine)
>>-----------------------------------------------------------
>>request = 'org.apache.catalina.core.ApplicationHttpRequest@1e389b8'
>>request.contextPath = '/indy'
>>request.method = 'GET'
>>request.session.id = '79E50B9B3F25A2897BF420521952D51F'
>>request.requestURI = '/indy/test.vm'
>>request.requestURL = 'http://localhost:8080/indy/test.htm'
>>request.servletPath = '/test.vm'
>>
>>
>>
>>--------------------------------------------------
>>
>>
>> >From: "Robin Mannering" <ro...@hotmail.com>
>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >To: velocity-user@jakarta.apache.org
>> >Subject: Re: Velocity Config/Security Issue
>> >Date: Wed, 11 Oct 2006 22:08:29 +0000
>> >
>> >Hi all,
>> >
>> >Can anyone shed some light? I have some more facts now....
>> >
>> >The original problem was Velocity required permission on a core package
>> >within catalina. Is this because it couldn't find the 'correct' request
>> >object.
>> >
>> >Here are some logs, the first is from a Struts action class, the second
>>is
>> >output from the velocity template forwarded to immediately after the
>>action
>> >class. They refer to different request objects that ultimately give
>> >different values. Should the velocity template not also refer to
>> >org.apache.catalina.connector.RequestFacade@121d818 ??
>> >
>> >Any help/clues would be greatly appreciated.
>> >
>> >Log 1 - From action class
>> >----------------------------------
>> >11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
>> > | request = 'org.apache.catalina.connector.RequestFacade@121d818'
>> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> > | request.getContextPath() = ''
>> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
>> > | request.getMethod() = 'GET'
>> >11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
>> > | request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
>> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> > | request.getRequestURI() = '/test.htm'
>> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
>> > | request.getRequestURL() =
>>'http://www.chaletexplorer.com/test.htm'
>> >11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
>> > | request.getServletPath() = '/test.htm'
>> >
>> >Log 2 - From VM Template/page
>> >-----------------------------
>> >request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
>> >
>> >request.contextPath = '/'
>> >
>> >request.method = 'GET'
>> >
>> >request.session.id = '$request.session.id'
>> >
>> >request.requestURI = '//test.vm'
>> >
>> >request.requestURL = 'http://www.chaletexplorer.com//test.vm'
>> >
>> >request.servletPath = '/test.vm'
>> >
>> >
>> >
>> >
>> >
>> >
>> >
>> >>From: "Will Glass-Husain" <wg...@forio.com>
>> >>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >>To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >>Subject: Re: Velocity Config/Security Issue
>> >>Date: Wed, 11 Oct 2006 06:25:35 -0700
>> >>
>> >>I don't think it's Velocity which requires that permission, I'm
>> >>guessing it's the request object which is ultimately provided by
>> >>Tomcat...
>> >>
>> >>WILL
>> >>
>> >>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>> >>>Hi Will,
>> >>>
>> >>>Thanks for the links, I'll give them a thorough read.
>> >>>
>> >>>I've been working with the hosting company who set up the server
>>config
>> >>>and
>> >>>they have give the application permission to org.apache.catalina.core
>> >>>although they are troubled to do so.
>> >>>
>> >>>They seem very surprised that velocity requires this permission.
>> >>>
>> >>>Since they granted the permission, the problem has cleared up and
>> >>>$request.contextPath now has a value within a velocity template
>>(although
>> >>>this has changed from an empty value to '/' so I need to make source
>> >>>amendments. Not a problem, just worrying it takes on a new value in a
>> >>>different hosting environment.
>> >>>
>> >>>Thanks again for your help
>> >>>Robin
>> >>>
>> >>>
>> >>> >From: "Will Glass-Husain" <wg...@forio.com>
>> >>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >>> >Subject: Re: Velocity Config/Security Issue
>> >>> >Date: Tue, 10 Oct 2006 15:04:32 -0700
>> >>> >
>> >>> >What app server are you using? This is a server configuration
>>issue.
>> >>> >If someone else set it up, you might also want to work with them.
>> >>> >
>> >>> >If you're using Tomcat, check out:
>> >>> >http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
>> >>> >
>> >>> >And you should read the Sun docs at:
>> >>> >http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
>> >>> >
>> >>> >WILL
>> >>> >
>> >>> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
>> >>> >>Hi Will,
>> >>> >>
>> >>> >>thanks for your help. Sorry. I'm new to permissions, could you
>>explain
>> >>>a
>> >>> >>little more for me please.
>> >>> >>
>> >>> >>Thanks
>> >>> >>Robin
>> >>> >>
>> >>> >>
>> >>> >> >From: "Will Glass-Husain" <wg...@forio.com>
>> >>> >> >Reply-To: "Velocity Users List"
>><ve...@jakarta.apache.org>
>> >>> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >>> >> >Subject: Re: Velocity Config/Security Issue
>> >>> >> >Date: Tue, 10 Oct 2006 08:24:57 -0700
>> >>> >> >
>> >>> >> >Looks like the security policy on your app server needs to be
>>tuned.
>> >>> >> >Have you tried giving the permission java.lang.RuntimePermission
>>for
>> >>> >> >accessClassInPackage.org.apache.catalina.core?
>> >>> >> >
>> >>> >> >WILL
>> >>> >> >
>> >>> >> >On 10/10/06, Robin Mannering <ro...@hotmail.com>
>>wrote:
>> >>> >> >>Hi all,
>> >>> >> >>
>> >>> >> >>I'm new back on this list in a while, please excuse if the
>> >>>following
>> >>> >> >>problem
>> >>> >> >>is obvious/has been posted before.
>> >>> >> >>
>> >>> >> >>I am transferring an existing site based on Struts/Velocity to a
>> >>>new
>> >>> >>web
>> >>> >> >>hosting provider. The application runs smoothly on its current
>> >>>host.
>> >>> >> >>
>> >>> >> >>However, there seems to be one last stumbling block with the new
>> >>>server
>> >>> >>in
>> >>> >> >>that the Struts object; 'request' appears not to be in scope
>>within
>> >>> >> >>velocity
>> >>> >> >>pages (there may be others not in scope).
>> >>> >> >>
>> >>> >> >>I'm using the VelocityLayoutServlet if that helps.
>> >>> >> >>
>> >>> >> >>I've attached a snippet of the log file that points to the
>>problem
>> >>>I
>> >>> >> >>mentioned, notable the 'java.security.AccessControlException'
>>and
>> >>> >> >>'$request.contextPath is not a valid reference'
>> >>> >> >>
>> >>> >> >>All other velocity directives appear to be functioning as
>>normal.
>> >>> >> >>
>> >>> >> >>Has anyone seen this behaviour before? Any help would be greatly
>> >>> >> >>appreciated.
>> >>> >> >>
>> >>> >> >>Kind regards
>> >>> >> >>Robin
>> >>> >> >>
>> >>> >> >>10-Oct 02:45:21.752 |INFO | [/].log
>> >>> >> >> | Velocity [info] ResourceManager : found
>> >>> >>/pages/frontend/home.vm
>> >>> >> >>with loader org.apache.velocity.tools.view.servlet.WebappLoader
>> >>> >> >>10-Oct 02:45:21.761 |INFO | [/].log
>> >>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>> >>> >> >>java.security.AccessControlException: access denied
>> >>> >> >>(java.lang.RuntimePermission
>> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >>> >> >>10-Oct 02:45:21.763 |INFO | [/].log
>> >>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
>> >>> >> >>contextPath
>> >>> >> >>: java.security.AccessControlException: access denied
>> >>> >> >>(java.lang.RuntimePermission
>> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >>> >> >>10-Oct 02:45:21.764 |INFO | [/].log
>> >>> >> >> | Velocity [error] RHS of #set statement is null. Context
>> >>>will
>> >>> >>not
>> >>> >> >>be
>> >>> >> >>modified. /pages/frontend/home.vm [line 9, column 1]
>> >>> >> >>10-Oct 02:45:21.772 |INFO | [/].log
>> >>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>> >>> >> >>java.security.AccessControlException: access denied
>> >>> >> >>(java.lang.RuntimePermission
>> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >>> >> >>10-Oct 02:45:21.773 |INFO | [/].log
>> >>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
>> >>> >> >>contextPath
>> >>> >> >>: java.security.AccessControlException: access denied
>> >>> >> >>(java.lang.RuntimePermission
>> >>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >>> >> >>10-Oct 02:45:21.774 |INFO | [/].log
>> >>> >> >> | Velocity [warn]
>> >>> >> >>org.apache.velocity.runtime.exception.ReferenceException:
>>reference
>> >>>:
>> >>> >> >>template = /pages/frontend/home.vm [line 32,column 34] :
>> >>> >> >>$request.contextPath is not a valid reference.
>> >>> >> >>
>> >>> >>
>> >>_________________________________________________________________
>> >>> >> >>Windows Liveďż˝ Messenger has arrived. Click here to download it
>>for
>> >>> >>free!
>> >>> >> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
>> >>> >> >>
>> >>> >> >>
>> >>> >>
>> >>>
>> >>---------------------------------------------------------------------
>> >>> >> >>To unsubscribe, e-mail:
>> >>>velocity-user-unsubscribe@jakarta.apache.org
>> >>> >> >>For additional commands, e-mail:
>> >>>velocity-user-help@jakarta.apache.org
>> >>> >> >>
>> >>> >> >>
>> >>> >> >
>> >>> >> >
>> >>> >> >--
>> >>> >> >Forio Business Simulations
>> >>> >> >
>> >>> >> >Will Glass-Husain
>> >>> >> >wglass@forio.com
>> >>> >> >www.forio.com
>> >>> >> >
>> >>> >>
>> >>>
>> >---------------------------------------------------------------------
>> >>> >> >To unsubscribe, e-mail:
>>velocity-user-unsubscribe@jakarta.apache.org
>> >>> >> >For additional commands, e-mail:
>> >>>velocity-user-help@jakarta.apache.org
>> >>> >> >
>> >>> >>
>> >>> >>_________________________________________________________________
>> >>> >>Be the first to hear what's new at MSN - sign up to our free
>> >>>newsletters!
