You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by jf...@apache.org on 2002/11/04 06:12:56 UTC
cvs commit: jakarta-tomcat-catalina/catalina/src/conf catalina.properties
jfarcand 2002/11/03 21:12:56
Modified: catalina/src/conf catalina.properties
Log:
Use the catalina.properties file to customize the package protection/access. This new security mechanism enable the customization, at runtime, of which package should be protected.
the following package will be protected by default:
o.a.catalina
o.a.jasper(*)
o.a.coyote
o.a.tomcat.util
(*) Tomcat 5 is broken when a JSP use a class from jsp20el.jar and when the SecurityManager is turned on. Even if you remove all the protection, Tomcat fail to properly runs the example.
o.a.coyote.tomcat5 has been securized in order to support package protection.
Revision Changes Path
1.3 +2 -2 jakarta-tomcat-catalina/catalina/src/conf/catalina.properties
Index: catalina.properties
===================================================================
RCS file: /home/cvs/jakarta-tomcat-catalina/catalina/src/conf/catalina.properties,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- catalina.properties 24 Oct 2002 13:53:33 -0000 1.2
+++ catalina.properties 4 Nov 2002 05:12:56 -0000 1.3
@@ -4,7 +4,7 @@
# passed to checkPackageAccess unless the
# corresponding RuntimePermission ("accessClassInPackage."+package) has
# been granted.
-package.access=sun.
+package.access=sun.,org.apache.catalina.,org.apache.jasper.,org.apache.coyote.,org.apache.tomcat.,org.apache.jsp.
#
# List of comma-separated packages that start with or equal this string
@@ -16,7 +16,7 @@
# by default, no packages are restricted for definition, and none of
# the class loaders supplied with the JDK call checkPackageDefinition.
#
-#package.definition=
+package.definition=sun.,java.,org.apache.catalina.,org.apache.jasper.,org.apache.coyote.,org.apache.tomcat.,org.apache.jsp
#
# List of comma-separated paths defining the contents of the "common"
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>