Re: [OT] session-timeout not taking effect

2010-09-15 Thread André Warnier
Debbie Shapiro wrote: Exactly. We have to follow FDA guidelines for validation of OTS software and our validation expert is testing for this now. We want to make sure that security is in place that if the app is left alone for a period of time other users won't have access to it. More serious

Re: [OT] session-timeout not taking effect

2010-09-15 Thread André Warnier
Debbie Shapiro wrote: Exactly. We have to follow FDA guidelines for validation of OTS software and our validation expert is testing for this now. We want to make sure that security is in place that if the app is left alone for a period of time other users won't have access to it. Well in th

RE: [OT] Tomcat on Linux

2010-09-15 Thread George Sexton
> -Original Message- > From: Tommy Pham [mailto:tommy...@gmail.com] > Sent: Wednesday, September 15, 2010 2:09 PM > To: users@tomcat.apache.org > Subject: [OT] Tomcat on Linux > > Hi, > > I was wondering what flavor(s) of Linux, if applicable, do you use to > develop? And what Linux flavo

Re: session-timeout not taking effect

2010-09-15 Thread Wesley Acheson
Pretty much as I thought. My "tests" were designed with this result in mind. Pretty bad way to test, I don't seem to help it though. I have an assumption then test accordingly. Anyway its using something called AJAX for other reasons. The downside it it keeps your sessions alive. Glad you sorted i

Re: Adding Transfer Encoding header if not present

2010-09-15 Thread André Warnier
Mark Thomas wrote: On 15/09/2010 20:39, Amit Puri wrote: Hi All I am using tomcat 6.0.26 I've got a simple web application deployed where I am printing all header information through servlet. By default I am not able to see Transfer-Encoding header when I do request.getHeader Enumeration enm =

Re: JSP:includes parameter passing vulnerability

2010-09-15 Thread Michael Coates
Chris, Thanks for your detailed response. It is very helpful. I've got some responses inline below. On 9/15/10 2:46 PM, Christopher Schultz wrote: > Michael, > > On 9/15/2010 3:05 PM, Michael Coates wrote: > > > http://michael-coates.blogspot.com/2010/09/danger-of-jsp-includes-and-parameter.html

RE: [OT] session-timeout not taking effect

2010-09-15 Thread Debbie Shapiro
Exactly. We have to follow FDA guidelines for validation of OTS software and our validation expert is testing for this now. We want to make sure that security is in place that if the app is left alone for a period of time other users won't have access to it. Debbie Shapiro, Data Wareh

Re: Tomcat 5.5: java.io.FilePermission read access denied to logging.properties

2010-09-15 Thread Pid
On 14/09/2010 23:35, André Warnier wrote: > Pid wrote: >> On 14/09/2010 16:17, Steve Ryder wrote: >>> java.security.AccessControlException: access denied >>> (java.io.FilePermission >>> /home/sryder/JsrSystems.info/ROOT/WEB-INF/classes/logging.properties >>> read) >>> >>> When I first noticed this

Re: OutOfMemoryError: PermGen space!!!! Dont know why?

2010-09-15 Thread Pid
On 15/09/2010 07:28, abhishek jain wrote: > Hi, > i have the following in bin/catalina.sh > > JAVA_OPTS="$JAVA_OPTS -server -Xms512M -Xmx1024M -XX:MaxPermSize=1024M > -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager" > > still i get the permgen error exception everyday, pl. som

RE: JSP:includes parameter passing vulnerability

2010-09-15 Thread Martin Gainty
Mike- check to make sure your if the browser doesnt see it the end tag the browser throws away the whole tag and uses the default assignment (which comes from the jsp:include page=) Martin-- __ Verzicht und Vertraulichkeitanmerkung/Note de déni

Re: [OT] Hi Guys ... can some one tell what is hashcode in java

2010-09-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ramzi, On 9/15/2010 12:43 PM, ramzi khlil wrote: > HashCode is a value computed in such way to be unique as possible to improve > performance while retrieving object in HashedCollections. What are HashedCollections? > If for example you have a HashM