>> >>> >>http://www.msn.co.uk/newsletters
>> >>> >>
>> >>> >>
>> >>>
>> >>---------------------------------------------------------------------
>> >>> >>To unsubscribe, e-mail:
>>velocity-user-unsubscribe@jakarta.apache.org
>> >>> >>For additional commands, e-mail:
>>velocity-user-help@jakarta.apache.org
>> >>> >>
>> >>> >>
>> >>> >
>> >>> >
>> >>> >--
>> >>> >Forio Business Simulations
>> >>> >
>> >>> >Will Glass-Husain
>> >>> >wglass@forio.com
>> >>> >www.forio.com
>> >>> >
>> >>>
>> >---------------------------------------------------------------------
>> >>> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >>> >For additional commands, e-mail:
>>velocity-user-help@jakarta.apache.org
>> >>> >
>> >>>
>> >>>_________________________________________________________________
>> >>>Download the new Windows Live Toolbar, including Desktop search!
>> >>>http://toolbar.live.com/?mkt=en-gb
>> >>>
>> >>>
>> >>>---------------------------------------------------------------------
>> >>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >>>
>> >>>
>> >>
>> >>
>> >>--
>> >>Forio Business Simulations
>> >>
>> >>Will Glass-Husain
>> >>wglass@forio.com
>> >>www.forio.com
>> >>
>> >>---------------------------------------------------------------------
>> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >>
>> >
>> >_________________________________________________________________
>> >Windows Liveďż˝ Messenger has arrived. Click here to download it for
>>free!
>> >http://imagine-msn.com/messenger/launch80/?locale=en-gb
>> >
>> >
>> >---------------------------------------------------------------------
>> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >
>>
>>_________________________________________________________________
>>Be the first to hear what's new at MSN - sign up to our free newsletters!
>>http://www.msn.co.uk/newsletters
>>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>>
>>
>
>
>--
>Forio Business Simulations
>
>Will Glass-Husain
>wglass@forio.com
>www.forio.com
_________________________________________________________________
Windows Live Messenger has arrived. Click here to download it for free!
http://imagine-msn.com/messenger/launch80/?locale=en-gb
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Will Glass-Husain <wg...@forio.com>.
One more question. What's your platform
-- version of Tomcat
-- version of JDK
-- Win, Linux, etc?
(and to repeat the last email for redundancy)
-- VelocityServlet or VelocityViewServlet (with version)
I run an instance of Tomcat with a security policy. I've found
numerous inconsistencies even within Tomcat that require security
permissions to be opened up. (There was a bug with the 4.1.x series
for example for which I had to open up something similar).
I tend to think you've hit a Tomcat bug triggered by the way Velocity
accesses the request object. Send the info back and we can dig into
this.
WILL
On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
> Sorry, some more logging that might make it clearer.
>
> My local machine uses request objects:
> org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce
> and
> org.apache.catalina.core.ApplicationHttpRequest@1e389b8
>
> Whereas the hosted server with the problem uses:
> org.apache.catalina.connector.RequestFacade@121d818
> and
> org.apache.catalina.core.ApplicationHttpRequest@76f954
>
>
>
> Log 1 - From action class running on hosted server
> --------------------------------------------------
> 11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
> | request = 'org.apache.catalina.connector.RequestFacade@121d818'
> 11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> | request.getContextPath() = ''
> 11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> | request.getMethod() = 'GET'
> 11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
> | request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
> 11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> | request.getRequestURI() = '/test.htm'
> 11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> | request.getRequestURL() = 'http://www.chaletexplorer.com/test.htm'
> 11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
> | request.getServletPath() = '/test.htm'
>
>
> Log 2 - From VM Template/page running on hosted server
> ------------------------------------------------------
> request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
> request.contextPath = '/'
> request.method = 'GET'
> request.session.id = '$request.session.id'
> request.requestURI = '//test.vm'
> request.requestURL = 'http://www.chaletexplorer.com//test.vm'
> request.servletPath = '/test.vm'
>
>
> Log 3 - From action class (running on my local machine)
> -------------------------------------------------------
>
> 12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> | request = 'org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce'
> 12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> | request.getContextPath() = '/indy'
> 12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> | request.getMethod() = 'GET'
> 12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> | request.getSession().getId() = '79E50B9B3F25A2897BF420521952D51F'
> 12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> | request.getRequestURI() = '/indy/test.htm'
> 12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
> | request.getRequestURL() = 'http://localhost:8080/indy/test.htm'
> 12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
> | request.getServletPath() = '/test.htm'
>
>
> Log 4 - From VM Template/page (running on my local machine)
> -----------------------------------------------------------
> request = 'org.apache.catalina.core.ApplicationHttpRequest@1e389b8'
> request.contextPath = '/indy'
> request.method = 'GET'
> request.session.id = '79E50B9B3F25A2897BF420521952D51F'
> request.requestURI = '/indy/test.vm'
> request.requestURL = 'http://localhost:8080/indy/test.htm'
> request.servletPath = '/test.vm'
>
>
>
> --------------------------------------------------
>
>
> >From: "Robin Mannering" <ro...@hotmail.com>
> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >To: velocity-user@jakarta.apache.org
> >Subject: Re: Velocity Config/Security Issue
> >Date: Wed, 11 Oct 2006 22:08:29 +0000
> >
> >Hi all,
> >
> >Can anyone shed some light? I have some more facts now....
> >
> >The original problem was Velocity required permission on a core package
> >within catalina. Is this because it couldn't find the 'correct' request
> >object.
> >
> >Here are some logs, the first is from a Struts action class, the second is
> >output from the velocity template forwarded to immediately after the action
> >class. They refer to different request objects that ultimately give
> >different values. Should the velocity template not also refer to
> >org.apache.catalina.connector.RequestFacade@121d818 ??
> >
> >Any help/clues would be greatly appreciated.
> >
> >Log 1 - From action class
> >----------------------------------
> >11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
> > | request = 'org.apache.catalina.connector.RequestFacade@121d818'
> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> > | request.getContextPath() = ''
> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> > | request.getMethod() = 'GET'
> >11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
> > | request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> > | request.getRequestURI() = '/test.htm'
> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> > | request.getRequestURL() = 'http://www.chaletexplorer.com/test.htm'
> >11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
> > | request.getServletPath() = '/test.htm'
> >
> >Log 2 - From VM Template/page
> >-----------------------------
> >request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
> >
> >request.contextPath = '/'
> >
> >request.method = 'GET'
> >
> >request.session.id = '$request.session.id'
> >
> >request.requestURI = '//test.vm'
> >
> >request.requestURL = 'http://www.chaletexplorer.com//test.vm'
> >
> >request.servletPath = '/test.vm'
> >
> >
> >
> >
> >
> >
> >
> >>From: "Will Glass-Husain" <wg...@forio.com>
> >>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>Subject: Re: Velocity Config/Security Issue
> >>Date: Wed, 11 Oct 2006 06:25:35 -0700
> >>
> >>I don't think it's Velocity which requires that permission, I'm
> >>guessing it's the request object which is ultimately provided by
> >>Tomcat...
> >>
> >>WILL
> >>
> >>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
> >>>Hi Will,
> >>>
> >>>Thanks for the links, I'll give them a thorough read.
> >>>
> >>>I've been working with the hosting company who set up the server config
> >>>and
> >>>they have give the application permission to org.apache.catalina.core
> >>>although they are troubled to do so.
> >>>
> >>>They seem very surprised that velocity requires this permission.
> >>>
> >>>Since they granted the permission, the problem has cleared up and
> >>>$request.contextPath now has a value within a velocity template (although
> >>>this has changed from an empty value to '/' so I need to make source
> >>>amendments. Not a problem, just worrying it takes on a new value in a
> >>>different hosting environment.
> >>>
> >>>Thanks again for your help
> >>>Robin
> >>>
> >>>
> >>> >From: "Will Glass-Husain" <wg...@forio.com>
> >>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>> >Subject: Re: Velocity Config/Security Issue
> >>> >Date: Tue, 10 Oct 2006 15:04:32 -0700
> >>> >
> >>> >What app server are you using? This is a server configuration issue.
> >>> >If someone else set it up, you might also want to work with them.
> >>> >
> >>> >If you're using Tomcat, check out:
> >>> >http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
> >>> >
> >>> >And you should read the Sun docs at:
> >>> >http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
> >>> >
> >>> >WILL
> >>> >
> >>> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
> >>> >>Hi Will,
> >>> >>
> >>> >>thanks for your help. Sorry. I'm new to permissions, could you explain
> >>>a
> >>> >>little more for me please.
> >>> >>
> >>> >>Thanks
> >>> >>Robin
> >>> >>
> >>> >>
> >>> >> >From: "Will Glass-Husain" <wg...@forio.com>
> >>> >> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>> >> >Subject: Re: Velocity Config/Security Issue
> >>> >> >Date: Tue, 10 Oct 2006 08:24:57 -0700
> >>> >> >
> >>> >> >Looks like the security policy on your app server needs to be tuned.
> >>> >> >Have you tried giving the permission java.lang.RuntimePermission for
> >>> >> >accessClassInPackage.org.apache.catalina.core?
> >>> >> >
> >>> >> >WILL
> >>> >> >
> >>> >> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
> >>> >> >>Hi all,
> >>> >> >>
> >>> >> >>I'm new back on this list in a while, please excuse if the
> >>>following
> >>> >> >>problem
> >>> >> >>is obvious/has been posted before.
> >>> >> >>
> >>> >> >>I am transferring an existing site based on Struts/Velocity to a
> >>>new
> >>> >>web
> >>> >> >>hosting provider. The application runs smoothly on its current
> >>>host.
> >>> >> >>
> >>> >> >>However, there seems to be one last stumbling block with the new
> >>>server
> >>> >>in
> >>> >> >>that the Struts object; 'request' appears not to be in scope within
> >>> >> >>velocity
> >>> >> >>pages (there may be others not in scope).
> >>> >> >>
> >>> >> >>I'm using the VelocityLayoutServlet if that helps.
