From: markt <markt@13f79535-47bb-0310-9956-ffa450edef68>
Date: Wed, 19 Jan 2011 00:00:59 +0000 (+0000)
Subject: Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=22278
X-Git-Url: https://git.internetallee.de/?a=commitdiff_plain;h=29736d9ded4586092efd40fed836ca0c36e12c21;p=tomcat7.0

Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=22278
Add a commented out RemoteAddrValve that limits access to the Manager and Host Manager applications to localhost.
Based on a patch by Yann Cébron.

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1060627 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index a52992529..45c6f7857 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -111,6 +111,11 @@
   <subsection name="Web applications">
     <changelog>
       <fix>
+        <bug>22278</bug>: Add a commented out <code>RemoteAddrValve</code> that
+        limits access to the Manager and Host Manager applications to localhost.
+        Based on a patch by Yann Cébron. (markt)
+      </fix>
+      <fix>
         Correct a handful of Javadoc warnings. (markt)
       </fix>
       <add>
diff --git a/webapps/host-manager/META-INF/context.xml b/webapps/host-manager/META-INF/context.xml
index b23cf4814..c64138408 100644
--- a/webapps/host-manager/META-INF/context.xml
+++ b/webapps/host-manager/META-INF/context.xml
@@ -15,4 +15,13 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<Context antiResourceLocking="false" privileged="true" />
+<Context antiResourceLocking="false" privileged="true" >
+  <!--
+    Remove the comment markers from around the Valve below to limit access to
+    the host-manager application to clients connecting from localhost
+  -->
+  <!--
+  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
+         allow="127\.0\.0\.1|::1" />
+  -->
+</Context>
\ No newline at end of file
diff --git a/webapps/manager/META-INF/context.xml b/webapps/manager/META-INF/context.xml
index b23cf4814..de4462010 100644
--- a/webapps/manager/META-INF/context.xml
+++ b/webapps/manager/META-INF/context.xml
@@ -15,4 +15,13 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<Context antiResourceLocking="false" privileged="true" />
+<Context antiResourceLocking="false" privileged="true" >
+  <!--
+    Remove the comment markers from around the Valve below to limit access to
+    the manager application to clients connecting from localhost
+  -->
+  <!--
+  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
+         allow="127\.0\.0\.1|::1" />
+  -->
+</Context>