HTTP Protocol + Auth BoF @ApacheCon Wed 9pm

2006-06-23 Thread William A. Rowe, Jr.
Communities, I believe this should be interesting to several participants of these three lists with respect to the HTTP protocol, associated protocols and the future direction of authentication. Lisa asked me to forward you all this invitation to the BoF, 9pm - 10pm Wed at ApacheCon this coming

Re: svn commit: r415549 - /tomcat/connectors/trunk/jni/native/src/network.c

2006-06-23 Thread William A. Rowe, Jr.
Mladen, maybe you aught to have deleted the @author tag while you were at it :) prakash shanmugam wrote: hello mturk i want to know how to store a *.doc file ,or *.pdf file in MYSQL database using JSP or SERVLET as a front end if you know the asnwer please reply me soon its very importa

Re: New Feature List

2006-06-23 Thread William A. Rowe, Jr.
prakash shanmugam wrote: hai if you can help me it will be a big relief for me now iam using tomcat 5.0 and linux as my server machine and the client machine are windows xp in my coding iam using JSP and SERVLETS. the problem is i want to store images and pdf files into mydatabase . the backend i

Ever wonder why you keep getting jk2 questions?

2006-07-07 Thread William A. Rowe, Jr.
Someone might want to review the 2nd to last paragraph here; http://www.apache.org/dist/tomcat/tomcat-5/v5.0.30/bin/ - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]

Re: svn commit: r420082 - /tomcat/connectors/trunk/jk/native/apache-2.0/mod_jk.c

2006-07-08 Thread William A. Rowe, Jr.
Folks, please DON'T work around APR problems without hollering at the [EMAIL PROTECTED] list! SVN is equally guilty. APR remains a piece of crap on some platforms until all these bizzare little edge cases are reported back to the project. The apr devs would thank you :) Bill [EMAIL PROTECTED]

Re: mod_jk 1.2.16 release candidate: ready to test

2006-07-08 Thread William A. Rowe, Jr.
Rainer Jung wrote: If no critical bugs will be found, we will have a formal release vote starting at Friday, July 7th. Out of curiousity, how is an existing bug a showstopper to releasing this 1.2.16 candidate? (The IBM platform quirk you just caught.) I'd like to see this keep moving unless

Re: mod_jk 1.2.16 test results

2006-07-08 Thread William A. Rowe, Jr.
Rainer Jung wrote: For the next feature release I will prepare the use of release candidates, because I think then the naming will look more familiar to users. You mean 1.2.16 three times over? Please don't... Version numbers are cheap :) Once the tag and roll is there, it's far less confus

Re: Next try: mod_jk 1.2.17 release candidate ready to test

2006-07-17 Thread William A. Rowe, Jr.
Mladen Turk wrote: Rainer Jung wrote: Hi Mladen, would you mind putting it on http://tomcat.apache.org/dev/dist/ first? Nope. There is no version/platform directory structure inside. Uhm - then create one? /dev/dist/ has the distinction of containing anything any RM wants to create. ww

Re: Next try: mod_jk 1.2.17 release candidate ready to test

2006-07-17 Thread William A. Rowe, Jr.
William A. Rowe, Jr. wrote: Mladen Turk wrote: Rainer Jung wrote: Hi Mladen, would you mind putting it on http://tomcat.apache.org/dev/dist/ first? Nope. There is no version/platform directory structure inside. Uhm - then create one? /dev/dist/ has the distinction of containing

Re: mod_jk premature documentation

2006-07-18 Thread William A. Rowe, Jr.
Rainer Jung wrote: I'll care about that, since it looks like I'll do 1.2.18 now. But I will only update documentation on tomcat.apache.org/dev. I'm really thinking about rolling back the premature publication of newer doc on tomcat.apache.org. I think, doc there should not be more recent, than

Re: SVN messages.

2006-07-20 Thread William A. Rowe, Jr.
Costin Manolache wrote: The svn messages are quite horrible IMO. Is there any way to suppress them in future ? Yes - it's really this project's fault that you didn't adopt the suggestion that dev@ discussion and commits@ notification don't belong on the same list ;-) And No - locking and unloc

Re: JK 1.2.18 isapi_redirect installer builds

2006-07-20 Thread William A. Rowe, Jr.
Mladen Turk wrote: Bill, IIRC you have one for building httpd? Any chance you create this build? I had mine IS 10, but the license was for my previous employer, so I'm unable to use it any more. I hate to do this, but I have to say no, until sometime next week; right now I'm swamped, and the

Re: svn commit: r423967 - /tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/CoyoteAdapter.java