> >>> >> >>
> >>> >> >>I've attached a snippet of the log file that points to the problem
> >>>I
> >>> >> >>mentioned, notable the 'java.security.AccessControlException' and
> >>> >> >>'$request.contextPath is not a valid reference'
> >>> >> >>
> >>> >> >>All other velocity directives appear to be functioning as normal.
> >>> >> >>
> >>> >> >>Has anyone seen this behaviour before? Any help would be greatly
> >>> >> >>appreciated.
> >>> >> >>
> >>> >> >>Kind regards
> >>> >> >>Robin
> >>> >> >>
> >>> >> >>10-Oct 02:45:21.752 |INFO | [/].log
> >>> >> >> | Velocity [info] ResourceManager : found
> >>> >>/pages/frontend/home.vm
> >>> >> >>with loader org.apache.velocity.tools.view.servlet.WebappLoader
> >>> >> >>10-Oct 02:45:21.761 |INFO | [/].log
> >>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> >>> >> >>java.security.AccessControlException: access denied
> >>> >> >>(java.lang.RuntimePermission
> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >>> >> >>10-Oct 02:45:21.763 |INFO | [/].log
> >>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
> >>> >> >>contextPath
> >>> >> >>: java.security.AccessControlException: access denied
> >>> >> >>(java.lang.RuntimePermission
> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >>> >> >>10-Oct 02:45:21.764 |INFO | [/].log
> >>> >> >> | Velocity [error] RHS of #set statement is null. Context
> >>>will
> >>> >>not
> >>> >> >>be
> >>> >> >>modified. /pages/frontend/home.vm [line 9, column 1]
> >>> >> >>10-Oct 02:45:21.772 |INFO | [/].log
> >>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> >>> >> >>java.security.AccessControlException: access denied
> >>> >> >>(java.lang.RuntimePermission
> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >>> >> >>10-Oct 02:45:21.773 |INFO | [/].log
> >>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
> >>> >> >>contextPath
> >>> >> >>: java.security.AccessControlException: access denied
> >>> >> >>(java.lang.RuntimePermission
> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >>> >> >>10-Oct 02:45:21.774 |INFO | [/].log
> >>> >> >> | Velocity [warn]
> >>> >> >>org.apache.velocity.runtime.exception.ReferenceException: reference
> >>>:
> >>> >> >>template = /pages/frontend/home.vm [line 32,column 34] :
> >>> >> >>$request.contextPath is not a valid reference.
> >>> >> >>
> >>> >> >>_________________________________________________________________
> >>> >> >>Windows Live� Messenger has arrived. Click here to download it for
> >>> >>free!
> >>> >> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
> >>> >> >>
> >>> >> >>
> >>> >>
> >>> >>---------------------------------------------------------------------
> >>> >> >>To unsubscribe, e-mail:
> >>>velocity-user-unsubscribe@jakarta.apache.org
> >>> >> >>For additional commands, e-mail:
> >>>velocity-user-help@jakarta.apache.org
> >>> >> >>
> >>> >> >>
> >>> >> >
> >>> >> >
> >>> >> >--
> >>> >> >Forio Business Simulations
> >>> >> >
> >>> >> >Will Glass-Husain
> >>> >> >wglass@forio.com
> >>> >> >www.forio.com
> >>> >> >
> >>> >>
> >>> >---------------------------------------------------------------------
> >>> >> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>> >> >For additional commands, e-mail:
> >>>velocity-user-help@jakarta.apache.org
> >>> >> >
> >>> >>
> >>> >>_________________________________________________________________
> >>> >>Be the first to hear what's new at MSN - sign up to our free
> >>>newsletters!
> >>> >>http://www.msn.co.uk/newsletters
> >>> >>
> >>> >>
> >>> >>---------------------------------------------------------------------
> >>> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>> >>
> >>> >>
> >>> >
> >>> >
> >>> >--
> >>> >Forio Business Simulations
> >>> >
> >>> >Will Glass-Husain
> >>> >wglass@forio.com
> >>> >www.forio.com
> >>> >
> >>> >---------------------------------------------------------------------
> >>> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>> >
> >>>
> >>>_________________________________________________________________
> >>>Download the new Windows Live Toolbar, including Desktop search!
> >>>http://toolbar.live.com/?mkt=en-gb
> >>>
> >>>
> >>>---------------------------------------------------------------------
> >>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>>
> >>>
> >>
> >>
> >>--
> >>Forio Business Simulations
> >>
> >>Will Glass-Husain
> >>wglass@forio.com
> >>www.forio.com
> >>
> >>---------------------------------------------------------------------
> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>
> >
> >_________________________________________________________________
> >Windows Live� Messenger has arrived. Click here to download it for free!
> >http://imagine-msn.com/messenger/launch80/?locale=en-gb
> >
> >
> >---------------------------------------------------------------------
> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >
>
> _________________________________________________________________
> Be the first to hear what's new at MSN - sign up to our free newsletters!
> http://www.msn.co.uk/newsletters
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
>
--
Forio Business Simulations
Will Glass-Husain
wglass@forio.com
www.forio.com
Re: Velocity Config/Security Issue
Posted by Will Glass-Husain <wg...@forio.com>.
Robin,
How is your web app set up?
--Do you use VelocityServlet or VelocityViewServlet?
--If you write a simple servlet that doesn't use velocity but calls
getRequest().getSession().getId()
do you have the same problem?
WILL
On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
> Sorry, some more logging that might make it clearer.
>
> My local machine uses request objects:
> org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce
> and
> org.apache.catalina.core.ApplicationHttpRequest@1e389b8
>
> Whereas the hosted server with the problem uses:
> org.apache.catalina.connector.RequestFacade@121d818
> and
> org.apache.catalina.core.ApplicationHttpRequest@76f954
>
>
>
> Log 1 - From action class running on hosted server
> --------------------------------------------------
> 11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
> | request = 'org.apache.catalina.connector.RequestFacade@121d818'
> 11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> | request.getContextPath() = ''
> 11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> | request.getMethod() = 'GET'
> 11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
> | request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
> 11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> | request.getRequestURI() = '/test.htm'
> 11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> | request.getRequestURL() = 'http://www.chaletexplorer.com/test.htm'
> 11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
> | request.getServletPath() = '/test.htm'
>
>
> Log 2 - From VM Template/page running on hosted server
> ------------------------------------------------------
> request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
> request.contextPath = '/'
> request.method = 'GET'
> request.session.id = '$request.session.id'
> request.requestURI = '//test.vm'
> request.requestURL = 'http://www.chaletexplorer.com//test.vm'
> request.servletPath = '/test.vm'
>
>
> Log 3 - From action class (running on my local machine)
> -------------------------------------------------------
>
> 12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> | request = 'org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce'
> 12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> | request.getContextPath() = '/indy'
> 12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> | request.getMethod() = 'GET'
> 12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> | request.getSession().getId() = '79E50B9B3F25A2897BF420521952D51F'
> 12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
> | request.getRequestURI() = '/indy/test.htm'
> 12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
> | request.getRequestURL() = 'http://localhost:8080/indy/test.htm'
> 12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
> | request.getServletPath() = '/test.htm'
>
>
> Log 4 - From VM Template/page (running on my local machine)
> -----------------------------------------------------------
> request = 'org.apache.catalina.core.ApplicationHttpRequest@1e389b8'
> request.contextPath = '/indy'
> request.method = 'GET'
> request.session.id = '79E50B9B3F25A2897BF420521952D51F'
> request.requestURI = '/indy/test.vm'
> request.requestURL = 'http://localhost:8080/indy/test.htm'
> request.servletPath = '/test.vm'
>
>
>
> --------------------------------------------------
>
>
> >From: "Robin Mannering" <ro...@hotmail.com>
> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >To: velocity-user@jakarta.apache.org
> >Subject: Re: Velocity Config/Security Issue
> >Date: Wed, 11 Oct 2006 22:08:29 +0000
> >
> >Hi all,
> >
> >Can anyone shed some light? I have some more facts now....
> >
> >The original problem was Velocity required permission on a core package
> >within catalina. Is this because it couldn't find the 'correct' request
> >object.
> >
> >Here are some logs, the first is from a Struts action class, the second is
> >output from the velocity template forwarded to immediately after the action
> >class. They refer to different request objects that ultimately give
> >different values. Should the velocity template not also refer to
> >org.apache.catalina.connector.RequestFacade@121d818 ??
> >
> >Any help/clues would be greatly appreciated.
> >
> >Log 1 - From action class
> >----------------------------------
> >11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
> > | request = 'org.apache.catalina.connector.RequestFacade@121d818'
> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> > | request.getContextPath() = ''
> >11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> > | request.getMethod() = 'GET'
> >11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
> > | request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> > | request.getRequestURI() = '/test.htm'
> >11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> > | request.getRequestURL() = 'http://www.chaletexplorer.com/test.htm'
> >11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
> > | request.getServletPath() = '/test.htm'
> >
> >Log 2 - From VM Template/page
> >-----------------------------
> >request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
> >
> >request.contextPath = '/'
> >
> >request.method = 'GET'
> >
> >request.session.id = '$request.session.id'
> >
> >request.requestURI = '//test.vm'
> >
> >request.requestURL = 'http://www.chaletexplorer.com//test.vm'
> >
> >request.servletPath = '/test.vm'
> >
> >
> >
> >
> >
> >
> >
> >>From: "Will Glass-Husain" <wg...@forio.com>
> >>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>Subject: Re: Velocity Config/Security Issue
> >>Date: Wed, 11 Oct 2006 06:25:35 -0700
> >>
> >>I don't think it's Velocity which requires that permission, I'm
> >>guessing it's the request object which is ultimately provided by
> >>Tomcat...
> >>
> >>WILL
> >>
> >>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
> >>>Hi Will,
> >>>
> >>>Thanks for the links, I'll give them a thorough read.
> >>>
> >>>I've been working with the hosting company who set up the server config
> >>>and
> >>>they have give the application permission to org.apache.catalina.core
> >>>although they are troubled to do so.
> >>>
> >>>They seem very surprised that velocity requires this permission.
> >>>
> >>>Since they granted the permission, the problem has cleared up and
> >>>$request.contextPath now has a value within a velocity template (although
> >>>this has changed from an empty value to '/' so I need to make source
> >>>amendments. Not a problem, just worrying it takes on a new value in a
> >>>different hosting environment.
