date:20140123

Re: running packed WAR files with embedded tomcat

2014-01-23 Thread Valery Shyshkin

Tomcat 7 embedded doesn't need a war file to be unpacked. I have a Spring
based application packaged in war and it works.
Do you really  use  Tomcat embedded jars on the classpath or may be from
Tomcat installation?



2014/1/22 John Cartwright - NOAA Federal john.c.cartwri...@noaa.gov

 Thanks for the example Valery.  Even with your approach, I'm finding that
 unless I create a directory webapps in the directory from which I run the
 program, I get this exception:

 java.io.IOException: Application base [{1}] for host [/tmp/./webapps] does
 not exist or is not a directory.

 It seems to me that the WAR is still needing to be unpacked prior to
 running.

 --john



 On Wed, Jan 22, 2014 at 12:16 AM, Valery Shyshkin vns.shysh...@gmail.com
 wrote:

  The code below works fine on my Win 7 PC
 
  final Tomcat tomcat = new Tomcat();
  tomcat.setPort(9191);
   //File baseDir = new File(System.getProperty(java.io.tmpdir));
  File baseDir = new File(.);
  tomcat.addContext(, baseDir.getAbsolutePath());
  tomcat.addWebapp(/WebApplication2,
 
 D:\\VnsTestApps\\Nb74Jetty\\WebApplication2\\dist\\WebApplication2.war);
 
  tomcat.start();
  tomcat.getServer().await();
 
 
 
  2014/1/22 Valery Shyshkin vns.shysh...@gmail.com
 
   By the way it's not a suggestion  it's a signature of the addWebApp
   method.
   I'll try to find my working code and send it.
  
  
   2014/1/22 Valery Shyshkin vns.shysh...@gmail.com
  
   Try:
  
   File baseDir = new File(System.getProperty(java.io.tmpdir));
   tomcat.addContext(, baseDir.getAbsolutePath());
  
  
  
  
   2014/1/22 John Cartwright - NOAA Federal john.c.cartwri...@noaa.gov
  
   Thanks for the suggestion Valery, but swapping the arguments doesn't
   work.
  
   --john
  
  
  
   On Tue, Jan 21, 2014 at 8:12 AM, Valery Shyshkin 
  vns.shysh...@gmail.com
   wrote:
  
May be tomcat.addWebapp(contextName,pathToWarFile) instead of
tomcat.addWebapp(pathToWarFile, contextName) will help yoo.
   
   
2014/1/21 John Cartwright - NOAA Federal 
 john.c.cartwri...@noaa.gov
  
   
 Hello All,

 I'm trying to create a very basic embeded tomcat 7 application to
   host a
 packed WAR file.  My code looks like:

 Tomcat tomcat = new Tomcat()
 tomcat.setPort(port)
 tomcat.setBaseDir(.)
 tomcat.addWebapp(pathToWarFile, contextName)

 It seems to work, but I'm getting an exception on startup
  complaining
about
 the missing webapps directory:

SEVERE: Exception fixing docBase for context [/quickstart]
java.io.IOException: Application base [{1}] for host
 [/private/tmp/./webapps] does not exist or is not a directory.

 Can someone please direct me to a better way to do this? Is
 Tomcat#addWebapp not appropriate if hosting a packed WAR file?

 Thanks!

 --john

Tomcat WebDav directory configuration

2014-01-23 Thread Sampers, Ruud

LS,

 

Tomcat 7.0.47. 

Windows 7

 

I want to enable WebDav functionality in a different directory that the
root:

Assume my data directory : c:\DATA.

 

  servlet

servlet-namewebdav/servlet-name

 
servlet-classorg.apache.catalina.servlets.WebdavServlet/servlet-class


init-param

param-namedebug/param-name

param-value0/param-value

/init-param

init-param

param-namelistings/param-name

param-valuetrue/param-value   

/init-param

load-on-startup6/load-on-startup

/servlet

 

servlet-mapping

servlet-namewebdav/servlet-name

url-pattern/dav/url-pattern

/servlet-mapping

 

When I hit the url .../dav I see the content of the root files and dirs.