2006-07-20 Thread William A. Rowe, Jr.
Guys, let me clarify, you are only paying attention to ';' following the QUERY_STRING delimiter '?', correct? ';' means nothing special before the '?', double check your interpretation of RFC 2616. I can have /foo.bar;bash?v1=a;v2=b (or ...?v1=a&v2=b) and that semi is part of the foo.bar;bash fi

Re: svn commit: r423967 - /tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/CoyoteAdapter.java

2006-07-20 Thread William A. Rowe, Jr.
Jean-frederic Clere wrote: William A. Rowe, Jr. wrote: Guys, let me clarify, you are only paying attention to ';' following the QUERY_STRING delimiter '?', correct? ';' means nothing special before the '?', double check your interpretation of RFC 2616.

Re: svn commit: r423967 - /tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/CoyoteAdapter.java

2006-07-20 Thread William A. Rowe, Jr.
Remy Maucherat wrote: William A. Rowe, Jr. wrote: Guys, let me clarify, you are only paying attention to ';' following the QUERY_STRING delimiter '?', correct? ';' means nothing special before the '?', double check your interpretation of RFC 2616.

Re: svn commit: r423967 - /tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/CoyoteAdapter.java

2006-07-21 Thread William A. Rowe, Jr.
Jean-frederic Clere wrote: Returning to my example: JkMount /*.jsp worker1 http://localhost/;jsp-examples/jsp2/;simpletag/;hello.jsp .jsp-examples simpletag and hello.jsp are parameters. (According to the 3.3 of the ref). So the mapping is //jsp2// -> no worker. I would concur... http://l

Re: svn commit: r423967 - /tomcat/tc6.0.x/trunk/java/org/apache/catalina/connector/CoyoteAdapter.java

2006-07-21 Thread William A. Rowe, Jr.
Remy Maucherat wrote: Jean-frederic Clere wrote: Comments? Another tactic is to give up, and return an error code of some sort in Tomcat if the URL contains a path parameter (since they are not part of the path, are not handled properly, and have no useful usage at the moment). +1 - this

Re: JK 1.2.18 isapi_redirect installer builds

2006-07-22 Thread William A. Rowe, Jr.
Mladen Turk wrote: Trent Nelson wrote: Mladen Turk wrote: Just out of interest, is there any motivation to switch to Nullsoft's Installer for future mod_jk/isapi_redirect releases? Given that tomcat's win32 installer uses this, and it's free, I would think that would be a better option than I

Re: JK 1.2.18 isapi_redirect installer builds

2006-07-22 Thread William A. Rowe, Jr.
Mladen Turk wrote: William A. Rowe, Jr. wrote: Mladen Turk wrote: Nullsoft lacks advanced IIS virtual directory creation/deletion. I suppose it can be done with multiple .vbs scripts. EWWW - no :) They are keys. No, they are not. Neither are filters :) Not what I ment. Found

Re: [Fwd: Re: svn commit: r426711 - in /apr/apr-util/trunk: include/apr_uri.h uri/apr_uri.c]

2006-07-31 Thread William A. Rowe, Jr.
Jean-frederic Clere wrote: > > What I want to do is just to register port 8009 for AJP protocol. Not to > register the whole protocol ;-) If you followed the thread on [EMAIL PROTECTED], the point was raised that it's very difficult to get your registration accepted when your port selection alre

Re: I am unable to unsubscribe

2006-08-10 Thread William A. Rowe, Jr.
Blame your provider; we've finally determined that hotmail is eating your unsubscribe requests - this is specific to hotmail accounts and you are far from the only one experiencing this problem. In any case you've been unsubscribed and should receive only one copy of this note. The current thinki

stale RELEASE-NOTES commentary

2006-08-23 Thread William A. Rowe, Jr.
...at least in 4.1.31... GLIBC 2.2 / Linux 2.4 users should also define an environment variable: export LD_ASSUME_KERNEL=2.2.5 Additionally, Redhat 9.0 users should use the same setting, to avoid stability problems. This is really, really horrific advice. A comment to for the user to fo

Re: stale RELEASE-NOTES commentary

2006-08-23 Thread William A. Rowe, Jr.
Yoav Shapira wrote: > Hi, > It's not only in the 4.1.31 release, it's even in the latest stable > 5.5.17. Let's change it in the next releases of 4.x and 5.x, starting > with 5.5.18 which should happen any day now. > > I think the advice was decent (and based on empirical evidence IIRC) > when or

