Questions about " [SECURITY] Apache Tomcat 4.x JSP source disclosure vulnerability"

[Adam Greene <ag...@romulin.com>]

Maybe I don't understand, but DefaultServlet, which is supposed to serve
static content is disabled... How are we supposed to serve up pictures, etc
that are static??



--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>

Re: Questions about " [SECURITY] Apache Tomcat 4.x JSP source disclosure vulnerability"

[Tim Funk <fu...@joedog.org>]

The DefaultServlet is "ok". But is was being called by the invoker 
servlet in a roundabout (unintended manner). The invoker servlet is 
typically mapped to /servlet/*

The invoker servlet should be disabled. Or "restricted" using many of 
the ways described in other threads.

You should be fine allowing the DefaultServlet  to work.

Adam Greene wrote:
> Maybe I don't understand, but DefaultServlet, which is supposed to serve
> static content is disabled... How are we supposed to serve up pictures, etc
> that are static??



--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>