Re: security and a servlet using core catalina classes

2001-05-10 Thread Fabien Le Floc'h
I am sorry, it seems I was not clear enough. I wrote a servlet in a classic WAR file at an arbitrary location and NOT in the org.apache.catalina package. The source code I copied in my last message was the source code of the doGet() method for THIS servlet (outside the catalina package). And

Re: security and a servlet using core catalina classes

2001-05-09 Thread Craig R. McClanahan
On Wed, 9 May 2001, Craig R. McClanahan wrote: > Catalina only lets servets installed in > $CATALINA_HOME/servlet have this kind of access). > Oops, that's actually "$CATALINA_HOME/server". Craig

Re: security and a servlet using core catalina classes

2001-05-09 Thread Craig R. McClanahan
On 9 May 2001, Fabien Le Floc'h wrote: > Ok, this is possible to bypass the "security"! > > Catalina conforms to the behavior in the Servlet 2.3 PFD2 > Specification (Section 9.7.2) but does not comply with its > "recommended" behaviour. > Which "recommended" behavior are you concerned about

Re: security and a servlet using core catalina classes

2001-05-09 Thread Fabien Le Floc'h
Ok, this is possible to bypass the "security"! Catalina conforms to the behavior in the Servlet 2.3 PFD2 Specification (Section 9.7.2) but does not comply with its "recommended" behaviour. Here is the code (not clean, sorry about that) for the doGet method of an regular servlet: respo

Re: security and a servlet using core catalina classes

2001-05-09 Thread Craig R. McClanahan
On 9 May 2001, Fabien Le Floc'h wrote: > Thanks for your answer, > > I decided to put my servlet in the catalina hierarchy (on my personal > computer). When it will be more advanced, I could even propose it as a > contribution to catalina. > Any hints on what it actually does? > But I think