> >>>
> >>>Thanks again for your help
> >>>Robin
> >>>
> >>>
> >>> >From: "Will Glass-Husain" <wg...@forio.com>
> >>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>> >Subject: Re: Velocity Config/Security Issue
> >>> >Date: Tue, 10 Oct 2006 15:04:32 -0700
> >>> >
> >>> >What app server are you using? This is a server configuration issue.
> >>> >If someone else set it up, you might also want to work with them.
> >>> >
> >>> >If you're using Tomcat, check out:
> >>> >http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
> >>> >
> >>> >And you should read the Sun docs at:
> >>> >http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
> >>> >
> >>> >WILL
> >>> >
> >>> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
> >>> >>Hi Will,
> >>> >>
> >>> >>thanks for your help. Sorry. I'm new to permissions, could you explain
> >>>a
> >>> >>little more for me please.
> >>> >>
> >>> >>Thanks
> >>> >>Robin
> >>> >>
> >>> >>
> >>> >> >From: "Will Glass-Husain" <wg...@forio.com>
> >>> >> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >>> >> >Subject: Re: Velocity Config/Security Issue
> >>> >> >Date: Tue, 10 Oct 2006 08:24:57 -0700
> >>> >> >
> >>> >> >Looks like the security policy on your app server needs to be tuned.
> >>> >> >Have you tried giving the permission java.lang.RuntimePermission for
> >>> >> >accessClassInPackage.org.apache.catalina.core?
> >>> >> >
> >>> >> >WILL
> >>> >> >
> >>> >> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
> >>> >> >>Hi all,
> >>> >> >>
> >>> >> >>I'm new back on this list in a while, please excuse if the
> >>>following
> >>> >> >>problem
> >>> >> >>is obvious/has been posted before.
> >>> >> >>
> >>> >> >>I am transferring an existing site based on Struts/Velocity to a
> >>>new
> >>> >>web
> >>> >> >>hosting provider. The application runs smoothly on its current
> >>>host.
> >>> >> >>
> >>> >> >>However, there seems to be one last stumbling block with the new
> >>>server
> >>> >>in
> >>> >> >>that the Struts object; 'request' appears not to be in scope within
> >>> >> >>velocity
> >>> >> >>pages (there may be others not in scope).
> >>> >> >>
> >>> >> >>I'm using the VelocityLayoutServlet if that helps.
> >>> >> >>
> >>> >> >>I've attached a snippet of the log file that points to the problem
> >>>I
> >>> >> >>mentioned, notable the 'java.security.AccessControlException' and
> >>> >> >>'$request.contextPath is not a valid reference'
> >>> >> >>
> >>> >> >>All other velocity directives appear to be functioning as normal.
> >>> >> >>
> >>> >> >>Has anyone seen this behaviour before? Any help would be greatly
> >>> >> >>appreciated.
> >>> >> >>
> >>> >> >>Kind regards
> >>> >> >>Robin
> >>> >> >>
> >>> >> >>10-Oct 02:45:21.752 |INFO | [/].log
> >>> >> >> | Velocity [info] ResourceManager : found
> >>> >>/pages/frontend/home.vm
> >>> >> >>with loader org.apache.velocity.tools.view.servlet.WebappLoader
> >>> >> >>10-Oct 02:45:21.761 |INFO | [/].log
> >>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> >>> >> >>java.security.AccessControlException: access denied
> >>> >> >>(java.lang.RuntimePermission
> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >>> >> >>10-Oct 02:45:21.763 |INFO | [/].log
> >>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
> >>> >> >>contextPath
> >>> >> >>: java.security.AccessControlException: access denied
> >>> >> >>(java.lang.RuntimePermission
> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >>> >> >>10-Oct 02:45:21.764 |INFO | [/].log
> >>> >> >> | Velocity [error] RHS of #set statement is null. Context
> >>>will
> >>> >>not
> >>> >> >>be
> >>> >> >>modified. /pages/frontend/home.vm [line 9, column 1]
> >>> >> >>10-Oct 02:45:21.772 |INFO | [/].log
> >>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> >>> >> >>java.security.AccessControlException: access denied
> >>> >> >>(java.lang.RuntimePermission
> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >>> >> >>10-Oct 02:45:21.773 |INFO | [/].log
> >>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
> >>> >> >>contextPath
> >>> >> >>: java.security.AccessControlException: access denied
> >>> >> >>(java.lang.RuntimePermission
> >>> >> >>accessClassInPackage.org.apache.catalina.core)
> >>> >> >>10-Oct 02:45:21.774 |INFO | [/].log
> >>> >> >> | Velocity [warn]
> >>> >> >>org.apache.velocity.runtime.exception.ReferenceException: reference
> >>>:
> >>> >> >>template = /pages/frontend/home.vm [line 32,column 34] :
> >>> >> >>$request.contextPath is not a valid reference.
> >>> >> >>
> >>> >> >>_________________________________________________________________
> >>> >> >>Windows Live� Messenger has arrived. Click here to download it for
> >>> >>free!
> >>> >> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
> >>> >> >>
> >>> >> >>
> >>> >>
> >>> >>---------------------------------------------------------------------
> >>> >> >>To unsubscribe, e-mail:
> >>>velocity-user-unsubscribe@jakarta.apache.org
> >>> >> >>For additional commands, e-mail:
> >>>velocity-user-help@jakarta.apache.org
> >>> >> >>
> >>> >> >>
> >>> >> >
> >>> >> >
> >>> >> >--
> >>> >> >Forio Business Simulations
> >>> >> >
> >>> >> >Will Glass-Husain
> >>> >> >wglass@forio.com
> >>> >> >www.forio.com
> >>> >> >
> >>> >>
> >>> >---------------------------------------------------------------------
> >>> >> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>> >> >For additional commands, e-mail:
> >>>velocity-user-help@jakarta.apache.org
> >>> >> >
> >>> >>
> >>> >>_________________________________________________________________
> >>> >>Be the first to hear what's new at MSN - sign up to our free
> >>>newsletters!
> >>> >>http://www.msn.co.uk/newsletters
> >>> >>
> >>> >>
> >>> >>---------------------------------------------------------------------
> >>> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>> >>
> >>> >>
> >>> >
> >>> >
> >>> >--
> >>> >Forio Business Simulations
> >>> >
> >>> >Will Glass-Husain
> >>> >wglass@forio.com
> >>> >www.forio.com
> >>> >
> >>> >---------------------------------------------------------------------
> >>> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>> >
> >>>
> >>>_________________________________________________________________
> >>>Download the new Windows Live Toolbar, including Desktop search!
> >>>http://toolbar.live.com/?mkt=en-gb
> >>>
> >>>
> >>>---------------------------------------------------------------------
> >>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>>
> >>>
> >>
> >>
> >>--
> >>Forio Business Simulations
> >>
> >>Will Glass-Husain
> >>wglass@forio.com
> >>www.forio.com
> >>
> >>---------------------------------------------------------------------
> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>
> >
> >_________________________________________________________________
> >Windows Live� Messenger has arrived. Click here to download it for free!
> >http://imagine-msn.com/messenger/launch80/?locale=en-gb
> >
> >
> >---------------------------------------------------------------------
> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >
>
> _________________________________________________________________
> Be the first to hear what's new at MSN - sign up to our free newsletters!
> http://www.msn.co.uk/newsletters
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
>
--
Forio Business Simulations
Will Glass-Husain
wglass@forio.com
www.forio.com
Re: Velocity Config/Security Issue
Posted by Robin Mannering <ro...@hotmail.com>.
Sorry, some more logging that might make it clearer.
My local machine uses request objects:
org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce
and
org.apache.catalina.core.ApplicationHttpRequest@1e389b8
Whereas the hosted server with the problem uses:
org.apache.catalina.connector.RequestFacade@121d818
and
org.apache.catalina.core.ApplicationHttpRequest@76f954
Log 1 - From action class running on hosted server
--------------------------------------------------
11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
| request = 'org.apache.catalina.connector.RequestFacade@121d818'
11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
| request.getContextPath() = ''
11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
| request.getMethod() = 'GET'
11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
| request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
| request.getRequestURI() = '/test.htm'
11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
| request.getRequestURL() = 'http://www.chaletexplorer.com/test.htm'
11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
| request.getServletPath() = '/test.htm'
Log 2 - From VM Template/page running on hosted server
------------------------------------------------------
request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
request.contextPath = '/'
request.method = 'GET'
request.session.id = '$request.session.id'
request.requestURI = '//test.vm'
request.requestURL = 'http://www.chaletexplorer.com//test.vm'
request.servletPath = '/test.vm'
Log 3 - From action class (running on my local machine)
-------------------------------------------------------
12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
| request = 'org.apache.coyote.tomcat5.CoyoteRequestFacade@1fd25ce'
12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
| request.getContextPath() = '/indy'
12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
| request.getMethod() = 'GET'
12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
| request.getSession().getId() = '79E50B9B3F25A2897BF420521952D51F'
12-Oct 00:10:17.516 |DEBUG| TestAction.executeLogic
| request.getRequestURI() = '/indy/test.htm'
12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
| request.getRequestURL() = 'http://localhost:8080/indy/test.htm'
12-Oct 00:10:17.532 |DEBUG| TestAction.executeLogic
| request.getServletPath() = '/test.htm'
Log 4 - From VM Template/page (running on my local machine)
-----------------------------------------------------------
request = 'org.apache.catalina.core.ApplicationHttpRequest@1e389b8'
request.contextPath = '/indy'
request.method = 'GET'
request.session.id = '79E50B9B3F25A2897BF420521952D51F'
request.requestURI = '/indy/test.vm'
request.requestURL = 'http://localhost:8080/indy/test.htm'
request.servletPath = '/test.vm'
--------------------------------------------------
>From: "Robin Mannering" <ro...@hotmail.com>
>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>To: velocity-user@jakarta.apache.org
>Subject: Re: Velocity Config/Security Issue
>Date: Wed, 11 Oct 2006 22:08:29 +0000
>
>Hi all,
>
>Can anyone shed some light? I have some more facts now....
