[Cocoon 1.8] ProducerFromRequest revisited

["Clinton, Doug" <dc...@tanning.com>]

Cristophe Maligorne posted a message about this problem back in September
but I didn't see a satisfactory followup to his message.

The problem is that ProducerFromRequest was removed from Cocoon at version
1.8 (due to security problems with it, as I understand it).  However, in
EngineWrapper.java there is this method:

        public String getParameter(String name) { 
            if ((document != null) &&  (name.equalsIgnoreCase("producer")))
{
                return "org.apache.cocoon.producer.ProducerFromRequest";
            } else {
                return null;
            }
        }

When I try to use Cocoon 1.8 with Tomcat (3.2 beta 6) it bombs out in
ProducerFactory complaining that it can't load ProducerFromRequest, so
something is clearly calling this getParameter method and trying to create a
producer from it.

I have worked around this by changing getParameter to return
"org...ProducerFromFile" instead of "ProducerFromRequest" and that seems to
work for the simple tests that I've tried. However, I was hoping to get a
more definitive answer on the issue.

regards,
Doug Clinton
dclinton@tanning.com