From: markt Date: Mon, 3 Nov 2008 21:52:42 +0000 (+0000) Subject: Remove the invoker servlet and all references for security reasons. This will not... X-Git-Url: https://git.internetallee.de/?a=commitdiff_plain;h=97a12ac81222c88a231e364f64bc8dcb77098759;p=tomcat7.0 Remove the invoker servlet and all references for security reasons. This will not be proposed for backport to 6.0.x git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@710179 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/RELEASE-NOTES b/RELEASE-NOTES index fbf098508..b42b1048e 100644 --- a/RELEASE-NOTES +++ b/RELEASE-NOTES @@ -34,7 +34,6 @@ KNOWN ISSUES IN THIS RELEASE: * Enabling SSI and CGI Support * Security manager URLs * Symlinking static resources -* Enabling invoker servlet * Viewing the Tomcat Change Log * When all else fails @@ -165,19 +164,6 @@ This behavior is optional, and the "allowLinking" flag may be used to disable the check. -========================= -Enabling invoker servlet: -========================= -Starting with Tomcat 4.1.12, the invoker servlet is no longer available by -default in all webapps. Enabling it for all webapps is possible by editing -$CATALINA_HOME/conf/web.xml to uncomment the "/servlet/*" servlet-mapping -definition. - -Using the invoker servlet in a production environment is not recommended and -is unsupported. More details are available on the Tomcat FAQ at -http://tomcat.apache.org/faq/misc.html#invoker. - - ============================== Viewing the Tomcat Change Log: ============================== diff --git a/conf/web.xml b/conf/web.xml index 9c7d3445f..5431a3715 100644 --- a/conf/web.xml +++ b/conf/web.xml @@ -102,34 +102,6 @@ - - - - - - - - - - - - - - - - @@ -364,14 +336,6 @@ / - - - jsp diff --git a/java/org/apache/catalina/Globals.java b/java/org/apache/catalina/Globals.java index 597113cea..0d0125bf3 100644 --- a/java/org/apache/catalina/Globals.java +++ b/java/org/apache/catalina/Globals.java @@ -121,15 +121,6 @@ public final class Globals { /** - * The request attribute under which the Invoker servlet will store - * the invoking servlet path, if it was used to execute a servlet - * indirectly instead of through a servlet mapping. - */ - public static final String INVOKED_ATTR = - "org.apache.catalina.INVOKED"; - - - /** * The request attribute under which we expose the value of the * <jsp-file> value associated with this servlet, * if any. diff --git a/java/org/apache/catalina/core/ApplicationDispatcher.java b/java/org/apache/catalina/core/ApplicationDispatcher.java index f9b4bba50..89e926165 100644 --- a/java/org/apache/catalina/core/ApplicationDispatcher.java +++ b/java/org/apache/catalina/core/ApplicationDispatcher.java @@ -823,9 +823,6 @@ final class ApplicationDispatcher while (current != null) { if(state.hrequest == null && (current instanceof HttpServletRequest)) state.hrequest = (HttpServletRequest)current; - if ("org.apache.catalina.servlets.InvokerHttpRequest". - equals(current.getClass().getName())) - break; // KLUDGE - Make nested RD.forward() using invoker work if (!(current instanceof ServletRequestWrapper)) break; if (current instanceof ApplicationHttpRequest) diff --git a/java/org/apache/catalina/core/RestrictedServlets.properties b/java/org/apache/catalina/core/RestrictedServlets.properties index 17a680734..d336968d1 100644 --- a/java/org/apache/catalina/core/RestrictedServlets.properties +++ b/java/org/apache/catalina/core/RestrictedServlets.properties @@ -15,5 +15,4 @@ org.apache.catalina.ssi.SSIServlet=restricted org.apache.catalina.servlets.CGIServlet=restricted -org.apache.catalina.servlets.InvokerServlet=restricted org.apache.catalina.manager.JMXProxyServlet=restricted diff --git a/java/org/apache/catalina/manager/LocalStrings.properties b/java/org/apache/catalina/manager/LocalStrings.properties index 17ddde27c..a6a95bb90 100644 --- a/java/org/apache/catalina/manager/LocalStrings.properties +++ b/java/org/apache/catalina/manager/LocalStrings.properties @@ -57,7 +57,6 @@ htmlManagerServlet.serverVersion=Tomcat Version htmlManagerServlet.title=Tomcat Web Application Manager managerServlet.alreadyContext=FAIL - Application already exists at path {0} managerServlet.alreadyDocBase=FAIL - Directory {0} is already in use -managerServlet.cannotInvoke=Cannot invoke manager servlet through invoker managerServlet.configured=OK - Deployed application from context file {0} managerServlet.deployed=OK - Deployed application at context path {0} managerServlet.deployFailed=FAIL - Failed to deploy application at context path {0} diff --git a/java/org/apache/catalina/manager/LocalStrings_de.properties b/java/org/apache/catalina/manager/LocalStrings_de.properties index 029655369..59c6353fb 100644 --- a/java/org/apache/catalina/manager/LocalStrings_de.properties +++ b/java/org/apache/catalina/manager/LocalStrings_de.properties @@ -55,7 +55,6 @@ htmlManagerServlet.serverVersion=Tomcat Version htmlManagerServlet.title=Tomcat Webanwendungs-Manager managerServlet.alreadyContext=FEHLER - Anwendung existiert bereits für Kontext Pfad {0} managerServlet.alreadyDocBase=FEHLER - Verzeichnis {0} bereits in Benutzung -managerServlet.cannotInvoke=Kann Manager-Servlet nicht durch Invoker aufrufen managerServlet.configured=OK - Anwendung von Kontext-Datei {0} installiert managerServlet.deployed=OK - Anwendung mit Kontext Pfad {0} installiert managerServlet.exception=FEHLER - Ausnahme aufgetreten {0} diff --git a/java/org/apache/catalina/manager/LocalStrings_fr.properties b/java/org/apache/catalina/manager/LocalStrings_fr.properties index 903667d42..023e937a1 100644 --- a/java/org/apache/catalina/manager/LocalStrings_fr.properties +++ b/java/org/apache/catalina/manager/LocalStrings_fr.properties @@ -38,7 +38,6 @@ htmlManagerServlet.serverVersion=Version de serveur htmlManagerServlet.title=Gestionnaire d''applications WEB Tomcat managerServlet.alreadyContext=ECHEC - l''application existe déjà dans le chemin {0} managerServlet.alreadyDocBase=ECHEC - Le répertoire {0} est déjà utilisé -managerServlet.cannotInvoke=Impossible d''utiliser le gestionnaire de servlet au travers du délégué (invoker) managerServlet.configured=OK - Application configurée depuis le fichier contexte {0} managerServlet.deployed=OK - Application déployée pour le chemin de contexte {0} managerServlet.exception=ECHEC - L''exception {0} a été rencontrée diff --git a/java/org/apache/catalina/manager/ManagerServlet.java b/java/org/apache/catalina/manager/ManagerServlet.java index 948793228..2a5f1293f 100644 --- a/java/org/apache/catalina/manager/ManagerServlet.java +++ b/java/org/apache/catalina/manager/ManagerServlet.java @@ -144,11 +144,6 @@ import org.apache.tomcat.util.modeler.Registry; * generally be deployed as a separate web application within the virtual host * to be managed. *

- * NOTE - For security reasons, this application will not operate - * when accessed via the invoker servlet. You must explicitly map this servlet - * with a servlet mapping, and you will always want to protect it with - * appropriate security constraints as well. - *

* The following servlet initialization parameters are recognized: *