From 29736d9ded4586092efd40fed836ca0c36e12c21 Mon Sep 17 00:00:00 2001
From: markt <markt@13f79535-47bb-0310-9956-ffa450edef68>
Date: Wed, 19 Jan 2011 00:00:59 +0000
Subject: [PATCH] =?utf8?q?Fix=20https://issues.apache.org/bugzilla/show=5F?=
 =?utf8?q?bug.cgi=3Fid=3D22278=20Add=20a=20commented=20out=20RemoteAddrVal?=
 =?utf8?q?ve=20that=20limits=20access=20to=20the=20Manager=20and=20Host=20?=
 =?utf8?q?Manager=20applications=20to=20localhost.=20Based=20on=20a=20patc?=
 =?utf8?q?h=20by=20Yann=20C=C3=A9bron.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1060627 13f79535-47bb-0310-9956-ffa450edef68
---
 webapps/docs/changelog.xml                |  5 +++++
 webapps/host-manager/META-INF/context.xml | 11 ++++++++++-
 webapps/manager/META-INF/context.xml      | 11 ++++++++++-
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index a52992529..45c6f7857 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -111,6 +111,11 @@
   <subsection name="Web applications">
     <changelog>
       <fix>
+        <bug>22278</bug>: Add a commented out <code>RemoteAddrValve</code> that
+        limits access to the Manager and Host Manager applications to localhost.
+        Based on a patch by Yann Cébron. (markt)
+      </fix>
+      <fix>
         Correct a handful of Javadoc warnings. (markt)
       </fix>
       <add>
diff --git a/webapps/host-manager/META-INF/context.xml b/webapps/host-manager/META-INF/context.xml
index b23cf4814..c64138408 100644
--- a/webapps/host-manager/META-INF/context.xml
+++ b/webapps/host-manager/META-INF/context.xml
@@ -15,4 +15,13 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<Context antiResourceLocking="false" privileged="true" />
+<Context antiResourceLocking="false" privileged="true" >
+  <!--
+    Remove the comment markers from around the Valve below to limit access to
+    the host-manager application to clients connecting from localhost
+  -->
+  <!--
+  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
+         allow="127\.0\.0\.1|::1" />
+  -->
+</Context>
\ No newline at end of file
diff --git a/webapps/manager/META-INF/context.xml b/webapps/manager/META-INF/context.xml
index b23cf4814..de4462010 100644
--- a/webapps/manager/META-INF/context.xml
+++ b/webapps/manager/META-INF/context.xml
@@ -15,4 +15,13 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 -->
-<Context antiResourceLocking="false" privileged="true" />
+<Context antiResourceLocking="false" privileged="true" >
+  <!--
+    Remove the comment markers from around the Valve below to limit access to
+    the manager application to clients connecting from localhost
+  -->
+  <!--
+  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
+         allow="127\.0\.0\.1|::1" />
+  -->
+</Context>
-- 
2.11.0