>
>The original problem was Velocity required permission on a core package
>within catalina. Is this because it couldn't find the 'correct' request
>object.
>
>Here are some logs, the first is from a Struts action class, the second is
>output from the velocity template forwarded to immediately after the action
>class. They refer to different request objects that ultimately give
>different values. Should the velocity template not also refer to
>org.apache.catalina.connector.RequestFacade@121d818 ??
>
>Any help/clues would be greatly appreciated.
>
>Log 1 - From action class
>----------------------------------
>11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
> | request = 'org.apache.catalina.connector.RequestFacade@121d818'
>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> | request.getContextPath() = ''
>11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
> | request.getMethod() = 'GET'
>11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
> | request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> | request.getRequestURI() = '/test.htm'
>11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
> | request.getRequestURL() = 'http://www.chaletexplorer.com/test.htm'
>11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
> | request.getServletPath() = '/test.htm'
>
>Log 2 - From VM Template/page
>-----------------------------
>request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
>
>request.contextPath = '/'
>
>request.method = 'GET'
>
>request.session.id = '$request.session.id'
>
>request.requestURI = '//test.vm'
>
>request.requestURL = 'http://www.chaletexplorer.com//test.vm'
>
>request.servletPath = '/test.vm'
>
>
>
>
>
>
>
>>From: "Will Glass-Husain" <wg...@forio.com>
>>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>>To: "Velocity Users List" <ve...@jakarta.apache.org>
>>Subject: Re: Velocity Config/Security Issue
>>Date: Wed, 11 Oct 2006 06:25:35 -0700
>>
>>I don't think it's Velocity which requires that permission, I'm
>>guessing it's the request object which is ultimately provided by
>>Tomcat...
>>
>>WILL
>>
>>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>>>Hi Will,
>>>
>>>Thanks for the links, I'll give them a thorough read.
>>>
>>>I've been working with the hosting company who set up the server config
>>>and
>>>they have give the application permission to org.apache.catalina.core
>>>although they are troubled to do so.
>>>
>>>They seem very surprised that velocity requires this permission.
>>>
>>>Since they granted the permission, the problem has cleared up and
>>>$request.contextPath now has a value within a velocity template (although
>>>this has changed from an empty value to '/' so I need to make source
>>>amendments. Not a problem, just worrying it takes on a new value in a
>>>different hosting environment.
>>>
>>>Thanks again for your help
>>>Robin
>>>
>>>
>>> >From: "Will Glass-Husain" <wg...@forio.com>
>>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>>> >Subject: Re: Velocity Config/Security Issue
>>> >Date: Tue, 10 Oct 2006 15:04:32 -0700
>>> >
>>> >What app server are you using? This is a server configuration issue.
>>> >If someone else set it up, you might also want to work with them.
>>> >
>>> >If you're using Tomcat, check out:
>>> >http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
>>> >
>>> >And you should read the Sun docs at:
>>> >http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
>>> >
>>> >WILL
>>> >
>>> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
>>> >>Hi Will,
>>> >>
>>> >>thanks for your help. Sorry. I'm new to permissions, could you explain
>>>a
>>> >>little more for me please.
>>> >>
>>> >>Thanks
>>> >>Robin
>>> >>
>>> >>
>>> >> >From: "Will Glass-Husain" <wg...@forio.com>
>>> >> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>>> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>>> >> >Subject: Re: Velocity Config/Security Issue
>>> >> >Date: Tue, 10 Oct 2006 08:24:57 -0700
>>> >> >
>>> >> >Looks like the security policy on your app server needs to be tuned.
>>> >> >Have you tried giving the permission java.lang.RuntimePermission for
>>> >> >accessClassInPackage.org.apache.catalina.core?
>>> >> >
>>> >> >WILL
>>> >> >
>>> >> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
>>> >> >>Hi all,
>>> >> >>
>>> >> >>I'm new back on this list in a while, please excuse if the
>>>following
>>> >> >>problem
>>> >> >>is obvious/has been posted before.
>>> >> >>
>>> >> >>I am transferring an existing site based on Struts/Velocity to a
>>>new
>>> >>web
>>> >> >>hosting provider. The application runs smoothly on its current
>>>host.
>>> >> >>
>>> >> >>However, there seems to be one last stumbling block with the new
>>>server
>>> >>in
>>> >> >>that the Struts object; 'request' appears not to be in scope within
>>> >> >>velocity
>>> >> >>pages (there may be others not in scope).
>>> >> >>
>>> >> >>I'm using the VelocityLayoutServlet if that helps.
>>> >> >>
>>> >> >>I've attached a snippet of the log file that points to the problem
>>>I
>>> >> >>mentioned, notable the 'java.security.AccessControlException' and
>>> >> >>'$request.contextPath is not a valid reference'
>>> >> >>
>>> >> >>All other velocity directives appear to be functioning as normal.
>>> >> >>
>>> >> >>Has anyone seen this behaviour before? Any help would be greatly
>>> >> >>appreciated.
>>> >> >>
>>> >> >>Kind regards
>>> >> >>Robin
>>> >> >>
>>> >> >>10-Oct 02:45:21.752 |INFO | [/].log
>>> >> >> | Velocity [info] ResourceManager : found
>>> >>/pages/frontend/home.vm
>>> >> >>with loader org.apache.velocity.tools.view.servlet.WebappLoader
>>> >> >>10-Oct 02:45:21.761 |INFO | [/].log
>>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>>> >> >>java.security.AccessControlException: access denied
>>> >> >>(java.lang.RuntimePermission
>>> >> >>accessClassInPackage.org.apache.catalina.core)
>>> >> >>10-Oct 02:45:21.763 |INFO | [/].log
>>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
>>> >> >>contextPath
>>> >> >>: java.security.AccessControlException: access denied
>>> >> >>(java.lang.RuntimePermission
>>> >> >>accessClassInPackage.org.apache.catalina.core)
>>> >> >>10-Oct 02:45:21.764 |INFO | [/].log
>>> >> >> | Velocity [error] RHS of #set statement is null. Context
>>>will
>>> >>not
>>> >> >>be
>>> >> >>modified. /pages/frontend/home.vm [line 9, column 1]
>>> >> >>10-Oct 02:45:21.772 |INFO | [/].log
>>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>>> >> >>java.security.AccessControlException: access denied
>>> >> >>(java.lang.RuntimePermission
>>> >> >>accessClassInPackage.org.apache.catalina.core)
>>> >> >>10-Oct 02:45:21.773 |INFO | [/].log
>>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
>>> >> >>contextPath
>>> >> >>: java.security.AccessControlException: access denied
>>> >> >>(java.lang.RuntimePermission
>>> >> >>accessClassInPackage.org.apache.catalina.core)
>>> >> >>10-Oct 02:45:21.774 |INFO | [/].log
>>> >> >> | Velocity [warn]
>>> >> >>org.apache.velocity.runtime.exception.ReferenceException: reference
>>>:
>>> >> >>template = /pages/frontend/home.vm [line 32,column 34] :
>>> >> >>$request.contextPath is not a valid reference.
>>> >> >>
>>> >> >>_________________________________________________________________
>>> >> >>Windows Live Messenger has arrived. Click here to download it for
>>> >>free!
>>> >> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
>>> >> >>
>>> >> >>
>>> >>
>>> >>---------------------------------------------------------------------
>>> >> >>To unsubscribe, e-mail:
>>>velocity-user-unsubscribe@jakarta.apache.org
>>> >> >>For additional commands, e-mail:
>>>velocity-user-help@jakarta.apache.org
>>> >> >>
>>> >> >>
>>> >> >
>>> >> >
>>> >> >--
>>> >> >Forio Business Simulations
>>> >> >
>>> >> >Will Glass-Husain
>>> >> >wglass@forio.com
>>> >> >www.forio.com
>>> >> >
>>> >>
>>> >---------------------------------------------------------------------
>>> >> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>> >> >For additional commands, e-mail:
>>>velocity-user-help@jakarta.apache.org
>>> >> >
>>> >>
>>> >>_________________________________________________________________
>>> >>Be the first to hear what's new at MSN - sign up to our free
>>>newsletters!
>>> >>http://www.msn.co.uk/newsletters
>>> >>
>>> >>
>>> >>---------------------------------------------------------------------
>>> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>>> >>
>>> >>
>>> >
>>> >
>>> >--
>>> >Forio Business Simulations
>>> >
>>> >Will Glass-Husain
>>> >wglass@forio.com
>>> >www.forio.com
>>> >
>>> >---------------------------------------------------------------------
>>> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>>> >
>>>
>>>_________________________________________________________________
>>>Download the new Windows Live Toolbar, including Desktop search!
>>>http://toolbar.live.com/?mkt=en-gb
>>>
>>>
>>>---------------------------------------------------------------------
>>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>>>
>>>
>>
>>
>>--
>>Forio Business Simulations
>>
>>Will Glass-Husain
>>wglass@forio.com
>>www.forio.com
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>>
>
>_________________________________________________________________
>Windows Live Messenger has arrived. Click here to download it for free!
>http://imagine-msn.com/messenger/launch80/?locale=en-gb
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
_________________________________________________________________
Be the first to hear what's new at MSN - sign up to our free newsletters!
http://www.msn.co.uk/newsletters
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Robin Mannering <ro...@hotmail.com>.
Hi all,
Can anyone shed some light? I have some more facts now....
The original problem was Velocity required permission on a core package
within catalina. Is this because it couldn't find the 'correct' request
object.
Here are some logs, the first is from a Struts action class, the second is
output from the velocity template forwarded to immediately after the action
class. They refer to different request objects that ultimately give
different values. Should the velocity template not also refer to
org.apache.catalina.connector.RequestFacade@121d818 ??
Any help/clues would be greatly appreciated.