Now I want to publish the data that is available in C:\DATA. 

I'm unable to do this...

 

Thanks would be greatly appreciated.

 

Best Regards,

 

Ruud Sampers

 



This message and attachment(s) are intended solely for use by the addressee and 
may contain information that is privileged, confidential or otherwise exempt 
from disclosure under applicable law.

If you are not the intended recipient or agent thereof responsible for 
delivering this message to the intended recipient, you are hereby notified that 
any dissemination, distribution or copying of this communication is strictly 
prohibited.

If you have received this communication in error, please notify the sender 
immediately by telephone and with a 'reply' message.

Thank you for your co-operation.

RE: Tomcat 7.0.50 tldValidation

2014-01-23 Thread Paul Beckett

Mark / Chris,Thanks for your responses, and telling me how I can fix this for a 
particular application. That's greatly appreciated.
I maintain several tomcat servers, and have encountered this issue on all three 
of the applications were I've upgraded Tomcat. This hadn't been an issue for me 
with earlier Tomcat releases: 7.0.47 and earlier. Ideally I would like to fix 
this at a tomcat level, rather than modifying several different (sometimes 
third-party proprietary) applications.
As this wasn't a problem in 7.0.47, do you know what's changed, and if this is 
something I can configure at the Tomcat level without too much pain?
Also you mentioned the possibility of include the spec-appropriate TLD Schema 
along with Tomcat, is this something I could configure easily? If so, would 
you be able to point me in the right direction (apologies for my ignorance in 
this area).
Thanks again,Paul

 Date: Wed, 22 Jan 2014 10:24:20 -0500
 From: ch...@christopherschultz.net
 To: users@tomcat.apache.org
 Subject: Re: Tomcat 7.0.50 tldValidation
 
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA256
 
 Mark,
 
 On 1/22/14, 10:15 AM, Mark Thomas wrote:
  On 22/01/2014 14:12, Paul Beckett wrote:
  Does anyone know:
  - Why this occurs only since 7.0.50 Changes to XML validation
  introduced in 7.0.48-7.0.50
  
  - Where the root issue is likely to be / how to fix it Psi probe
  ships with an implementation of the standard tag library that 
  includes the following: 
  xsi:schemaLocation=http://java.sun.com/xml/ns/j2ee 
  web-jsptaglibrary_2_0.xsd
  
  in a tag library descriptor. The web-jsptaglibrary_2_0.xsd is a
  hint to the location but that is not enough for Tomcat to identify
  it. Later versions of the standard tag library use:
  
  xsi:schemaLocation=http://java.sun.com/xml/ns/j2ee 
  http://java.sun.com/xml/ns/j2ee/web-jsptaglibrary_2_0.xsd;
  
  which is unique so Tomcat is able to identify it.
  
  One could argue that web-jsptaglibrary_2_0.xsd should be sufficient
  to identify location of the intended schema.
 
 Would it be worth it to include the spec-appropriate TLD Schema along
 with Tomcat so that simply mentioning the system id would be enough
 for Tomcat to recognize it when configuring the digester?
 
 - -chris
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1
 Comment: GPGTools - http://gpgtools.org
 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
 
