Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=22278

Add a commented out RemoteAddrValve that limits access to the Manager and Host Manager applications to localhost.
Based on a patch by Yann Cébron.

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1060627 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index a529925..45c6f78 100644 (file)
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -111,6 +111,11 @@
   <subsection name="Web applications">
     <changelog>
       <fix>
+        <bug>22278</bug>: Add a commented out <code>RemoteAddrValve</code> that
+        limits access to the Manager and Host Manager applications to localhost.
+        Based on a patch by Yann Cébron. (markt)
+      </fix>
+      <fix>
         Correct a handful of Javadoc warnings. (markt)
       </fix>
       <add>

diff --git a/webapps/host-manager/META-INF/context.xml b/webapps/host-manager/META-INF/context.xml
index b23cf48..c641384 100644 (file)
--- a/webapps/host-manager/META-INF/context.xml
+++ b/webapps/host-manager/META-INF/context.xml
@@ -15,4 +15,13 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<Context antiResourceLocking="false" privileged="true" />
+<Context antiResourceLocking="false" privileged="true" >
+  <!--
+    Remove the comment markers from around the Valve below to limit access to
+    the host-manager application to clients connecting from localhost
+  -->
+  <!--
+  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
+         allow="127\.0\.0\.1|::1" />
+  -->
+</Context>
\ No newline at end of file

diff --git a/webapps/manager/META-INF/context.xml b/webapps/manager/META-INF/context.xml
index b23cf48..de44620 100644 (file)
--- a/webapps/manager/META-INF/context.xml
+++ b/webapps/manager/META-INF/context.xml
@@ -15,4 +15,13 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<Context antiResourceLocking="false" privileged="true" />
+<Context antiResourceLocking="false" privileged="true" >
+  <!--
+    Remove the comment markers from around the Valve below to limit access to
+    the manager application to clients connecting from localhost
+  -->
+  <!--
+  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
+         allow="127\.0\.0\.1|::1" />
+  -->
+</Context>