Re: parameters in URL path segments

2006-08-23 Thread William A. Rowe, Jr.
James Berry wrote: > > My response is that the tomcat should be completely blind to > "parameters". Basically, to Tomcat's perspective, they don't exist. > There is nothing any more special about "this;biz=bar" than > "this,biz=bar" or "this-biz-bar". But, of course, your access control does call

Re: parameters in URL path segments

2006-08-23 Thread William A. Rowe, Jr.
James Berry wrote: > >> Because Tomcat and Apache are blind to parameters, the connector -should- >> reject them. When Tomcat/Apache are able to treat your "this;biz=bar" >> example the same as "this" for the purpose of access control, then they >> can be enabled in an opaque manner that lets the

Re: parameters in URL path segments

2006-08-23 Thread William A. Rowe, Jr.
James Berry wrote: > > On Aug 23, 2006, at 2:40 PM, William A. Rowe, Jr. wrote: > >> James Berry wrote: >>> >>> So maybe this is the crux of it. Why/where is it that "this;biz=bar" >>> cannot be treated the same for the purposes of access con

Re: Tomcat 5.5.18-beta preview

2006-08-29 Thread William A. Rowe, Jr.
Jason Brittain wrote: > > Then, later, I needed Java 1.5.x features, so I upgraded it to > Sun Java 1.5.0. At the time that I upgraded just the JDK, I > knew very well that I have LD_ASSUME_KERNEL set, but I > since I didn't upgrade the OS (same kernel & libs) I left that > setting alone to see i

Re: mod_jk.dsp in unix format

2006-09-02 Thread William A. Rowe, Jr.
Alpha Huang wrote: > It has been a long time that mod_jk.dsp has unix line endings (LF) instead of > win32's CRLF. > > I have to fix it every time when I use msdev to build it. > > Although many text editors could fix the format, why don't someone clean it > before upload it as "win32 source"? Y

Re: mod_jk 1.2.19 release candidate: ready to test

2006-09-18 Thread William A. Rowe, Jr.
Mladen Turk wrote: > > The binaries are at: > http://www.apache.org/dist/tomcat/tomcat-connectors/jk/binaries/win32/jk-1.2.19/ > > http://www.apache.org/dist/tomcat/tomcat-connectors/jk/binaries/win64/jk-1.2.19/ > > > Note: > Do not use Apache 1.3.37 binaries > from http://hunter.campbus.com/ >

Re: Progress towards mod_jk 1.2.33

2011-10-28 Thread William A. Rowe Jr.
On 10/27/2011 1:10 PM, Mladen Truk wrote: > On 10/27/2011 07:45 PM, Rainer Jung wrote: >>> >>> BTW, I plan to support IIS on XP+ which means >>> dropping anything bellow IIS5.1 >> >> I'm OK with dropping support for IIS up until 5.0, e.g. up until Win >> 2000 including if that's what you plan. Star

Re: Progress towards mod_jk 1.2.33

2011-10-28 Thread William A. Rowe Jr.
On 10/27/2011 1:10 PM, Mladen Truk wrote: > On 10/27/2011 07:45 PM, Rainer Jung wrote: >>> >>> BTW, I plan to support IIS on XP+ which means >>> dropping anything bellow IIS5.1 >> >> I'm OK with dropping support for IIS up until 5.0, e.g. up until Win >> 2000 including if that's what you plan. Star

Re: Progress towards mod_jk 1.2.33

2011-10-28 Thread William A. Rowe Jr.
On 10/28/2011 2:28 AM, Mark Thomas wrote: > On 28/10/2011 08:15, William A. Rowe Jr. wrote: >> On 10/27/2011 1:10 PM, Mladen Truk wrote: >>> On 10/27/2011 07:45 PM, Rainer Jung wrote: >>>>> >>>>> BTW, I plan to support IIS on XP+ which means >&g

Re: svn commit: r1195363 - /tomcat/jk/trunk/native/iis/pcre/pcre.amd64

2011-10-31 Thread William A. Rowe Jr.
On 10/31/2011 2:37 AM, mt...@apache.org wrote: > --- tomcat/jk/trunk/native/iis/pcre/pcre.amd64 (original) > +++ tomcat/jk/trunk/native/iis/pcre/pcre.amd64 Mon Oct 31 07:37:07 2011 > @@ -66,7 +66,7 @@ LIB32_OBJS= \ >$(LIB32_FLAGS) $(DEF_FLAGS) $(LIB32_OBJS) > << > > -CPP_PROJ=-nologo -MD -W3

Re: svn commit: r1202058 - in /tomcat/trunk/bin: catalina.bat catalina.sh configtest.sh digest.sh setclasspath.bat setclasspath.sh shutdown.sh startup.sh version.sh