 iQIcBAEBCAAGBQJS3+KkAAoJEBzwKT+lPKRYZjQQAJzIJIP9nQXs6CfKFoN8Y+Ay
 xDfCyiUgreAPvtCdGj6PbtsOQoei1sr+c52Dgyz7YYuMZjZhCYCF38BFhsNyhHrw
 SWRRs8MIqbYnR7NU2YX22HEcf84SCBXMNK7+K261zlGAFsuYCTFoeOaCx3z/f993
 jiPbZfjY0cNHNKJS3VilItUzjdH73noWhjmAHUVQJ4gD5Aa+ZI2f5Enbw0lGXIm1
 RSOLJ7+9Zm6AKqeJ+pI4mARxUK9crXqMbmaT/RZKj9zV3T0GrMcUvc7BtvGHsKTv
 JBckJKleb1dx1hCM1r9XqMvaQ8gU623NYDPq+9w6+cJQdR6oEtBCL3ayLfVTX5Dz
 PQqmvn8WZUxi7xuENvzlqljfmF6xoFKCfRTHmuiyusch77KsmVHMNJDkoEUhccrE
 G6Qy749nIIvvhaBMAzSD174XijSiBSAuJxn+zZyiojAcd9S37f4ZKn8cCnTPPZdp
 XRV3F/tD802qFfKHr887OxIchpKsyTlXSnWVuXYEasg09kPAYNCa6tCZ5xHRazr+
 suwM301luStIs3EF+goix5H0njFaQO9bWvVNnjJyvKlQfxJqVyQseMCjDBwYa05C
 n55LJi0H0Jl3i7qmpLvVIzX54HsUsJiKYp6JCOlNYoVXaZm7xlVtWoZwXj370yX/
 Bh3LLh2/gUMPEIn9QeaU
 =eXbe
 -END PGP SIGNATURE-
 
 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org

Out of memory exception

2014-01-23 Thread Randeep

Hi,

I'm getting out of memory exception errors.

Exception in thread Timer-1 java.lang.OutOfMemoryError: Java heap space
at java.util.Arrays.copyOf(Arrays.java:2882)
at
java.lang.AbstractStringBuilder.expandCapacity(AbstractStringBuilder.java:100)
at
java.lang.AbstractStringBuilder.append(AbstractStringBuilder.java:572)
at java.lang.StringBuffer.append(StringBuffer.java:320)
at org.json.JSONArray.toString(JSONArray.java:834)
at org.json.JSONObject.valueToString(JSONObject.java:1359)
at org.json.JSONObject.toString(JSONObject.java:1233)
at com.xxx.xxx.servlet.WServlet.writeProgramJson(WServlet.java:503)
at com.xxx.xxx.servlet.WServlet$1.run(WServlet.java:414)
at java.util.TimerThread.mainLoop(Timer.java:512)
at java.util.TimerThread.run(Timer.java:462)

Is there anyway to see currently set jvm heap size details? Any linux
commands.

I have tried creating setenv.sh and putting the new parameters in it. but
echo $JAVA_OPTS was not giving any value. So I have put in .bash_profile
and run it. Then restarted tomcat6.

this is the line I added in .bash_profile.
JAVA_OPTS=-Xms256m -Xmx512m -Xss512k -verbose:gc -Xloggc:heap.log

Also I checked in heap.log where catelina.out can be found. But its not
created. Then I touched and restarted. But that also didn't work.

What is the right way to do this?

-- 
Randeep
Mob: +919447831699[kerala]
Mob: +919880050349[B'lore]
I blog here:
http://www.randeeppr.me/
Follow me Here:
http://twitter.com/Randeeppr
Poke me here!
http://www.facebook.com/Randeeppr
A little Linux Help
http://www.linuxhelp.in/
Work profile:
http://in.linkedin.com/in/randeeppr

Re: Tomcat 7.0.50 tldValidation

2014-01-23 Thread Mark Thomas

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On 23/01/2014 12:20, Paul Beckett wrote:
snip/

 As this wasn't a problem in 7.0.47, do you know what's changed, and
 if this is something I can configure at the Tomcat level without
 too much pain?

See my previous response.

 Also you mentioned the possibility of include the spec-appropriate
 TLD Schema along with Tomcat, is this something I could configure
 easily?

Not sure what Chris was thinking on that one. Tomcat already includes
all the appropriate TLD schema.