Re: JSP:includes parameter passing vulnerability

2010-09-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Michael, On 9/15/2010 3:05 PM, Michael Coates wrote: > http://michael-coates.blogspot.com/2010/09/danger-of-jsp-includes-and-parameter.html Can I ask this stupid question: why are you grabbing data from the request using a variable parameter name? (

Re: [OT] Tomcat on Linux

2010-09-15 Thread Wesley Acheson
Hi Christopher On Wed, Sep 15, 2010 at 11:18 PM, Christopher Schultz wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Wesley, > >> Our Production environment is Solaris 10. Technically not linux but >> close enough. > > Really? I haven't used Solaris in a long time, but back then it w

Re: [OT] Tomcat on Linux

2010-09-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Tommy, On 9/15/2010 4:08 PM, Tommy Pham wrote: > I was wondering what flavor(s) of Linux, if applicable, do you use to > develop? And what Linux flavor(s) do you have Tomcat running production on? We use Debian Etch and Lenny for all our environments

Re: [OT] Tomcat on Linux

2010-09-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Wesley, On 9/15/2010 4:32 PM, Wesley Acheson wrote: > On Wed, Sep 15, 2010 at 10:08 PM, Tommy Pham wrote: >> Hi, >> >> I was wondering what flavor(s) of Linux, if applicable, do you use to >> develop? > Em Windows. :P >> And what Linux flavor(s) do y

Re: [OT] Tomcat on Linux

2010-09-15 Thread Wesley Acheson
On Wed, Sep 15, 2010 at 10:08 PM, Tommy Pham wrote: > Hi, > > I was wondering what flavor(s) of Linux, if applicable, do you use to > develop? Em Windows. :P > And what Linux flavor(s) do you have Tomcat running production on? > Our Production environment is Solaris 10. Technically not linux but c

Re: JSP:includes parameter passing vulnerability

2010-09-15 Thread Michael Coates
I agree that in the current design a developer can never trust the request parameter. I guess what I'm arguing for is the ability for a developer to decide that a parameter will always come from another jsp and never come from the URL. However, even in this scenario its possible that the origina

RE: How to set start up sequence of application in tomcat

2010-09-15 Thread Caldarale, Charles R
> From: Ashish Kulkarni [mailto:ashish.kulkarn...@gmail.com] > Subject: Re: How to set start up sequence of application in tomcat > So there is no way of doing it through tomcat, > how can i do it? You will have to implement your own sequencing controller. The servlet spec likes to consider al

Re: How to set start up sequence of application in tomcat

2010-09-15 Thread Mark Thomas
On 15/09/2010 21:00, Ashish Kulkarni wrote: > Hi > So there is no way of doing it through tomcat, how can i do it? Read my response again. Mark - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional command

[OT] Tomcat on Linux

2010-09-15 Thread Tommy Pham
Hi, I was wondering what flavor(s) of Linux, if applicable, do you use to develop? And what Linux flavor(s) do you have Tomcat running production on? Thanks, Tommy - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org F

Re: How to set start up sequence of application in tomcat

2010-09-15 Thread Ashish Kulkarni
Hi So there is no way of doing it through tomcat, how can i do it? Ashish On Wed, Sep 15, 2010 at 3:47 PM, Mark Thomas wrote: > On 15/09/2010 20:43, Ashish Kulkarni wrote: > > Hi > > I have deployed 3 applications in tomcat, is there a way to setup startup > > sequence of these applications in

RE: tomcat 7.0.2 single sign on issue

2010-09-15 Thread Ming_Chang
Thanks. I will wait for 7.0.3 -Original Message- From: Mark Thomas [mailto:ma...@apache.org] Sent: Wednesday, September 15, 2010 12:39 PM To: Tomcat Users List Subject: Re: tomcat 7.0.2 single sign on issue On 15/09/2010 19:25, ming_ch...@mcafee.com wrote: > Thanks for looking at this is

Re: JSP:includes parameter passing vulnerability

2010-09-15 Thread Mikolaj Rydzewski
Michael Coates wrote: It seems to me that the method used to request parameters from an included jsp file should not "fail over" to the URL if the jsp:include does not provide the parameter. IMO that's incorrect assumption, that one can skip security consideration when using JPS's in 'safe wa

