From 47e668ff14f6777648d2901b514cb3901bb786d2 Mon Sep 17 00:00:00 2001
From: markt <markt@13f79535-47bb-0310-9956-ffa450edef68>
Date: Wed, 9 Mar 2011 11:38:38 +0000
Subject: [PATCH] Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=50854
 Add additional permissions required by the Manager application when running
 under a security Manager and support a shared Manager installation when
 $CATALINA_HOME != CATALINA_BASE.

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1079755 13f79535-47bb-0310-9956-ffa450edef68
---
 conf/catalina.policy       | 15 ++++++++++++++-
 webapps/docs/changelog.xml |  7 ++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/conf/catalina.policy b/conf/catalina.policy
index 200936ac4..38d5de969 100644
--- a/conf/catalina.policy
+++ b/conf/catalina.policy
@@ -187,11 +187,24 @@ grant {
 
 
 // The Manager application needs access to the following packages to support the
-// session display functionality
+// session display functionality. These settings support the following
+// configurations:
+// - default CATALINA_HOME == CATALINA_BASE
+// - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
+// - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
 grant codeBase "file:${catalina.base}/webapps/manager/-" {
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
     permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
+};
+grant codeBase "file:${catalina.home}/webapps/manager/-" {
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
 };
 
 // You can assign additional permissions to particular web applications by
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index e49667372..fdb5197cb 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -30,7 +30,7 @@
     <author email="kkolinko@apache.org">Konstantin Kolinko</author>
     <author email="pero@apache.org">Peter Rossbach</author>
     <author email="kfujino@apache.org">Keiichi Fujino</author>
-    <author email="timw@apache.org">Tim Whittington</author>    
+    <author email="timw@apache.org">Tim Whittington</author>   
     <author email="mturk@apache.org">Mladen Turk</author>
     <author email="schultz@apache.org">Christopher Schultz</author>
     <author email="slaurent@apache.org">Sylvain Laurent</author>
@@ -69,6 +69,11 @@
         to make request data swallowing configurable for requests
         that are too large. (rjung)
       </add>
+      <fix>
+        <bug>50854</bug>: Add additional permissions required by the Manager
+        application when running under a security Manager and support a shared
+        Manager installation when $CATALINA_HOME != CATALINA_BASE. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">
-- 
2.11.0