2011-11-14 Thread William A. Rowe Jr.
On 11/15/2011 12:37 AM, mt...@apache.org wrote: Author: mturk Date: Tue Nov 15 06:37:12 2011 New Revision: 1202058 URL: http://svn.apache.org/viewvc?rev=1202058&view=rev Log: Make sure .bat and .sh files have executable property set This could be a silly point, but .bat files do not carry a sh

Re: svn commit: r1183612 [2/2] - /tomcat/trunk/java/org/apache/catalina/startup/ContextConfig.java

2012-01-17 Thread William A. Rowe Jr.
On 1/13/2012 8:30 PM, Brian Burch wrote: > On 14/01/12 09:45, Filip Hanik - Dev Lists wrote: >> No grudge held :) >> I'm just bringing it up since very many files have been reformatted for >> the sake of formatting. And when tracing down a problem, I, and I >> suspect others too, often use SVN hist

Re: Updated procrun binaries

2009-06-12 Thread William A. Rowe, Jr.
Mladen Turk wrote: > Konstantin Kolinko wrote: >>> so -win32-x86-native, -win32-x64 and -win32-ia64 would make perfect sense. >>> Fine with me. >>> >> >> "32" in "-win32-x64" looks odd. >> > > Right win64-x64 would make more sense. Irrelevant. There is no win64, but there could be

Re: [PROPOSAL] Remove SVN keywords from JavaDoc

2009-07-06 Thread William A. Rowe, Jr.
Rainer Jung wrote: > > So I like the idea of using Id, but I am open to arguments for dropping it. In httpd, we use; in the reference file, and the tag which is updated in order to determine how far out of sync translations have fallen. So there is one argument for at least one embedded svn pr

Re: [Tomcat Wiki] Update of "TomcatTrackUs09" by JeanFredericClere

2009-07-09 Thread William A. Rowe, Jr.
> The following page has been changed by JeanFredericClere: > http://wiki.apache.org/tomcat/TomcatTrackUs09 FYI - I'm having problems groking this, so I presume the general public will have the same trouble... > Track Description > > + This track will give you all you need to know about the

Re: [Tomcat Wiki] Update of "TomcatTrackUs09" by JeanFredericClere

2009-07-09 Thread William A. Rowe, Jr.
Mladen Turk wrote: > William A. Rowe, Jr. wrote: >> >> You have three groups, "general users", "Tomcat users", and "Tomcat >> Admins". >> I understand the second two, and have no clue what you mean by >> "general" :) >

Re: Notice : No more IBM support JK/Tomcat on i5/OS V6R1

2009-08-04 Thread William A. Rowe, Jr.
Henri Gomez wrote: > The question here is : > > Why did we use unixd_set_global_mutex_perms/ap_unixd_set_global_mutex_perms > since both call didn't exist in i5/OS V6R1 and I had to set > JK_NEED_SET_MUTEX_PERMS to 0 to have them excluded. Because otherwise, root created file locking objects are

Re: Bug workflow

2009-09-17 Thread William A. Rowe, Jr.
Uwe Günther wrote: > So I wasn't so wrong with the first one. Unfortunately there was nothing > to code at all. > > So I am gonna go for some odd ones and go on with the good things to do. > > How does this work for non commiters; if they have a patch? Ok, 1st > attach the patch to the bug, 2nd..

Re: KEYS files

2009-11-23 Thread William A. Rowe Jr.
jean-frederic clere wrote: > Hi, > > It seems there is a bunch of KEYS file in the > https://svn.apache.org/repos/asf/tomcat and in the web site. > > Should we only have one of those? http://www.apache.org/dist/tomcat/KEYS is really all you need or even want to maintain. ---

Re: [PATCH]: X-Forwarded-For support

2009-12-12 Thread William A. Rowe Jr.
Brane F. Gračnar wrote: > Hello :) > > This patch adds support for X-Forwarded-For (or any other) http request > header > holding ip address of real client so that request.getRemoteAddr() return > correct address if tomcat is running behind apache or any other reverse http > proxy. Note you c

Re: New connector sandbox

2011-04-27 Thread William A. Rowe Jr.
On 4/27/2011 1:53 AM, Henri Gomez wrote: > Now that HTTP connector is as fast as AJP connector, is it still required ? > > Ie, is there any mod_proxy for IIS ? You mean... http://blogs.msdn.com/b/carlosag/archive/2010/04/02/setting-up-a-reverse-proxy-using-iis-url-rewrite-and-arr.aspx ? --