Re: How to set start up sequence of application in tomcat

2010-09-15 Thread Mark Thomas
On 15/09/2010 20:43, Ashish Kulkarni wrote: > Hi > I have deployed 3 applications in tomcat, is there a way to setup startup > sequence of these applications in tomcat, for example if i have test, test1, > test2 as application then i would like to start test2 first, test1 second > and test last, as

Re: Adding Transfer Encoding header if not present

2010-09-15 Thread Mark Thomas
On 15/09/2010 20:39, Amit Puri wrote: > Hi All > > I am using tomcat 6.0.26 > I've got a simple web application deployed where I am printing all header > information through servlet. By default I am not able to see > Transfer-Encoding header when I do request.getHeader > > Enumeration enm = reque

How to set start up sequence of application in tomcat

2010-09-15 Thread Ashish Kulkarni
Hi I have deployed 3 applications in tomcat, is there a way to setup startup sequence of these applications in tomcat, for example if i have test, test1, test2 as application then i would like to start test2 first, test1 second and test last, as test needs some information from test1. Any ideas -

Adding Transfer Encoding header if not present

2010-09-15 Thread Amit Puri
Hi All I am using tomcat 6.0.26 I've got a simple web application deployed where I am printing all header information through servlet. By default I am not able to see Transfer-Encoding header when I do request.getHeader Enumeration enm = request.getHeaderNames(); while (enm.hasMoreElements()) { S

Re: tomcat 7.0.2 single sign on issue

2010-09-15 Thread Mark Thomas
On 15/09/2010 19:25, ming_ch...@mcafee.com wrote: > Thanks for looking at this issue. Already fixed. Will be in 7.0.3 http://svn.apache.org/repos/asf/tomcat/trunk/webapps/docs/changelog.xml Mark - To unsubscribe, e-mail: users-

Re: [OT] session-timeout not taking effect

2010-09-15 Thread André Warnier
Debbie Shapiro wrote: Sorry, I probably wasn't very clear in that email. I created a second IE instance and navigated to another page in that instance (suggestion made on another email here) to see if that would cause Tomcat to see the first page as inactive. It didn't. Allright, that makes

RE: session-timeout not taking effect

2010-09-15 Thread Debbie Shapiro
Sorry, I probably wasn't very clear in that email. I created a second IE instance and navigated to another page in that instance (suggestion made on another email here) to see if that would cause Tomcat to see the first page as inactive. It didn't. Debbie Shapiro, Data Warehouse Manag

tomcat 7.0.2 single sign on issue

2010-09-15 Thread Ming_Chang
Hi, there, I am playing with the latest 7.0.2 and the single sign on part is not working correctly. And I debugged the problem and found the sso member variable is always null in AuthenticatorBase class. Here is the clip of code in this class I found it may have a problem. This code tries to

Re: session-timeout not taking effect

2010-09-15 Thread André Warnier
Debbie Shapiro wrote: Official response from InetSoft: ** If you request for a report and leave it running in the browser in v10.2, the report will send a heartbeat beacon to the report server to let the server kno

Re: 2 second delays in mod_jk while "maintaining workers"

2010-09-15 Thread John Baker
Hello, I've spent a week looking into mod_jk, Apache, etc., and the problem appears to be due to a bug in the AJP connector within JBoss: https://jira.jboss.org/browse/JBPAPP-366 This bug is not fixed in the latest release of JBoss 4.2.3, which is rather disappointing. After downloading the j

Re: Hi Guys ... can some one tell what is hashcode in java

2010-09-15 Thread Mark Thomas
On 15/09/2010 17:44, Antonio Petrelli wrote: > 2010/9/15 Pankaj D : >> What is DYH > > Following Chuck's idea... > http://lmgtfy.com/?q=dyh And while you are at it, I'd read these too: http://catb.org/~esr/faqs/smart-questions.html http://slash7.com/2006/12/22/vampires/ Mark ---

