From: markt Date: Tue, 23 Nov 2010 17:59:49 +0000 (+0000) Subject: Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=50318 X-Git-Url: https://git.internetallee.de/?a=commitdiff_plain;h=53ee07ac13b5ea48648614f35aeb037ab996c7b1;p=tomcat7.0 Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=50318 Avoid NPE when viewing session detail for expired sessions git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1038235 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index aca59a5ca..6d72bcb33 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -290,31 +290,35 @@ Improve Tomcat Logging documentation. (kkolinko) - 50303: Update JNDI how-to to reflect new JavaMail download - location and that JAF is now included in Java SE 6. (markt) + 50303: Update JNDI how-to to reflect the new JavaMail + download location and that JAF is now included in Java SE 6. (markt) - Fix ordering functionality on sessions page for HTML Manager + Fix ordering functionality on sessions page for the HTML Manager application. (markt) - Fix primary sessions not always being treated as such in HTML Manager - application. (markt) + Fix primary sessions not always being treated as such in the HTML + Manager application. (markt) - Fix message not being displayed after session attribute removal in HTML - Manager application. (markt) + Fix message not being displayed after session attribute removal in the + HTML Manager application. (markt) - 50310: Fix display of Servlet information in Manager + 50310: Fix display of Servlet information in the Manager application. (markt) - CVE-2010-4172: Multiple XSS in Manager application. (markt/kkolinko) + CVE-2010-4172: Multiple XSS in the Manager application. (markt/kkolinko) - 50316: Fix display of negative values in Manager application. - (kkolinko) + 50316: Fix display of negative values in the Manager + application. (kkolinko) + + + 50318: Avoid NPE when trying to view session detail for an + expired session in the Manager application. (markt) diff --git a/webapps/manager/WEB-INF/jsp/sessionDetail.jsp b/webapps/manager/WEB-INF/jsp/sessionDetail.jsp index 2cef06629..d711f7f6c 100644 --- a/webapps/manager/WEB-INF/jsp/sessionDetail.jsp +++ b/webapps/manager/WEB-INF/jsp/sessionDetail.jsp @@ -32,8 +32,14 @@ String version = (String) request.getAttribute("version"); ContextName cn = new ContextName(path, version); Session currentSession = (Session)request.getAttribute("currentSession"); - HttpSession currentHttpSession = currentSession.getSession(); - String currentSessionId = JspHelper.escapeXml(currentSession.getId()); + String currentSessionId = null; + HttpSession currentHttpSession = null; + if (currentSession != null) { + currentHttpSession = currentSession.getSession(); + currentSessionId = JspHelper.escapeXml(currentSession.getId()); + } else { + currentSessionId = "Session invalidated"; + } String submitUrl = JspHelper.escapeXml(response.encodeURL( ((HttpServletRequest) pageContext.getRequest()).getRequestURI() + "?path=" + path + "&version=" + version)); @@ -50,118 +56,122 @@ Sessions Administration: details for <%= currentSessionId %> -

Details for Session <%= currentSessionId %>

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Session Id<%= currentSessionId %>
Guessed Locale<%= JspHelper.guessDisplayLocaleFromSession(currentSession) %>
Guessed User<%= JspHelper.guessDisplayUserFromSession(currentSession) %>
Creation Time<%= JspHelper.getDisplayCreationTimeForSession(currentSession) %>
Last Accessed Time<%= JspHelper.getDisplayLastAccessedTimeForSession(currentSession) %>
Session Max Inactive Interval<%= JspHelper.secondsToTimeString(currentSession.getMaxInactiveInterval()) %>
Used Time<%= JspHelper.getDisplayUsedTimeForSession(currentSession) %>
Inactive Time<%= JspHelper.getDisplayInactiveTimeForSession(currentSession) %>
TTL<%= JspHelper.getDisplayTTLForSession(currentSession) %>
- -
-
- - - <% - if ("Primary".equals(request.getParameter("sessionType"))) { - %> - - <% - } - %> -
-
+<% if (currentHttpSession == null) { %> +

<%=currentSessionId%>

+<% } else { %> +

Details for Session <%= currentSessionId %>

-
<%= JspHelper.escapeXml(request.getAttribute("error")) %>
-
<%= JspHelper.escapeXml(request.getAttribute("message")) %>
- - -<% int nAttributes = 0; - Enumeration attributeNamesEnumeration = currentHttpSession.getAttributeNames(); - while (attributeNamesEnumeration.hasMoreElements()) { - attributeNamesEnumeration.nextElement(); - ++nAttributes; - } -%> - - - - - - - - - <%--tfoot> - - - - - -<% attributeNamesEnumeration = currentHttpSession.getAttributeNames(); - while (attributeNamesEnumeration.hasMoreElements()) { - String attributeName = (String) attributeNamesEnumeration.nextElement(); -%> - - - - - -<% } // end while %> - -
<%= JspHelper.formatNumber(nAttributes) %> attributes
Remove AttributeAttribute nameAttribute value
- TODO: set Max Inactive Interval on sessions -
-
-
- - - - <% - if ("Primary".equals(request.getParameter("sessionType"))) { - %> - - - <% - } else { - out.print("Primary sessions only"); - } - %> -
-
- 		<%= JspHelper.escapeXml(attributeName) %><% Object attributeValue = currentHttpSession.getAttribute(attributeName); %>"><%= JspHelper.escapeXml(attributeValue) %>
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Session Id<%= currentSessionId %>
Guessed Locale<%= JspHelper.guessDisplayLocaleFromSession(currentSession) %>
Guessed User<%= JspHelper.guessDisplayUserFromSession(currentSession) %>
Creation Time<%= JspHelper.getDisplayCreationTimeForSession(currentSession) %>
Last Accessed Time<%= JspHelper.getDisplayLastAccessedTimeForSession(currentSession) %>
Session Max Inactive Interval<%= JspHelper.secondsToTimeString(currentSession.getMaxInactiveInterval()) %>
Used Time<%= JspHelper.getDisplayUsedTimeForSession(currentSession) %>
Inactive Time<%= JspHelper.getDisplayInactiveTimeForSession(currentSession) %>
TTL<%= JspHelper.getDisplayTTLForSession(currentSession) %>
+ +
+
+ + + <% + if ("Primary".equals(request.getParameter("sessionType"))) { + %> + + <% + } + %> +
+
+ +
<%= JspHelper.escapeXml(request.getAttribute("error")) %>
+
<%= JspHelper.escapeXml(request.getAttribute("message")) %>
+ + + <% int nAttributes = 0; + Enumeration attributeNamesEnumeration = currentHttpSession.getAttributeNames(); + while (attributeNamesEnumeration.hasMoreElements()) { + attributeNamesEnumeration.nextElement(); + ++nAttributes; + } + %> + + + + + + + + + <%--tfoot> + + + + + + <% attributeNamesEnumeration = currentHttpSession.getAttributeNames(); + while (attributeNamesEnumeration.hasMoreElements()) { + String attributeName = (String) attributeNamesEnumeration.nextElement(); + %> + + + + + + <% } // end while %> + +
<%= JspHelper.formatNumber(nAttributes) %> attributes
Remove AttributeAttribute nameAttribute value
+ TODO: set Max Inactive Interval on sessions +
+
+
+ + + + <% + if ("Primary".equals(request.getParameter("sessionType"))) { + %> + + + <% + } else { + out.print("Primary sessions only"); + } + %> +
+
+ 		<%= JspHelper.escapeXml(attributeName) %><% Object attributeValue = currentHttpSession.getAttribute(attributeName); %>"><%= JspHelper.escapeXml(attributeValue) %>
+<% } // endif%>