Mark
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJS4RD8AAoJEBDAHFovYFnnkyoP/1vyRJulvTyRjZELVKav4gsT
Lovta+IhRVLCY1sDh2tiA06nARqd+tLAJ5HZ7ZILkbhCATDI4R7IfdQWru/gYwX8
uFmtfWHEhIuRqMIukaBpJU+Jy5QN37rnmSu+ltO9YH1OPPg+vF7RO8RVkEhSW1Fo
smOk7GRYHU22DW72qBg2M4i+PByva1Sk/w5bHQTbrEIitTbadM7g2VNgQX/xfwx4
fdIsqxUhmI0B5QZ6mi5ikuAjxAmz8U/nLi2yWzJ4+IttQ+8K9UJPnLjO1CdKcuoI
YMfGZEc6Cj7BuG3FYJq1mRZz8hl/3UoxUs/zl2WQnZ7LGSAteuz0dN8DdqRBHfFI
KVmIhYq2KaE3ea8gjZzl2uGDPmELECHIQZJ9d90J6fteh5tpD++lay0AyB3l99eY
TQSU+yj0hLVJYV/langTvzblGanfoMEZ3mpJNtdqplyEbX2z7E0dGVx8Q3VXVXxd
dfPpZ1MX9WpW6Iyylp/dzROZNJ7TsweCfruPML/znjWN93rWr2eBeg7QINf5P5IF
/8wD4HKnanZrn4CKWceDxblcoti/Mq6wQBQFpNcCwY4oM3ytmYFtxsN+zC+4OLDd
G/I589kOlEKA1EHn4up2PhK6s0reD8AyxeoquvOXOT7af2+wrF3Lke5zSWxHKMJa
hxpKUPhFdqGYHjYeZbHZ
=4che
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Tomcat WebDav directory configuration

2014-01-23 Thread André Warnier


Sampers, Ruud wrote:

LS,

 

Tomcat 7.0.47. 


Windows 7

 


I want to enable WebDav functionality in a different directory that the
root:

Assume my data directory : c:\DATA.

 


  servlet

servlet-namewebdav/servlet-name

 
servlet-classorg.apache.catalina.servlets.WebdavServlet/servlet-class


init-param

param-namedebug/param-name

param-value0/param-value

/init-param

init-param

param-namelistings/param-name

param-valuetrue/param-value   


/init-param

load-on-startup6/load-on-startup

/servlet

 


servlet-mapping

servlet-namewebdav/servlet-name

url-pattern/dav/url-pattern

/servlet-mapping

 


When I hit the url .../dav I see the content of the root files and dirs.


Now I want to publish the data that is available in C:\DATA. 


I'm unable to do this...



I think that what you need to look at is this :
http://tomcat.apache.org/tomcat-7.0-doc/config/context.html (docBase)

In other words, you need to :
- create a /META-INF/context.xml file inside your DAV application
- define a Context element inside that file, with the appropriate docBase 
attribute



-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Do some research before blogging (was: Out of memory exception)

2014-01-23 Thread KD

Randeep writes:

 I blog here:
 http://www.randeeppr.me/

Great, but recommending to run Tomcat as root is dangerous nonsense.


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

DAV app.

2014-01-23 Thread André Warnier


Hi.

In order to respond to a previous post to the list, I was trying to find details of the 
DAV application.


I'm starting here :
http://tomcat.apache.org/tomcat-7.0-doc/config/index.html

but don't really find anything DAV-like.
Am I looking in the wrong spot ?


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Apache Tomcat Summit at ApacheCon NA 2014

2014-01-23 Thread Mark Thomas

ApacheCon NA will be in Denver 7th to 11th April.

The schedule for ApacheCon NA 2014 has been firmed up. There is an
opportunity for a project summit on either the Thursday or the Friday.
Since the BarCamp has been scheduled for the Thursday the Friday seems
like the better option.

We have complete flexibility as to the organisation of the Summit. One
possible topic is with the Java EE 7 work pretty much complete, what new
features is the community interested in between now and when the Java EE
8 work starts? Other suggestions for topics welcome.