Re: Hi Guys ... can some one tell what is hashcode in java

2010-09-15 Thread Leon Rosenberg
On Wed, Sep 15, 2010 at 6:44 PM, Antonio Petrelli wrote: > 2010/9/15 Pankaj D : >> What is DYH > > Following Chuck's idea... > http://lmgtfy.com/?q=dyh > so DYH is Doğan Yayın Holding in Turkey... :-) > Antonio > > - > To unsubs

Re: Hi Guys ... can some one tell what is hashcode in java

2010-09-15 Thread Pankaj D
Thanks dude .. .this is what i was looking for On Wed, Sep 15, 2010 at 10:13 PM, ramzi khlil wrote: > HashCode is a value computed in such way to be unique as possible to > improve > performance while retrieving object in HashedCollections. > If for example you have a HashMap, and didn't ov

Re: Hi guys ... What is Translation time and request time.

2010-09-15 Thread Pankaj D
OK thankyou On Wed, Sep 15, 2010 at 10:11 PM, Antonio Petrelli < antonio.petre...@gmail.com> wrote: > 2010/9/15 Pankaj D : > > NO ... m a newbie to java just having a discussion with a friend > ... > > This is not a Java generic mailing list, here we discuss of problems > about *Tomca

Re: Hi Guys ... can some one tell what is hashcode in java

2010-09-15 Thread Laird Nelson
On Wed, Sep 15, 2010 at 12:42 PM, Pankaj D wrote: > What is DYH Do Your Homework. Best, Laird

Re: Hi Guys ... can some one tell what is hashcode in java

2010-09-15 Thread Antonio Petrelli
2010/9/15 Pankaj D : > What is DYH Following Chuck's idea... http://lmgtfy.com/?q=dyh Antonio - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org

Re: Hi Guys ... can some one tell what is hashcode in java

2010-09-15 Thread ramzi khlil
HashCode is a value computed in such way to be unique as possible to improve performance while retrieving object in HashedCollections. If for example you have a HashMap, and didn't overrride hashCode() method all your objects will be in the same bucket resulting a slow execution while retrieving an

Re: Hi Guys ... can some one tell what is hashcode in java

2010-09-15 Thread Pankaj D
What is DYH On Wed, Sep 15, 2010 at 10:09 PM, Antonio Petrelli < antonio.petre...@gmail.com> wrote: > DYH > > 2010/9/15 Pankaj D : > > HI if someone can answer this query what is hash code in java ...is it > some > > sort of memory location or address ...? > > > > Regards > > Pankaj > > > > -

Re: Hi guys ... What is Translation time and request time.

2010-09-15 Thread Antonio Petrelli
2010/9/15 Pankaj D : > NO ...  m a newbie  to java just having a discussion with a friend ... This is not a Java generic mailing list, here we discuss of problems about *Tomcat*, nothing else. Contact your local JUG, that may help you to find a tutorial, or simply google it. Don't ask random

RE: Hi guys ... What is Translation time and request time.

2010-09-15 Thread Caldarale, Charles R
> From: Pankaj D [mailto:pankaj66...@gmail.com] > Subject: Re: Hi guys ... What is Translation time and request time. > NO ... m a newbie to java just having a discussion with a friend ... http://lmgtfy.com/?q=java+tutorial - Chuck THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OT

Re: Hi Guys ... can some one tell what is hashcode in java

2010-09-15 Thread Antonio Petrelli
DYH 2010/9/15 Pankaj D : > HI if someone can answer this query what is hash code in java ...is it some > sort of memory location or address ...? > > Regards > Pankaj > - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org

Re: Hi guys ... What is Translation time and request time.

2010-09-15 Thread Pankaj D
NO ... m a newbie to java just having a discussion with a friend ... On Wed, Sep 15, 2010 at 10:06 PM, Antonio Petrelli < antonio.petre...@gmail.com> wrote: > 2010/9/15 Pankaj D : > > What are these is JSP ...? > > > > Translation time : is it the Time of translation or Time required for >

Re: Hi guys ... What is Translation time and request time.

2010-09-15 Thread Antonio Petrelli
2010/9/15 Pankaj D : > What are these is JSP ...? > > Translation time : is it the Time of translation or Time required for > translation ..? > Request time : Is it time of request or what ...? This is homework right? - To unsubs

Hi guys ... What is Translation time and request time.