Re: [PROPOSAL] Move to svnpubsub for /dist/tomcat

2011-05-18 Thread William A. Rowe Jr.
On 5/18/2011 9:22 AM, Mark Thomas wrote: > On 18/05/2011 15:06, Konstantin Kolinko wrote: >> 2011/5/18 Mark Thomas : >>> All, >>> >>> We have the option to move to svnpubsub for managing our releases. >>> Rather than copying artefacts to people.a.o and then waiting for rsync >>> (every around 2 hou

Re: [VOTE] Release Apache Tomcat Native 1.1.21

2011-07-28 Thread William A. Rowe Jr.
On 7/27/2011 1:16 PM, jean-frederic clere wrote: > > Well does it make sense to vote for a binary? IMHO, not as a 'release vote'. Testing it, is great, but testing isn't the purpose of release voting. Mladen attests he's compiled from the asf source, then the binary corresponds to the ASF relea

Re: Is Tomcat5.0 FIPS compliant?

2008-01-14 Thread William A. Rowe, Jr.
robingandhi21 wrote: Info regarding FIPS is:The Federal Information Processing Standard 140-1 (FIPS 140-1) and its successor FIPS 140-2 are United States Government standards that provide a benchmark for implementing cryptographic software. They specify best practices for implementing crypto alg

Re: Native 1.1.12 release

2008-01-14 Thread William A. Rowe, Jr.
Mladen Turk wrote: OK if you insist. The *Foundation* insists ;-) I suppose we can then use the src tarball from the heanet.ie site (used by the installer BTW) instead dist site. Or you can remove the file to /dev/dist/, and hold a release vote already? > Or we can have it inside > http:/

Re: Native 1.1.12 release

2008-01-14 Thread William A. Rowe, Jr.
Mladen Turk wrote: Because it's native and the one that makes a release needs some extra prerequisites to build it. Part of this confusion is that projects never vote on binary artifacts, they vote on source code releases. Because the sources land in tags/ and a tarball, I'd strongly consider

Re: DOS-Lineends in many files contained in distribution tar.gz

2008-01-25 Thread William A. Rowe, Jr.
Rainer Jung wrote: - cleanup and prepare for each of the targets underneath or "release". Either way, since in the source tgz target there is already an exclude list, I would prefer to update that exclude list and use the same one whereever possible, so something like: FYI - this is all ove

Re: Reorder the http header generated by tomcat

2008-03-05 Thread William A. Rowe, Jr.
Jim Jagielski wrote: Requiring any specific order on HTTP response headers is completely bogus... :) To elaborate on why Jim thinks so (and we all agree)... - it's not spec. You cannot rely on this when authoring a user agent. - proxies can and will reorder whatever pretty order you assign

Re: tomcat native 1.1.13 for win32

2008-03-12 Thread William A. Rowe, Jr.
Mark Thomas wrote: Henri Gomez wrote: Hi to all, I used to get the win32 tcnative at http://tomcat.heanet.ie/native/ but there is only a 1.1.12 there. Do you know alternate location ? Nothing I am aware of. That is where they are currently uploaded to. Also, shouldn't we provide such win32/

Re: Cookie standards

2008-03-18 Thread William A. Rowe, Jr.
The standard is only 7 1/2 years old; http://www.ietf.org/rfc/rfc2965 Jim Manico wrote: According to Daniel Stenberg, Cookies are not even *mentioned* in RFC2616 Per http://lists.w3.org/Archives/Public/ietf-http-wg/2008JanMar/0623.html "On Tue, 18 Mar 2008, Jim Manico wrote: > Are there any

[Fwd: svn commit: r646229 - in /httpd/mod_ftp/trunk/modules/ftp: ftp_connection.c ftp_protocol.c]

2008-04-22 Thread William A. Rowe, Jr.
Although it's a little goofy to f/w this to the tomcat list, it seems this might clear up your fluxored mod_jk test ;-) --- Begin Message --- Author: wrowe Date: Wed Apr 9 01:48:19 2008 New Revision: 646229 URL: http://svn.apache.org/viewvc?rev=646229&view=rev Log: Per httpd/trunk r440337 - "Rep

Re: [Fwd: svn commit: r646229 - in /httpd/mod_ftp/trunk/modules/ftp: ftp_connection.c ftp_protocol.c]

2008-04-22 Thread William A. Rowe, Jr.
Rainer Jung wrote: Hi Bill, thanks for this. The problem though is not with the test, but if your compilation environment does not match your runtime environment. In Henri's case, and also in the case where we provide binaries, the build environment contains a newer version of 2.2.x httpd hea