To get this up and running we need an idea of how many folks might want
to attend so please reply to this thread on the users list if:
- you are interested in attending
- you have a topic / some topics to suggest

Thanks,

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Tomcat 7 not honoring maxThreads configuration in catalina.properties and activeCount not going beyond 200

2014-01-23 Thread akshay hiremath

I've a tomcat 7 instance with following configuration in 
catalina.properties for threads
server.service-Catalina.executor-tomcatThreadPool.maxThreads=300 
server.service-Catalina.executor-tomcatThreadPool.minSpareThreads=300
server.service-Catalina.connector.http1.1.executor=tomcatThreadPool 
server.service-Catalina.connector.http1.1.protocol=HTTP/1.1 
server.service-Catalina.connector.http1.1.connectionTimeout=2 
server.service-Catalina.connector.http1.1.acceptCount=300 
server.service-Catalina.connector.http1.1.maxKeepAliveRequests=15
server.xml configuration

 Service name=Catalina

    Executor name=tomcatThreadPool
  
namePrefix=${server.service-Catalina.executor-tomcatThreadPool.namePrefix}
  
maxThreads=${server.service-Catalina.executor-tomcatThreadPool.maxThreads}
  
minSpareThreads=${server.service-Catalina.executor-tomcatThreadPool.minSpareThreads}/

    Connector executor=${server.service-Catalina.connector.http1.1.executor}
   port=${http.port}
   protocol=${server.service-Catalina.connector.http1.1.protocol}
   
connectionTimeout=${server.service-Catalina.connector.http1.1.connectionTimeout}
   redirectPort=${https.port}
   
acceptCount=${server.service-Catalina.connector.http1.1.acceptCount}
   
maxKeepAliveRequests=${server.service-Catalina.connector.http1.1.maxKeepAliveRequests}/



I want 300 threads to serve the requests.
With above configuration tomcat starts 300 threads and I can see 
through JConsole 300 worker threads are running. but when I hit with 300 
concurrent requests load the activeCount goes just till 200.
Why tomcat is not able to have more than 200 active Threads (parallel 
threads) processng my requests?

Thanks,
Akshay

Re: DAV app.

2014-01-23 Thread Mark Thomas

On 23/01/2014 13:21, André Warnier wrote:
 Hi.
 
 In order to respond to a previous post to the list, I was trying to find
 details of the DAV application.
 
 I'm starting here :
 http://tomcat.apache.org/tomcat-7.0-doc/config/index.html
 
 but don't really find anything DAV-like.
 Am I looking in the wrong spot ?

Not really. There isn't much documentation. WebDAV support is provided
by a Servlet. The best place to start is the Javadoc for that Servlet:
http://tomcat.apache.org/tomcat-8.0-doc/api/org/apache/catalina/servlets/WebdavServlet.html

Mark


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Tomcat 7 not honoring maxThreads configuration in catalina.properties and activeCount not going beyond 200

2014-01-23 Thread Mark Thomas

On 23/01/2014 13:30, akshay hiremath wrote:
 Why tomcat is not able to have more than 200 active Threads (parallel 
 threads) processng my requests?

It can. The issue is that the combination of the requests you are making
(which you fail to describe), your load testing framework (which you
fail to describe) and the scheduling in the CPUs of your hardware (which
you also fail to describe) mean that the chances of there actually being
300 concurrent requests for Tomcat to process is pretty much zero.

Mark


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Tomcat 7 not honoring maxThreads configuration in catalina.properties and activeCount not going beyond 200

2014-01-23 Thread akshay hiremath

We have this HP load runner running a load of requests on this system. We don't 
see request rejected by Tomcat but if I monitor the activeCount attribute of 
Mbean Catalina:type=Executor,name=tomcatThreadPool over the period of test 
why the activeCount is not going above 200. if I continuously track activeCount 
and currentThreadsBusy of MBean Catalina:type=ThreadPool,name=http-bio-8080 
I see the graph reahes 200 and flat lines there. Please find monitored graph 
attached during one of the tests. See time frm start of graph to the 13:30 when 
test ended. ignore the in between part and rest graph that is of another 
ongoing test.




On Thursday, January 23, 2014 7:06 PM, Mark Thomas ma...@apache.org wrote:
 
On 23/01/2014 13:30, akshay hiremath wrote:

 Why tomcat is not able to have more than 200 active Threads (parallel 
 threads) processng my requests?