Log 1 - From action class
----------------------------------
11-Oct 17:52:49.647 |DEBUG| TestAction.executeLogic
| request = 'org.apache.catalina.connector.RequestFacade@121d818'
11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
| request.getContextPath() = ''
11-Oct 17:52:49.648 |DEBUG| TestAction.executeLogic
| request.getMethod() = 'GET'
11-Oct 17:52:49.649 |DEBUG| TestAction.executeLogic
| request.getSession().getId() = '28536F4542A222DC6F0E6DE23442DC6D'
11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
| request.getRequestURI() = '/test.htm'
11-Oct 17:52:49.650 |DEBUG| TestAction.executeLogic
| request.getRequestURL() = 'http://www.chaletexplorer.com/test.htm'
11-Oct 17:52:49.651 |DEBUG| TestAction.executeLogic
| request.getServletPath() = '/test.htm'
Log 2 - From VM Template/page
-----------------------------
request = 'org.apache.catalina.core.ApplicationHttpRequest@76f954'
request.contextPath = '/'
request.method = 'GET'
request.session.id = '$request.session.id'
request.requestURI = '//test.vm'
request.requestURL = 'http://www.chaletexplorer.com//test.vm'
request.servletPath = '/test.vm'
>From: "Will Glass-Husain" <wg...@forio.com>
>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>To: "Velocity Users List" <ve...@jakarta.apache.org>
>Subject: Re: Velocity Config/Security Issue
>Date: Wed, 11 Oct 2006 06:25:35 -0700
>
>I don't think it's Velocity which requires that permission, I'm
>guessing it's the request object which is ultimately provided by
>Tomcat...
>
>WILL
>
>On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
>>Hi Will,
>>
>>Thanks for the links, I'll give them a thorough read.
>>
>>I've been working with the hosting company who set up the server config
>>and
>>they have give the application permission to org.apache.catalina.core
>>although they are troubled to do so.
>>
>>They seem very surprised that velocity requires this permission.
>>
>>Since they granted the permission, the problem has cleared up and
>>$request.contextPath now has a value within a velocity template (although
>>this has changed from an empty value to '/' so I need to make source
>>amendments. Not a problem, just worrying it takes on a new value in a
>>different hosting environment.
>>
>>Thanks again for your help
>>Robin
>>
>>
>> >From: "Will Glass-Husain" <wg...@forio.com>
>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >Subject: Re: Velocity Config/Security Issue
>> >Date: Tue, 10 Oct 2006 15:04:32 -0700
>> >
>> >What app server are you using? This is a server configuration issue.
>> >If someone else set it up, you might also want to work with them.
>> >
>> >If you're using Tomcat, check out:
>> >http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
>> >
>> >And you should read the Sun docs at:
>> >http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
>> >
>> >WILL
>> >
>> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
>> >>Hi Will,
>> >>
>> >>thanks for your help. Sorry. I'm new to permissions, could you explain
>>a
>> >>little more for me please.
>> >>
>> >>Thanks
>> >>Robin
>> >>
>> >>
>> >> >From: "Will Glass-Husain" <wg...@forio.com>
>> >> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >> >Subject: Re: Velocity Config/Security Issue
>> >> >Date: Tue, 10 Oct 2006 08:24:57 -0700
>> >> >
>> >> >Looks like the security policy on your app server needs to be tuned.
>> >> >Have you tried giving the permission java.lang.RuntimePermission for
>> >> >accessClassInPackage.org.apache.catalina.core?
>> >> >
>> >> >WILL
>> >> >
>> >> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
>> >> >>Hi all,
>> >> >>
>> >> >>I'm new back on this list in a while, please excuse if the following
>> >> >>problem
>> >> >>is obvious/has been posted before.
>> >> >>
>> >> >>I am transferring an existing site based on Struts/Velocity to a new
>> >>web
>> >> >>hosting provider. The application runs smoothly on its current
>>host.
>> >> >>
>> >> >>However, there seems to be one last stumbling block with the new
>>server
>> >>in
>> >> >>that the Struts object; 'request' appears not to be in scope within
>> >> >>velocity
>> >> >>pages (there may be others not in scope).
>> >> >>
>> >> >>I'm using the VelocityLayoutServlet if that helps.
>> >> >>
>> >> >>I've attached a snippet of the log file that points to the problem I
>> >> >>mentioned, notable the 'java.security.AccessControlException' and
>> >> >>'$request.contextPath is not a valid reference'
>> >> >>
>> >> >>All other velocity directives appear to be functioning as normal.
>> >> >>
>> >> >>Has anyone seen this behaviour before? Any help would be greatly
>> >> >>appreciated.
>> >> >>
>> >> >>Kind regards
>> >> >>Robin
>> >> >>
>> >> >>10-Oct 02:45:21.752 |INFO | [/].log
>> >> >> | Velocity [info] ResourceManager : found
>> >>/pages/frontend/home.vm
>> >> >>with loader org.apache.velocity.tools.view.servlet.WebappLoader
>> >> >>10-Oct 02:45:21.761 |INFO | [/].log
>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>> >> >>java.security.AccessControlException: access denied
>> >> >>(java.lang.RuntimePermission
>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >>10-Oct 02:45:21.763 |INFO | [/].log
>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
>> >> >>contextPath
>> >> >>: java.security.AccessControlException: access denied
>> >> >>(java.lang.RuntimePermission
>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >>10-Oct 02:45:21.764 |INFO | [/].log
>> >> >> | Velocity [error] RHS of #set statement is null. Context
>>will
>> >>not
>> >> >>be
>> >> >>modified. /pages/frontend/home.vm [line 9, column 1]
>> >> >>10-Oct 02:45:21.772 |INFO | [/].log
>> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>> >> >>java.security.AccessControlException: access denied
>> >> >>(java.lang.RuntimePermission
>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >>10-Oct 02:45:21.773 |INFO | [/].log
>> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
>> >> >>contextPath
>> >> >>: java.security.AccessControlException: access denied
>> >> >>(java.lang.RuntimePermission
>> >> >>accessClassInPackage.org.apache.catalina.core)
>> >> >>10-Oct 02:45:21.774 |INFO | [/].log
>> >> >> | Velocity [warn]
>> >> >>org.apache.velocity.runtime.exception.ReferenceException: reference
>>:
>> >> >>template = /pages/frontend/home.vm [line 32,column 34] :
>> >> >>$request.contextPath is not a valid reference.
>> >> >>
>> >> >>_________________________________________________________________
>> >> >>Windows Live Messenger has arrived. Click here to download it for
>> >>free!
>> >> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
>> >> >>
>> >> >>
>> >>
>> >>---------------------------------------------------------------------
>> >> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >> >>For additional commands, e-mail:
>>velocity-user-help@jakarta.apache.org
>> >> >>
>> >> >>
>> >> >
>> >> >
>> >> >--
>> >> >Forio Business Simulations
>> >> >
>> >> >Will Glass-Husain
>> >> >wglass@forio.com
>> >> >www.forio.com
>> >> >
>> >> >---------------------------------------------------------------------
>> >> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >> >For additional commands, e-mail:
>>velocity-user-help@jakarta.apache.org
>> >> >
>> >>
>> >>_________________________________________________________________
>> >>Be the first to hear what's new at MSN - sign up to our free
>>newsletters!
>> >>http://www.msn.co.uk/newsletters
>> >>
>> >>
>> >>---------------------------------------------------------------------
>> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >>
>> >>
>> >
>> >
>> >--
>> >Forio Business Simulations
>> >
>> >Will Glass-Husain
>> >wglass@forio.com
>> >www.forio.com
>> >
>> >---------------------------------------------------------------------
>> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >
>>
>>_________________________________________________________________
>>Download the new Windows Live Toolbar, including Desktop search!
>>http://toolbar.live.com/?mkt=en-gb
>>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>>
>>
>
>
>--
>Forio Business Simulations
>
>Will Glass-Husain
>wglass@forio.com
>www.forio.com
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
_________________________________________________________________
Windows Live Messenger has arrived. Click here to download it for free!
http://imagine-msn.com/messenger/launch80/?locale=en-gb
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Will Glass-Husain <wg...@forio.com>.
I don't think it's Velocity which requires that permission, I'm
guessing it's the request object which is ultimately provided by
Tomcat...
WILL
On 10/11/06, Robin Mannering <ro...@hotmail.com> wrote:
> Hi Will,
>
> Thanks for the links, I'll give them a thorough read.
>
> I've been working with the hosting company who set up the server config and
> they have give the application permission to org.apache.catalina.core
> although they are troubled to do so.
>
> They seem very surprised that velocity requires this permission.
>
> Since they granted the permission, the problem has cleared up and
> $request.contextPath now has a value within a velocity template (although
> this has changed from an empty value to '/' so I need to make source
> amendments. Not a problem, just worrying it takes on a new value in a
> different hosting environment.
>
> Thanks again for your help
> Robin
>
>
> >From: "Will Glass-Husain" <wg...@forio.com>
> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >Subject: Re: Velocity Config/Security Issue
> >Date: Tue, 10 Oct 2006 15:04:32 -0700
> >
> >What app server are you using? This is a server configuration issue.
> >If someone else set it up, you might also want to work with them.
> >
> >If you're using Tomcat, check out:
> >http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
> >
> >And you should read the Sun docs at:
> >http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
> >
> >WILL
> >
> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
> >>Hi Will,
> >>
> >>thanks for your help. Sorry. I'm new to permissions, could you explain a
> >>little more for me please.
> >>
> >>Thanks
> >>Robin
> >>
> >>
> >> >From: "Will Glass-Husain" <wg...@forio.com>
> >> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >> >Subject: Re: Velocity Config/Security Issue
> >> >Date: Tue, 10 Oct 2006 08:24:57 -0700
> >> >
> >> >Looks like the security policy on your app server needs to be tuned.
> >> >Have you tried giving the permission java.lang.RuntimePermission for
> >> >accessClassInPackage.org.apache.catalina.core?
> >> >
> >> >WILL
> >> >
> >> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
> >> >>Hi all,
> >> >>
> >> >>I'm new back on this list in a while, please excuse if the following
> >> >>problem
> >> >>is obvious/has been posted before.
> >> >>
> >> >>I am transferring an existing site based on Struts/Velocity to a new
> >>web
> >> >>hosting provider. The application runs smoothly on its current host.
> >> >>
> >> >>However, there seems to be one last stumbling block with the new server
> >>in
> >> >>that the Struts object; 'request' appears not to be in scope within
> >> >>velocity
> >> >>pages (there may be others not in scope).
> >> >>
> >> >>I'm using the VelocityLayoutServlet if that helps.
