Re: [PATCH] Secure defaults in server.xml + support for multihom ed machines

2001-05-15 Thread Andrey Kartashov
On Tue, May 15, 2001 at 09:46:18AM +0200, GOMEZ Henri wrote: +1 Thanks! So what's the procedure for adding it to CVS? Is there a contact person responsible for adding patches or if not then how does it work? Sorry to be asking but I didn't see any info about it on jakarta web site and I'm new

Re: Tomcat 3.2.2 beta 4 - AJP14 continuation

2001-05-12 Thread Andrey Kartashov
, 8 May 2001, Andrey Kartashov wrote: What I'm trying to say is: To address this group of people I'd suggest splitting distribution into pure java Tomcat part + extensions. This way only NECESSARY files will make their way to conf directory. If someone is (for example) interested

[PATCH] Secure defaults in server.xml + support for multihomed machines

2001-05-12 Thread Andrey Kartashov
This patch is a result of our previous discussion with Henry about making more secure default bindings in server.xml. Summary of changes: src/etc/server.xml: Added address=127.0.0.1 parameter to Ajp interceptors that should make them bind to localhost by default (At the very

Re: Tomcat 3.2.2 beta 4 - AJP14 continuation

2001-05-08 Thread Andrey Kartashov
On Mon, May 07, 2001 at 11:49:25PM +0200, GOMEZ Henri wrote: Should it become default? I hope the answer is yes:) It also has another value: inet is not a well-known parameter. Having it in default server.xml along with a little comment about what it does may compensate for the lack of

Re: Tomcat 3.2.2 beta 4 (insecure default settings)

2001-05-07 Thread Andrey Kartashov
On Mon, May 07, 2001 at 02:11:35PM +0200, GOMEZ Henri wrote: You're right. TC still use ajp12 at its default connector so it listen all interface (which I agree could rise problem). I'm using in my prod systems, ajp13 to connect webservers and ajp12 only for the shutdown purpose (and listen

Re: Tomcat 3.2.2 beta 4 (insecure default settings)

2001-05-05 Thread Andrey Kartashov
On Fri, May 04, 2001 at 07:58:17PM -0400, Andrey Kartashov wrote: [skpd] Let's be prudent here. The standard configuration must avoid security hole. Many users will have tomcat in front and we must avoid someone outside shutdown their TC boxes. Let me clarify this:) I don't ask you

Re: Tomcat 3.2.2 beta 4 (problem with shutdown code)

2001-05-04 Thread Andrey Kartashov
On Fri, May 04, 2001 at 09:26:35AM +0200, GOMEZ Henri wrote: Hi, all! I've made a little modification in Tomcat 3.2.1 codebase that I think would be nice to include in TC 3.2.2. Problem: shutdown script always connects to localhost to send shutdown command. It is a problem on a

Re: ERROR using multipart/form-data POST request

2001-04-27 Thread Andrey Kartashov
On Fri, Apr 27, 2001 at 03:57:43AM +0200, Incze Lajos wrote: This error hapens when I try to upload file using form with enctype=multipart/form-data and method=post. The environment: Linux(2.4.3), Apache(1.3.19), mod_jk and Tomcat (3.2.1), using ajp13 protocol. I can't seem to

Re: ERROR using multipart/form-data POST request

2001-04-27 Thread Andrey Kartashov
On Fri, Apr 27, 2001 at 11:17:32AM -0700, Lucian Cionca wrote: The reason for this is a bug in the doRead() method of Ajp13ConnectorRequest, which causes the doRead(byte[] b, int off, int len) in that same class to prematurely end processing . The bug is in the conversion of the value read