2010-09-15 Thread Pankaj D
What are these is JSP ...? Translation time : is it the Time of translation or Time required for translation ..? Request time : Is it time of request or what ...?

RE: session-timeout not taking effect

2010-09-15 Thread Debbie Shapiro
Official response from InetSoft: ** If you request for a report and leave it running in the browser in v10.2, the report will send a heartbeat beacon to the report server to let the server know that the report is st

RE: session-timeout not taking effect

2010-09-15 Thread Debbie Shapiro
I don't see any settings like this in the web.xml located w/in the inetsoft web app directory. Debbie Shapiro, Data Warehouse Manager Office: 425.402.2233 -Original Message- From: André Warnier [mailto:a...@ice-sa.com] Sent: Tuesday, September 14, 2010 3:59 PM To: Tomcat User

SOLVED: Virtual host deployment

2010-09-15 Thread Alec Swan
Thank you everybody for the answers. I am closing this thread. On Wed, Sep 15, 2010 at 8:27 AM, Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Alec, > > On 9/14/2010 5:52 PM, Alec Swan wrote: > > The deployment scenario I would lik

Re: HtttServletRequest.getSession()

2010-09-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 André, Thanks for further investigation. Comments, as always, are below. On 9/14/2010 6:17 PM, André Warnier wrote: > 3.3.3 Cookie Management If a user agent receives a Set-Cookie2 >response header whose NAME is the same as that of a cookie it

Re: Virtual host deployment

2010-09-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Alec, On 9/14/2010 5:52 PM, Alec Swan wrote: > The deployment scenario I would like to support requires deploying the same > WAR file on the development server first and then on the production server. > Development and production servers use different

Re: session-timeout not taking effect

2010-09-15 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 André, On 9/14/2010 6:27 PM, André Warnier wrote: > Debbie Shapiro wrote: >> Hi Wesley - >> I logged in to my web app, ran a report and then left it alone for 45 >> minutes. Came back and tried to run another report. I was expecting to >> receive a pr

Re: Tomcat unexpected shutdown on Solaris

2010-09-15 Thread kretes
Hi, We are experiencing similiar problem, and we have added a shutdown hook to JVM : Runtime.getRuntime().addShutdownHook(new PrintStacktracesOnShutdownHook()); and used Thread.getAllStackTraces() to get all stack traces and printed them out. Finally it occured that process really did got SIGHUP

Re: OutOfMemoryError: PermGen space!!!! Dont know why?

2010-09-15 Thread Edmund Urbani
On 09/15/10 08:28, abhishek jain wrote: > Hi, > i have the following in bin/catalina.sh > > JAVA_OPTS="$JAVA_OPTS -server -Xms512M -Xmx1024M -XX:MaxPermSize=1024M > -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager" > > still i get the permgen error exception everyday, pl. someon

Re: OutOfMemoryError: PermGen space!!!! Dont know why?

2010-09-15 Thread Peter McNeil
Check the process for java has the correct max perm size set. If you're using linux do a ps axf --cols 1000 | grep java A max PermSize of 1024m is pretty big... My tomcat 6 instance running several apps returns:- /usr/java/latest/bin/java -Djava.util.logging.config.file=/home/pmcneil/apps/to

Re: One question about EL 2.2 :"java.lang.NoSuchMethodException" error when call a managedbean int method

2010-09-15 Thread Mark Thomas
On 15/09/2010 08:02, viola lu wrote: > did you have any idea? I know exactly where this code is going wrong. As I said before, it is in the code the works out which method to call. [1] It uses an exact match on parameter types (with some scope for ambiguity). It looks like the code needs to be a l

Re: One question about EL 2.2 :"java.lang.NoSuchMethodException" error when call a managedbean int method

2010-09-15 Thread viola lu
This test application can work well on glassfish, but glassfish el implementation is different from tomcat el implementation: jasper-el.jar, which is under tomcat lib folder? First, i though it's myfaces problem, but myfaces community response it's el implementation problem: https://issues.apache.o