> >> >>
> >> >>I've attached a snippet of the log file that points to the problem I
> >> >>mentioned, notable the 'java.security.AccessControlException' and
> >> >>'$request.contextPath is not a valid reference'
> >> >>
> >> >>All other velocity directives appear to be functioning as normal.
> >> >>
> >> >>Has anyone seen this behaviour before? Any help would be greatly
> >> >>appreciated.
> >> >>
> >> >>Kind regards
> >> >>Robin
> >> >>
> >> >>10-Oct 02:45:21.752 |INFO | [/].log
> >> >> | Velocity [info] ResourceManager : found
> >>/pages/frontend/home.vm
> >> >>with loader org.apache.velocity.tools.view.servlet.WebappLoader
> >> >>10-Oct 02:45:21.761 |INFO | [/].log
> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> >> >>java.security.AccessControlException: access denied
> >> >>(java.lang.RuntimePermission
> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >>10-Oct 02:45:21.763 |INFO | [/].log
> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
> >> >>contextPath
> >> >>: java.security.AccessControlException: access denied
> >> >>(java.lang.RuntimePermission
> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >>10-Oct 02:45:21.764 |INFO | [/].log
> >> >> | Velocity [error] RHS of #set statement is null. Context will
> >>not
> >> >>be
> >> >>modified. /pages/frontend/home.vm [line 9, column 1]
> >> >>10-Oct 02:45:21.772 |INFO | [/].log
> >> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> >> >>java.security.AccessControlException: access denied
> >> >>(java.lang.RuntimePermission
> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >>10-Oct 02:45:21.773 |INFO | [/].log
> >> >> | Velocity [error] ASTIdentifier.execute() : identifier =
> >> >>contextPath
> >> >>: java.security.AccessControlException: access denied
> >> >>(java.lang.RuntimePermission
> >> >>accessClassInPackage.org.apache.catalina.core)
> >> >>10-Oct 02:45:21.774 |INFO | [/].log
> >> >> | Velocity [warn]
> >> >>org.apache.velocity.runtime.exception.ReferenceException: reference :
> >> >>template = /pages/frontend/home.vm [line 32,column 34] :
> >> >>$request.contextPath is not a valid reference.
> >> >>
> >> >>_________________________________________________________________
> >> >>Windows Live™ Messenger has arrived. Click here to download it for
> >>free!
> >> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
> >> >>
> >> >>
> >> >>---------------------------------------------------------------------
> >> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >> >>
> >> >>
> >> >
> >> >
> >> >--
> >> >Forio Business Simulations
> >> >
> >> >Will Glass-Husain
> >> >wglass@forio.com
> >> >www.forio.com
> >> >
> >> >---------------------------------------------------------------------
> >> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >> >
> >>
> >>_________________________________________________________________
> >>Be the first to hear what's new at MSN - sign up to our free newsletters!
> >>http://www.msn.co.uk/newsletters
> >>
> >>
> >>---------------------------------------------------------------------
> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>
> >>
> >
> >
> >--
> >Forio Business Simulations
> >
> >Will Glass-Husain
> >wglass@forio.com
> >www.forio.com
> >
> >---------------------------------------------------------------------
> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >
>
> _________________________________________________________________
> Download the new Windows Live Toolbar, including Desktop search!
> http://toolbar.live.com/?mkt=en-gb
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
>
--
Forio Business Simulations
Will Glass-Husain
wglass@forio.com
www.forio.com
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Robin Mannering <ro...@hotmail.com>.
Hi Will,
Thanks for the links, I'll give them a thorough read.
I've been working with the hosting company who set up the server config and
they have give the application permission to org.apache.catalina.core
although they are troubled to do so.
They seem very surprised that velocity requires this permission.
Since they granted the permission, the problem has cleared up and
$request.contextPath now has a value within a velocity template (although
this has changed from an empty value to '/' so I need to make source
amendments. Not a problem, just worrying it takes on a new value in a
different hosting environment.
Thanks again for your help
Robin
>From: "Will Glass-Husain" <wg...@forio.com>
>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>To: "Velocity Users List" <ve...@jakarta.apache.org>
>Subject: Re: Velocity Config/Security Issue
>Date: Tue, 10 Oct 2006 15:04:32 -0700
>
>What app server are you using? This is a server configuration issue.
>If someone else set it up, you might also want to work with them.
>
>If you're using Tomcat, check out:
>http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
>
>And you should read the Sun docs at:
>http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
>
>WILL
>
>On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
>>Hi Will,
>>
>>thanks for your help. Sorry. I'm new to permissions, could you explain a
>>little more for me please.
>>
>>Thanks
>>Robin
>>
>>
>> >From: "Will Glass-Husain" <wg...@forio.com>
>> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >To: "Velocity Users List" <ve...@jakarta.apache.org>
>> >Subject: Re: Velocity Config/Security Issue
>> >Date: Tue, 10 Oct 2006 08:24:57 -0700
>> >
>> >Looks like the security policy on your app server needs to be tuned.
>> >Have you tried giving the permission java.lang.RuntimePermission for
>> >accessClassInPackage.org.apache.catalina.core?
>> >
>> >WILL
>> >
>> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
>> >>Hi all,
>> >>
>> >>I'm new back on this list in a while, please excuse if the following
>> >>problem
>> >>is obvious/has been posted before.
>> >>
>> >>I am transferring an existing site based on Struts/Velocity to a new
>>web
>> >>hosting provider. The application runs smoothly on its current host.
>> >>
>> >>However, there seems to be one last stumbling block with the new server
>>in
>> >>that the Struts object; 'request' appears not to be in scope within
>> >>velocity
>> >>pages (there may be others not in scope).
>> >>
>> >>I'm using the VelocityLayoutServlet if that helps.
>> >>
>> >>I've attached a snippet of the log file that points to the problem I
>> >>mentioned, notable the 'java.security.AccessControlException' and
>> >>'$request.contextPath is not a valid reference'
>> >>
>> >>All other velocity directives appear to be functioning as normal.
>> >>
>> >>Has anyone seen this behaviour before? Any help would be greatly
>> >>appreciated.
>> >>
>> >>Kind regards
>> >>Robin
>> >>
>> >>10-Oct 02:45:21.752 |INFO | [/].log
>> >> | Velocity [info] ResourceManager : found
>>/pages/frontend/home.vm
>> >>with loader org.apache.velocity.tools.view.servlet.WebappLoader
>> >>10-Oct 02:45:21.761 |INFO | [/].log
>> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>> >>java.security.AccessControlException: access denied
>> >>(java.lang.RuntimePermission
>> >>accessClassInPackage.org.apache.catalina.core)
>> >>10-Oct 02:45:21.763 |INFO | [/].log
>> >> | Velocity [error] ASTIdentifier.execute() : identifier =
>> >>contextPath
>> >>: java.security.AccessControlException: access denied
>> >>(java.lang.RuntimePermission
>> >>accessClassInPackage.org.apache.catalina.core)
>> >>10-Oct 02:45:21.764 |INFO | [/].log
>> >> | Velocity [error] RHS of #set statement is null. Context will
>>not
>> >>be
>> >>modified. /pages/frontend/home.vm [line 9, column 1]
>> >>10-Oct 02:45:21.772 |INFO | [/].log
>> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>> >>java.security.AccessControlException: access denied
>> >>(java.lang.RuntimePermission
>> >>accessClassInPackage.org.apache.catalina.core)
>> >>10-Oct 02:45:21.773 |INFO | [/].log
>> >> | Velocity [error] ASTIdentifier.execute() : identifier =
>> >>contextPath
>> >>: java.security.AccessControlException: access denied
>> >>(java.lang.RuntimePermission
>> >>accessClassInPackage.org.apache.catalina.core)
>> >>10-Oct 02:45:21.774 |INFO | [/].log
>> >> | Velocity [warn]
>> >>org.apache.velocity.runtime.exception.ReferenceException: reference :
>> >>template = /pages/frontend/home.vm [line 32,column 34] :
>> >>$request.contextPath is not a valid reference.
>> >>
>> >>_________________________________________________________________
>> >>Windows Live Messenger has arrived. Click here to download it for
>>free!
>> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
>> >>
>> >>
>> >>---------------------------------------------------------------------
>> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >>
>> >>
>> >
>> >
>> >--
>> >Forio Business Simulations
>> >
>> >Will Glass-Husain
>> >wglass@forio.com
>> >www.forio.com
>> >
>> >---------------------------------------------------------------------
>> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>> >
>>
>>_________________________________________________________________
>>Be the first to hear what's new at MSN - sign up to our free newsletters!
>>http://www.msn.co.uk/newsletters
>>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>>
>>
>
>
>--
>Forio Business Simulations
>
>Will Glass-Husain
>wglass@forio.com
>www.forio.com
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
_________________________________________________________________
Download the new Windows Live Toolbar, including Desktop search!
http://toolbar.live.com/?mkt=en-gb
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Will Glass-Husain <wg...@forio.com>.
What app server are you using? This is a server configuration issue.
If someone else set it up, you might also want to work with them.
If you're using Tomcat, check out:
http://tomcat.apache.org/tomcat-5.5-doc/security-manager-howto.html
And you should read the Sun docs at:
http://java.sun.com/j2se/1.5.0/docs/guide/security/permissions.html
WILL
On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
> Hi Will,
>
> thanks for your help. Sorry. I'm new to permissions, could you explain a
> little more for me please.
>
> Thanks
> Robin
>
>
> >From: "Will Glass-Husain" <wg...@forio.com>
> >Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
> >To: "Velocity Users List" <ve...@jakarta.apache.org>
> >Subject: Re: Velocity Config/Security Issue
> >Date: Tue, 10 Oct 2006 08:24:57 -0700
> >
> >Looks like the security policy on your app server needs to be tuned.
> >Have you tried giving the permission java.lang.RuntimePermission for
> >accessClassInPackage.org.apache.catalina.core?
> >
> >WILL
> >
> >On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
> >>Hi all,
> >>
> >>I'm new back on this list in a while, please excuse if the following
> >>problem
> >>is obvious/has been posted before.
> >>
> >>I am transferring an existing site based on Struts/Velocity to a new web
> >>hosting provider. The application runs smoothly on its current host.