Re: [Fwd: svn commit: r646229 - in /httpd/mod_ftp/trunk/modules/ftp: ftp_connection.c ftp_protocol.c]

2008-04-22 Thread William A. Rowe, Jr.
Rainer Jung wrote: Hmmm, I'm talking only about 2.2. The function ap_get_server_banner() has been added between 2.2.3 and 2.2.4 with an associated minor MMN bump. So any module build against 2.2.4 using ap_get_server_banner() shielded by AP_MODULE_MAGIC_AT_LEAST(20051115,4) will not load into

Re: svn commit: r667604 - /tomcat/trunk/java/org/apache/catalina/session/StandardSession.java

2008-06-13 Thread William A. Rowe, Jr.
Tim Funk wrote: Since there was never a release from trunk - there really isn't a change log. When trunk is released as a new branch it should have a RELEASE-NOTES which highlight why its a different branch but maintaining change log for an unreleased version doesn't make much sense to me. Hm

Re: svn commit: r680102 - /tomcat/site/trunk/docs/doap_Tomcat.rdf

2008-07-27 Thread William A. Rowe, Jr.
Mark Thomas wrote: [EMAIL PROTECTED] wrote: Author: markt Date: Sun Jul 27 06:33:31 2008 New Revision: 680102 URL: http://svn.apache.org/viewvc?rev=680102&view=rev Log: Fix RDF as per report on users list This is now fixed but the data is horribly out of date? Does anyone care about this fil

Re: svn commit: r680102 - /tomcat/site/trunk/docs/doap_Tomcat.rdf

2008-07-27 Thread William A. Rowe, Jr.
William A. Rowe, Jr. wrote: Mark Thomas wrote: [EMAIL PROTECTED] wrote: Author: markt Date: Sun Jul 27 06:33:31 2008 New Revision: 680102 URL: http://svn.apache.org/viewvc?rev=680102&view=rev Log: Fix RDF as per report on users list This is now fixed but the data is horribly out of

Re: svn commit: r680102 - /tomcat/site/trunk/docs/doap_Tomcat.rdf

2008-07-27 Thread William A. Rowe, Jr.
Mark Thomas wrote: [EMAIL PROTECTED] wrote: Author: markt Date: Sun Jul 27 06:33:31 2008 New Revision: 680102 URL: http://svn.apache.org/viewvc?rev=680102&view=rev Log: Fix RDF as per report on users list This is now fixed but the data is horribly out of date? Does anyone care about this fil

Re: [CVE-2008-2370] Apache Tomcat information disclosure vulnerability

2008-08-01 Thread William A. Rowe, Jr.
Mark Thomas wrote: Description: When using a RequestDispatcher the target path was normalised before the query string was removed. A request that included a specially crafted request parameter could be used to access content that would otherwise be protected by a security constraint or by locati

Re: [CVE-2008-2370] Apache Tomcat information disclosure vulnerability

2008-08-02 Thread William A. Rowe, Jr.
Mark Thomas wrote: What mitigations are you thinking of? The description is intended to be sufficient for a user to determine if they match the vulnerability conditions. And this for this notice I believe it meets this criteria. In this case there is no way of configuring yourself away from

Re: Exploiting Tomcat

2008-08-13 Thread William A. Rowe, Jr.
Jim Manico wrote: This is a worthwhile post to read regarding path traversal attacks against tomcat. http://www.0x00.com/?i=630 Worthwhile? To note the community frustration against Tomcat parsers? Must be what you meant since the author adds nothing. New information is always welcome.

Re: svn commit: r685838 - in /tomcat/site/trunk: docs/security.html xdocs/security.xml

2008-08-14 Thread William A. Rowe, Jr.
I love the way you phrased this, httpd should steal this for our site :) Bill [EMAIL PROTECTED] wrote: Author: markt Date: Thu Aug 14 03:07:25 2008 New Revision: 685838 URL: http://svn.apache.org/viewvc?rev=685838&view=rev Log: Make purpose of security mailing list even clearer. Could now just

Re: svn commit: r685981 - /tomcat/trunk/java/org/apache/tomcat/util/net/jsse/JSSESocketFactory.java

2008-08-14 Thread William A. Rowe, Jr.
[EMAIL PROTECTED] wrote: Author: markt Date: Thu Aug 14 11:11:28 2008 New Revision: 685981 FYI, I've updated asf-mailer so it no longer directs commit traffic to the long-dead [EMAIL PROTECTED] Which means starting at this commit, you may have to adjust your filters. But reply-to-all should n

