Author: markt
Date: Wed Jun 13 19:17:22 2007
New Revision: 547088
URL: http://svn.apache.org/viewvc?view=rev&rev=547088
Log:
Port fix for XSS issue in Manager. This is CVE-2007-2450.
Modified:
tomcat/container/branches/tc5.0.x/webapps/manager/WEB-INF/classes/org/apache/catalina/manager/HTMLManagerServlet.java
Modified:
tomcat/container/branches/tc5.0.x/webapps/manager/WEB-INF/classes/org/apache/catalina/manager/HTMLManagerServlet.java
URL:
http://svn.apache.org/viewvc/tomcat/container/branches/tc5.0.x/webapps/manager/WEB-INF/classes/org/apache/catalina/manager/HTMLManagerServlet.java?view=diff&rev=547088&r1=547087&r2=547088
==============================================================================
---
tomcat/container/branches/tc5.0.x/webapps/manager/WEB-INF/classes/org/apache/catalina/manager/HTMLManagerServlet.java
(original)
+++
tomcat/container/branches/tc5.0.x/webapps/manager/WEB-INF/classes/org/apache/catalina/manager/HTMLManagerServlet.java
Wed Jun 13 19:17:22 2007
@@ -106,9 +106,7 @@
} else if (command.equals("/stop")) {
message = stop(path);
} else {
- message =
- sm.getString("managerServlet.unknownCommand",
- RequestUtil.filter(command));
+ message = sm.getString("managerServlet.unknownCommand", command);
}
list(request, response, message);
@@ -306,7 +304,11 @@
// Message Section
args = new Object[3];
args[0] = sm.getString("htmlManagerServlet.messageLabel");
- args[1] = (message == null || message.length() == 0) ? "OK" : message;
+ if (message == null || message.length() == 0) {
+ args[1] = "OK";
+ } else {
+ args[1] = RequestUtil.filter(message);
+ }
writer.print(MessageFormat.format(Constants.MESSAGE_SECTION, args));
// Manager Section
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