It can. The issue is that the combination of the requests you are making
(which you fail to describe), your load testing framework (which you
fail to describe) and the scheduling in the CPUs of your hardware (which
you also fail to describe) mean that the chances of there actually being
300 concurrent requests for Tomcat to process is pretty much zero.

Mark


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Out of memory exception

2014-01-23 Thread Daniel Mikusa

On Jan 23, 2014, at 7:43 AM, Randeep randeep...@gmail.com wrote:

Hi,

I'm getting out of memory exception errors.

Exception in thread Timer-1 java.lang.OutOfMemoryError: Java heap space
at java.util.Arrays.copyOf(Arrays.java:2882)
at
java.lang.AbstractStringBuilder.expandCapacity(AbstractStringBuilder.java:100)
at
java.lang.AbstractStringBuilder.append(AbstractStringBuilder.java:572)
at java.lang.StringBuffer.append(StringBuffer.java:320)
at org.json.JSONArray.toString(JSONArray.java:834)
at org.json.JSONObject.valueToString(JSONObject.java:1359)
at org.json.JSONObject.toString(JSONObject.java:1233)
at com.xxx.xxx.servlet.WServlet.writeProgramJson(WServlet.java:503)
at com.xxx.xxx.servlet.WServlet$1.run(WServlet.java:414)
at java.util.TimerThread.mainLoop(Timer.java:512)
at java.util.TimerThread.run(Timer.java:462)

Is there anyway to see currently set jvm heap size details? Any linux
commands.

If you run “ps” and “grep” for something like “java”, “catalina”, etc.. you can
find your running Tomcat process. On Linux this should show the full command
that was run.

Alternatively, you could use “jinfo pid”. That will dump a bunch of info
including the VM Flags.

I have tried creating setenv.sh and putting the new parameters in it. but
echo $JAVA_OPTS was not giving any value.

How did you install Tomcat? Did you use your distro’s package manager? Did
you download from tomcat.apache.org?

How are you starting your server? Are you using the included start script?
Are you using an init.d (or other) script you created? Are you using commons
daemon?

So I have put in .bash_profile and run it.

Don’t do that. Why would you want these in your bash profile?

Then restarted tomcat6.

What version exactly? There are quite a few.

this is the line I added in .bash_profile.
JAVA_OPTS=-Xms256m -Xmx512m -Xss512k -verbose:gc -Xloggc:heap.log”

Again, don’t put this in your profile.

Also I checked in heap.log where catelina.out can be found. But its not
created. Then I touched and restarted. But that also didn't work.

What is the right way to do this?

If you downloaded from tomcat.apache.org and installed from the zip, you’d put
them in bin/setenv.sh and it would work. If you’re using a packaged version of
Tomcat from your Linux distro, then it may well be different. If you gave more
details, perhaps someone on the list could help.

Dan

--
Randeep
Mob: +919447831699[kerala]
Mob: +919880050349[B'lore]
I blog here:
http://www.randeeppr.me/
Follow me Here:
http://twitter.com/Randeeppr
Poke me here!
http://www.facebook.com/Randeeppr
A little Linux Help
http://www.linuxhelp.in/
Work profile:
http://in.linkedin.com/in/randeeppr

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Deny Put Delete

2014-01-23 Thread Stephan Fletcher

Can anyone tell me how to fix the following in my Tomcat config. I'm using 
Apache Tomcat 7.0.30 and I'm failing on the following PCI Security scans.


1. Title: Web server allows PUT: /

Impact: An attacker may be able to upload files onto the web server.

Data Received: Allow: GET, HEAD, POST, PUT, DELETE, OPTIONS

Resolution: Configure the web server not to accept PUT requests. If you require 
the functionality of PUT for web publishing, use a put script which can only be 
run by authorized users, which ensures that the script can update only web 
content files, and which ensures that users can only update their own pages


2. Title: Web server allows HTTP method DELETE

Impact: The HTTP DELETE method may allow an attacker to delete arbitrary 
content from the Web Server.