Re: [VOTE] Release build 5.5.27

2008-09-03 Thread William A. Rowe, Jr.
George Sexton wrote: I guess I'm not understanding how you use the term regression. 5.5.25 for sure did not have this problem. 5.5.26 introduced it, and 5.5.27 has it. How do you mean regression? x.y.-1 was free of it and x.y.-0 demonstrated it. This is x.y.-2 is free of it, x.y.-1 demons

Re: svn commit: r697779 - in /tomcat/connectors/trunk/jk: native/common/jk_lb_worker.c native/common/jk_lb_worker.h native/common/jk_shm.h native/common/jk_util.c native/common/jk_util.h xdocs/miscel

2008-09-23 Thread William A. Rowe, Jr.
Tim Whittington wrote: > The bizarre thing is it seems to have built without issue on Linux, HP-UX > (two archs) and AIX/Power. That undefined symbols thing is windows specific, most unix compilers building a lib or module won't complain, so your observation is perfectly normal. But getting this

Re: UTF-8 POST request results in corrupted data

2008-10-06 Thread William A. Rowe, Jr.
Andre-John Mas wrote: > Just to repeat what I stated in the ticket: > > The problem I have with the suggested approach is that it treats UTF-8 > as an > exception, rather that a norm for my whole application server. I am not > sure > that I should be having to be specifying the encoding before han

AC/US /security/ related talk need (2 weeks from yesterday)

2008-10-23 Thread William A. Rowe, Jr.
Hello Experts, the AC/US planning team has a 1hr gap in the program, of the "Security" topic track 1 on Thursday 6 November. http://us.apachecon.com/c/acus2008/schedule/2008/11/06 Please get back to me ASAP if you have (or would like to create) a session that hits one or more of the bullets belo

Re: svn commit: r714246 - /tomcat/trunk/KEYS

2008-11-16 Thread William A. Rowe, Jr.
[EMAIL PROTECTED] wrote: > Author: markt > Date: Sat Nov 15 04:59:01 2008 > New Revision: 714246 > > URL: http://svn.apache.org/viewvc?rev=714246&view=rev > Log: > Update KEYS with changes from 6.0.x (Remy updated his key) > -pub 1024D/41E49465 2006-11-08 > - Key fingerprint = 80FF 76D8 8A

Re: [RESULT] [VOTE] Releasing Apache Tomcat Native 1.1.16

2008-11-17 Thread William A. Rowe, Jr.
Mladen Turk wrote: > Mladen Turk wrote: >> Mladen Turk wrote: >> > Hello to the Tomcat team, >> > >> > Native 1.1.16 has been available for testing for almost a week, >> > so I would like to proceed with the release vote. >> > >> >> So far only one binding vote has been recorded >> (Thanks Hen

Re: tcnative API stability/compatibility

2009-01-02 Thread William A. Rowe, Jr.
Mark Thomas wrote: > Rainer Jung wrote: >> Hi, >> >> we now have tcnative 1.1.x and trunk. What's our goal w.r.t. API stability? > > My understanding was that trunk was created to introduce APR 1.3 and > that the result would be tcnative 1.2.x. APR 1.3 is abi compatible to 1.2 - although you famo

Re: Why are manager session tokens generated with MD5 by default?

2009-01-05 Thread William A. Rowe, Jr.
Mark Thomas wrote: > Filip Hanik - Dev Lists wrote: >> you don't need to lobby, simply create a patch in Bugzilla > > Although it is likely to get ignored / end up as WONTFIX. I don't see > what the security issue is here. How does an MD5 collisions affect the > security of the session ID? The on

Re: [Proposal] Branching JK

2009-03-25 Thread William A. Rowe, Jr.
Mladen Turk wrote: The problem with mod_proxy and mod_cluster is the fact they are targeted for a *single* web server (httpd) Which varies from a one off poorly defined protocol how, exactly? They don't have the generic web server API like mod_jk does, and all of them doesn't support async b

drop mod_jk?

2009-03-25 Thread William A. Rowe, Jr.
If there's a desire to move ahead with a new connector at the tomcat project, and the branch/release approach is planned to yield stable code that will improve from release to release, why even retain the association to 'jk'? It seems it would benefit the effort if stable code was released with a

Re: drop mod_jk?

2009-03-25 Thread William A. Rowe, Jr.
Henri Gomez wrote: mod_jk is not a 'regular' Apache HTTPd module, since it could be used with IIS, Domino, iPlanet and got JNI support. Of course I understand all that. But why call it after 'jakarta'? My point is that tomcat/7.0/connectors could use a fresh new name. --

Re: [Proposal] Remove older of the two BIO AJP connectors

2009-04-02 Thread William A. Rowe, Jr.
Henri Gomez wrote: > > If i recall the tomcat story (10 years). > Today > > Sun has it's own implementation, Grizzly. > Jboss forked tc code in it's own implémentation for AS. > Spring Source embed it in it's DM server. It's disturbing that you fail to mention Geronimo altogether. If we can't h

Re: Any way to fix bug 46950 without a change to tcnative?