> >>
> >>However, there seems to be one last stumbling block with the new server in
> >>that the Struts object; 'request' appears not to be in scope within
> >>velocity
> >>pages (there may be others not in scope).
> >>
> >>I'm using the VelocityLayoutServlet if that helps.
> >>
> >>I've attached a snippet of the log file that points to the problem I
> >>mentioned, notable the 'java.security.AccessControlException' and
> >>'$request.contextPath is not a valid reference'
> >>
> >>All other velocity directives appear to be functioning as normal.
> >>
> >>Has anyone seen this behaviour before? Any help would be greatly
> >>appreciated.
> >>
> >>Kind regards
> >>Robin
> >>
> >>10-Oct 02:45:21.752 |INFO | [/].log
> >> | Velocity [info] ResourceManager : found /pages/frontend/home.vm
> >>with loader org.apache.velocity.tools.view.servlet.WebappLoader
> >>10-Oct 02:45:21.761 |INFO | [/].log
> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> >>java.security.AccessControlException: access denied
> >>(java.lang.RuntimePermission
> >>accessClassInPackage.org.apache.catalina.core)
> >>10-Oct 02:45:21.763 |INFO | [/].log
> >> | Velocity [error] ASTIdentifier.execute() : identifier =
> >>contextPath
> >>: java.security.AccessControlException: access denied
> >>(java.lang.RuntimePermission
> >>accessClassInPackage.org.apache.catalina.core)
> >>10-Oct 02:45:21.764 |INFO | [/].log
> >> | Velocity [error] RHS of #set statement is null. Context will not
> >>be
> >>modified. /pages/frontend/home.vm [line 9, column 1]
> >>10-Oct 02:45:21.772 |INFO | [/].log
> >> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> >>java.security.AccessControlException: access denied
> >>(java.lang.RuntimePermission
> >>accessClassInPackage.org.apache.catalina.core)
> >>10-Oct 02:45:21.773 |INFO | [/].log
> >> | Velocity [error] ASTIdentifier.execute() : identifier =
> >>contextPath
> >>: java.security.AccessControlException: access denied
> >>(java.lang.RuntimePermission
> >>accessClassInPackage.org.apache.catalina.core)
> >>10-Oct 02:45:21.774 |INFO | [/].log
> >> | Velocity [warn]
> >>org.apache.velocity.runtime.exception.ReferenceException: reference :
> >>template = /pages/frontend/home.vm [line 32,column 34] :
> >>$request.contextPath is not a valid reference.
> >>
> >>_________________________________________________________________
> >>Windows Live™ Messenger has arrived. Click here to download it for free!
> >>http://imagine-msn.com/messenger/launch80/?locale=en-gb
> >>
> >>
> >>---------------------------------------------------------------------
> >>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >>
> >>
> >
> >
> >--
> >Forio Business Simulations
> >
> >Will Glass-Husain
> >wglass@forio.com
> >www.forio.com
> >
> >---------------------------------------------------------------------
> >To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> >For additional commands, e-mail: velocity-user-help@jakarta.apache.org
> >
>
> _________________________________________________________________
> Be the first to hear what's new at MSN - sign up to our free newsletters!
> http://www.msn.co.uk/newsletters
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
>
--
Forio Business Simulations
Will Glass-Husain
wglass@forio.com
www.forio.com
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Robin Mannering <ro...@hotmail.com>.
Hi Will,
thanks for your help. Sorry. I'm new to permissions, could you explain a
little more for me please.
Thanks
Robin
>From: "Will Glass-Husain" <wg...@forio.com>
>Reply-To: "Velocity Users List" <ve...@jakarta.apache.org>
>To: "Velocity Users List" <ve...@jakarta.apache.org>
>Subject: Re: Velocity Config/Security Issue
>Date: Tue, 10 Oct 2006 08:24:57 -0700
>
>Looks like the security policy on your app server needs to be tuned.
>Have you tried giving the permission java.lang.RuntimePermission for
>accessClassInPackage.org.apache.catalina.core?
>
>WILL
>
>On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
>>Hi all,
>>
>>I'm new back on this list in a while, please excuse if the following
>>problem
>>is obvious/has been posted before.
>>
>>I am transferring an existing site based on Struts/Velocity to a new web
>>hosting provider. The application runs smoothly on its current host.
>>
>>However, there seems to be one last stumbling block with the new server in
>>that the Struts object; 'request' appears not to be in scope within
>>velocity
>>pages (there may be others not in scope).
>>
>>I'm using the VelocityLayoutServlet if that helps.
>>
>>I've attached a snippet of the log file that points to the problem I
>>mentioned, notable the 'java.security.AccessControlException' and
>>'$request.contextPath is not a valid reference'
>>
>>All other velocity directives appear to be functioning as normal.
>>
>>Has anyone seen this behaviour before? Any help would be greatly
>>appreciated.
>>
>>Kind regards
>>Robin
>>
>>10-Oct 02:45:21.752 |INFO | [/].log
>> | Velocity [info] ResourceManager : found /pages/frontend/home.vm
>>with loader org.apache.velocity.tools.view.servlet.WebappLoader
>>10-Oct 02:45:21.761 |INFO | [/].log
>> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>>java.security.AccessControlException: access denied
>>(java.lang.RuntimePermission
>>accessClassInPackage.org.apache.catalina.core)
>>10-Oct 02:45:21.763 |INFO | [/].log
>> | Velocity [error] ASTIdentifier.execute() : identifier =
>>contextPath
>>: java.security.AccessControlException: access denied
>>(java.lang.RuntimePermission
>>accessClassInPackage.org.apache.catalina.core)
>>10-Oct 02:45:21.764 |INFO | [/].log
>> | Velocity [error] RHS of #set statement is null. Context will not
>>be
>>modified. /pages/frontend/home.vm [line 9, column 1]
>>10-Oct 02:45:21.772 |INFO | [/].log
>> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
>>java.security.AccessControlException: access denied
>>(java.lang.RuntimePermission
>>accessClassInPackage.org.apache.catalina.core)
>>10-Oct 02:45:21.773 |INFO | [/].log
>> | Velocity [error] ASTIdentifier.execute() : identifier =
>>contextPath
>>: java.security.AccessControlException: access denied
>>(java.lang.RuntimePermission
>>accessClassInPackage.org.apache.catalina.core)
>>10-Oct 02:45:21.774 |INFO | [/].log
>> | Velocity [warn]
>>org.apache.velocity.runtime.exception.ReferenceException: reference :
>>template = /pages/frontend/home.vm [line 32,column 34] :
>>$request.contextPath is not a valid reference.
>>
>>_________________________________________________________________
>>Windows Live Messenger has arrived. Click here to download it for free!
>>http://imagine-msn.com/messenger/launch80/?locale=en-gb
>>
>>
>>---------------------------------------------------------------------
>>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>>
>>
>
>
>--
>Forio Business Simulations
>
>Will Glass-Husain
>wglass@forio.com
>www.forio.com
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
>For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
_________________________________________________________________
Be the first to hear what's new at MSN - sign up to our free newsletters!
http://www.msn.co.uk/newsletters
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org
Re: Velocity Config/Security Issue
Posted by Will Glass-Husain <wg...@forio.com>.
Looks like the security policy on your app server needs to be tuned.
Have you tried giving the permission java.lang.RuntimePermission for
accessClassInPackage.org.apache.catalina.core?
WILL
On 10/10/06, Robin Mannering <ro...@hotmail.com> wrote:
> Hi all,
>
> I'm new back on this list in a while, please excuse if the following problem
> is obvious/has been posted before.
>
> I am transferring an existing site based on Struts/Velocity to a new web
> hosting provider. The application runs smoothly on its current host.
>
> However, there seems to be one last stumbling block with the new server in
> that the Struts object; 'request' appears not to be in scope within velocity
> pages (there may be others not in scope).
>
> I'm using the VelocityLayoutServlet if that helps.
>
> I've attached a snippet of the log file that points to the problem I
> mentioned, notable the 'java.security.AccessControlException' and
> '$request.contextPath is not a valid reference'
>
> All other velocity directives appear to be functioning as normal.
>
> Has anyone seen this behaviour before? Any help would be greatly
> appreciated.
>
> Kind regards
> Robin
>
> 10-Oct 02:45:21.752 |INFO | [/].log
> | Velocity [info] ResourceManager : found /pages/frontend/home.vm
> with loader org.apache.velocity.tools.view.servlet.WebappLoader
> 10-Oct 02:45:21.761 |INFO | [/].log
> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> java.security.AccessControlException: access denied
> (java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core)
> 10-Oct 02:45:21.763 |INFO | [/].log
> | Velocity [error] ASTIdentifier.execute() : identifier = contextPath
> : java.security.AccessControlException: access denied
> (java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core)
> 10-Oct 02:45:21.764 |INFO | [/].log
> | Velocity [error] RHS of #set statement is null. Context will not be
> modified. /pages/frontend/home.vm [line 9, column 1]
> 10-Oct 02:45:21.772 |INFO | [/].log
> | Velocity [error] PROGRAMMER ERROR : PropertyExector() :
> java.security.AccessControlException: access denied
> (java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core)
> 10-Oct 02:45:21.773 |INFO | [/].log
> | Velocity [error] ASTIdentifier.execute() : identifier = contextPath
> : java.security.AccessControlException: access denied
> (java.lang.RuntimePermission accessClassInPackage.org.apache.catalina.core)
> 10-Oct 02:45:21.774 |INFO | [/].log
> | Velocity [warn]
> org.apache.velocity.runtime.exception.ReferenceException: reference :
> template = /pages/frontend/home.vm [line 32,column 34] :
> $request.contextPath is not a valid reference.
>
> _________________________________________________________________
> Windows Live™ Messenger has arrived. Click here to download it for free!
> http://imagine-msn.com/messenger/launch80/?locale=en-gb
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: velocity-user-help@jakarta.apache.org
>
>
--
Forio Business Simulations
Will Glass-Husain
wglass@forio.com
www.forio.com
---------------------------------------------------------------------
To unsubscribe, e-mail: velocity-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: velocity-user-help@jakarta.apache.org