Scarab commit: svn commit: r10637 - trunk/tomcat/conf/server.xml

Author: ronvoe122
Date: 2008-11-02 06:44:41-0700
New Revision: 10637

Modified:
   trunk/tomcat/conf/server.xml

Log:
Bugfix: 
Set the tomcat parameter useURIValidationHack to false.
This options prevents some security leaks in tomcat 4.0.x. Since we are using 4.1.x it should be ok to disable it.

Before the upgrade to tomcat v4.1.36 there was no problem with this option. 
After the upgrade the URIValidationHack causes that Request.decodedURI() contains the jsessionid-parameter. 
This URI is used, to extract the path for the velocity-template, which is used for the request. Because the extracted path is invalid, a ResourceNotFoundException is thrown.  

Disabling the URIValidationHack solves the problem.


Modified: trunk/tomcat/conf/server.xml
Url: http://scarab.tigris.org/source/browse/scarab/trunk/tomcat/conf/server.xml?view=diff&rev=10637&p1=trunk/tomcat/conf/server.xml&p2=trunk/tomcat/conf/server.xml&r1=10636&r2=10637
==============================================================================
--- trunk/tomcat/conf/server.xml	(original)
+++ trunk/tomcat/conf/server.xml	2008-11-02 06:44:41-0700
@@ -10,6 +10,7 @@
             acceptCount      = "10" 
             debug            = "0" 
             connectionTimeout= "60000" 
+            useURIValidationHack="false"
             compression="off"/>
 
         <Engine    name        = "Standalone"