Re: Security restrictions for Tomcat

2007-09-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Alla, alla winter wrote: > I am confused now > web.xml instructs Tomcat what application needs to be called for a given > MIME type Nope. This is mapping file extensions to MIME types. Totally different. Notice that you don't see "msword.exe" anywher

Re: Security restrictions for Tomcat

2007-09-26 Thread alla winter
> > > > Mitesh Shah > Hosted Services Engineer > eClinicalWorks LLC > > -Original Message- > From: alla winter [mailto:[EMAIL PROTECTED] > Sent: Wednesday, September 26, 2007 2:00 PM > To: Tomcat Users List; [EMAIL PROTECTED] > Subject: Re: Securi

RE: Security restrictions for Tomcat

2007-09-26 Thread Caldarale, Charles R
> From: alla winter [mailto:[EMAIL PROTECTED] > Subject: Re: Security restrictions for Tomcat > > I can see all the directory listing except WEB-INF directory. > I am using all default XMLs for configuration without any > changes, except web.xml were I defined my servlets.

RE: Security restrictions for Tomcat

2007-09-26 Thread Mitesh Shah
TED] Sent: Wednesday, September 26, 2007 2:00 PM To: Tomcat Users List; [EMAIL PROTECTED] Subject: Re: Security restrictions for Tomcat OK, I got it, the content type will do the trick. Thanks But I would appreciate if you answer on my second question regarding the directory listing I can see all the

Re: Security restrictions for Tomcat

2007-09-26 Thread alla winter
OK, I got it, the content type will do the trick. Thanks But I would appreciate if you answer on my second question regarding the directory listing I can see all the directory listing except WEB-INF directory. I am using all default XMLs for configuration without any changes, except web.xml were

Re: Security restrictions for Tomcat

2007-09-26 Thread Pid
alla winter wrote: > I am confused now > web.xml instructs Tomcat what application needs to be called for a given > MIME type No, unless you've got some weird setup on a windows machine Tomcat is not opening MSWord. The mime type is sent to the browser in an http header, and the browser decides w

Re: Security restrictions for Tomcat

2007-09-26 Thread alla winter
I am confused now web.xml instructs Tomcat what application needs to be called for a given MIME type for example: - rtf application/vnd.ms-word Tomcat pass the request to the third party application based on the MIME type, so if I show the link to the .RTF file and the user selects the l

Re: Security restrictions for Tomcat

2007-09-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Alla, alla winter wrote: > Thanks for the quick response. > So, I want to make sure that understand it right : you are proposing that > the servlet should display the file, instead of allowing Tomcat to invoke > Microsoft Word to disply the file cont

Re: Security restrictions for Tomcat

2007-09-26 Thread alla winter
Thanks for the quick response. So, I want to make sure that understand it right : you are proposing that the servlet should display the file, instead of allowing Tomcat to invoke Microsoft Word to disply the file content. The only issue with that is that the file is created in the RTF format and i

Re: Security restrictions for Tomcat

2007-09-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Alla, alla winter wrote: > I would appreciate if you would give me some hints how this dispatcher > servlet should work. How about this: 1. Check user id against requested path. a. Return FORBIDDEN for unauthorized access b. Open file and serve by

Re: Security restrictions for Tomcat

2007-09-26 Thread alla winter
I would appreciate if you would give me some hints how this dispatcher servlet should work. Also, what needs to be done to restrict Tomcat to list the directories that contain java script and images. thanks On 9/26/07, Mikolaj Rydzewski <[EMAIL PROTECTED]> wrote: > > alla winter wrote: > > My app

Re: Security restrictions for Tomcat

2007-09-25 Thread Mikolaj Rydzewski
alla winter wrote: My application can crate report on a fly ( a file) for an authorized clients. The client authentication is conducted by the application and Tomcat is not involved in this process. Other clients may create a file in the same directory, but the application will show the links

Security restrictions for Tomcat

2007-09-25 Thread alla winter
Hello, My application can crate report on a fly ( a file) for an authorized clients. The client authentication is conducted by the application and Tomcat is not involved in this process. Other clients may create a file in the same directory, but the application will show the links only to the f