Data Received: Allow: GET, HEAD, POST, PUT, DELETE, OPTIONS

Resolution: Disable the DELETE method in the Web Server configuration. If this 
is not an option, use one of the following workarounds:

Apache: Disable the DELETE method by including the following in the Apache 
configuration:

lt;Limit DELETEgt; Order Deny, Allow Deny from All lt;/Limitgt;


Any help would be greatly appreciated





Stephan Fletcher
Manager of Information Services
Bohren's Moving  Storage
Docusafe Records Management
3 Applegate Drive South
Robbinsville, NJ 08691
O: 609.208.1470
F: 609.208.1471
W: www.bohrensmoving.comhttp://www.bohrensmoving.com/
W: www.docusafe.comhttp://www.docusafe.com/






Important Notice: This email is copyright of Bohrensmoving.com, and any files 
transmitted with it are confidential and intended solely for the use of the 
individual or entity to whom they are addressed. If you have received this 
email in error please notify the system manager. This message contains 
confidential information and is intended only for the individual named. If you 
are not the named addressee you should not disseminate, distribute or copy this 
e-mail. Please notify the sender immediately by e-mail from your system. If you 
are not the intended recipient you are notified that disclosing, copying, 
distributing or taking any action in reliance on the contents of this 
information is strictly prohibited.

This email and any files transmitted with it are confidential and 
intended solely for the use of the individual or entity to whom they are
addressed. This footnote also confirms that this email message has been 
swept for the presence of computer viruses.

Re: Deny Put Delete

2014-01-23 Thread Mark Thomas

On 23/01/2014 14:57, Stephan Fletcher wrote:
 Any help would be greatly appreciated

rant
Buy a better vulnerability scanner. Specifically, one understands that
an OPTIONS request returns the methods that are *available* not the
methods that are *permitted*.
/rant

Assuming you haven't changed Tomcat's default configuration any attempt
to actually PUT or DELETE a resource will be denied.

I have a recollection that we changed the implementation of the OPTIONS
request to try and help with this sort of thing. Scratch that. That was
for TRACE which won't be included in an OPTIONS response unless Tomcat
can confirm that it has been explicitly enabled in the Connector.

Mark


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: Deny Put Delete

2014-01-23 Thread Stephan Fletcher

It's a third party that is running the scan.

-Original Message-
From: Mark Thomas [mailto:ma...@apache.org]
Sent: Thursday, January 23, 2014 10:05 AM
To: Tomcat Users List
Subject: Re: Deny Put  Delete

On 23/01/2014 14:57, Stephan Fletcher wrote:
 Any help would be greatly appreciated

rant
Buy a better vulnerability scanner. Specifically, one understands that an 
OPTIONS request returns the methods that are *available* not the methods that 
are *permitted*.
/rant

Assuming you haven't changed Tomcat's default configuration any attempt to 
actually PUT or DELETE a resource will be denied.

I have a recollection that we changed the implementation of the OPTIONS request 
to try and help with this sort of thing. Scratch that. That was for TRACE which 
won't be included in an OPTIONS response unless Tomcat can confirm that it has 
been explicitly enabled in the Connector.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Important Notice: This email is copyright of Bohrensmoving.com, and any files 
transmitted with it are confidential and intended solely for the use of the 
individual or entity to whom they are addressed. If you have received this 
email in error please notify the system manager. This message contains 
confidential information and is intended only for the individual named. If you 
are not the named addressee you should not disseminate, distribute or copy this 
e-mail. Please notify the sender immediately by e-mail from your system. If you 
are not the intended recipient you are notified that disclosing, copying, 
distributing or taking any action in reliance on the contents of this 
information is strictly prohibited.

This email and any files transmitted with it are confidential and 
intended solely for the use of the individual or entity to whom they are
addressed. This footnote also confirms that this email message has been 
swept for the presence of computer viruses.

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

71 matches

Mail list logo