2009-04-15 Thread William A. Rowe, Jr.
Mark Thomas wrote: > Folks, > > I have been looking at bug 46950 [1]. Everything is fine with the BIO > connector but with APR the renegotiation fails to trigger a request for > the user's certificate. I assume that this is because the socket is > still associated with an SSLContext where the SSLV

Re: Any way to fix bug 46950 without a change to tcnative?

2009-04-15 Thread William A. Rowe, Jr.
William A. Rowe, Jr. wrote: > Mark Thomas wrote: >> Folks, >> >> I have been looking at bug 46950 [1]. Everything is fine with the BIO >> connector but with APR the renegotiation fails to trigger a request for >> the user's certificate. I assume that

Re: svn commit: r777247 - /tomcat/tc6.0.x/trunk/java/org/apache/catalina/tribes/group/interceptors/SimpleCoordinator.java

2009-05-21 Thread William A. Rowe, Jr.
Filip Hanik - Dev Lists wrote: > sebb wrote: >> There's also a suggested set on the Apache site, see: >> >> http://www.apache.org/dev/version-control.html#https-svn-config >> > that's exactly my point, everytime I just onto a new machine, and I > forget, which I'm bound to do, to set the config

Re: svn commit: r779047 - /tomcat/trunk/bin/service.bat

2009-05-27 Thread William A. Rowe, Jr.
mt...@apache.org wrote: > +runas /env /savecred /user:%SERVICE_USER% "%COMSPEC% /K \"%SELF%\" > %SERVICE_CMD% %SERVICE_NAME%" review your cmd.exe syntax. cmd /k is wrong here, that's to persist a shell. You meant /c I suspect. ---

Re: Updated procrun binaries

2009-05-29 Thread William A. Rowe, Jr.
Mladen Turk wrote: > Nevertheless, how about creating separate .zips that > would contain tomcat(X)w.exe tomcat(X).exe service.bat > and tcnative-1.dll > eg. > apache-tomcat-6.0.21-win32-native.zip > apache-tomcat-6.0.21-win64-native.zip > apache-tomcat-6.0.21-win64-ia64-native.zip ia64 != x64, y

Re: Closing Jakarta mailing lists: servletapi-dev and watchdog-dev

2010-05-29 Thread William A. Rowe Jr.
On 5/29/2010 8:56 AM, Rahul Akolkar wrote: > As indicated below, I will now be requesting infra close these lists > with qmail forwards to d...@tomcat. I've found, in managing a host of httpd and apr related lists, that sending a final closure message, verifying all *.apache.org references to the

Re: [PROPOSAL] Change the name of the default host in server.xml

2010-07-15 Thread William A. Rowe Jr.
On 7/15/2010 9:44 PM, Yoav Shapira wrote: > On Thu, Jul 15, 2010 at 8:51 AM, Mark Thomas wrote: >> I'm teaching a Tomcat course today and tomorrow and one of the students >> raised the question why is the default host called localhost? The implied >> relationship to 127.0.0.1 was causing confusion

Re: svn commit: r988409 - /tomcat/native/trunk/native/build/tcnative.m4

2010-08-24 Thread William A. Rowe Jr.
On 8/24/2010 3:48 AM, Remy Maucherat wrote: > > I don't remember, but I guess I changed my mind then. Real world usage > difficulties mean it is very hard to require something newer than APR > 1.3. Nonsense, httpd 2.4 (now in beta as 2.3.6) requires APR. Forward looking releases, e.g. those in t

Proposed .dsp and source change to jk for apache 2.0

2010-09-08 Thread William A. Rowe Jr.
It seems I've been lax in committing anything in recent memory, and had my commit privileges for the jk module suspended :) But wanted to pass on these very small proposals; * mod_jk.dsp should have referred to a project 'named' mod_jk, the 'project name' should generally match the name of th

Re: Proposed .dsp and source change to jk for apache 2.0

2010-09-08 Thread William A. Rowe Jr.
On 9/8/2010 12:04 PM, Mladen Turk wrote: > On 09/08/2010 06:51 PM, William A. Rowe Jr. wrote: >> It seems I've been lax in committing anything in recent memory, and had my >> commit privileges for the jk module suspended :) But wanted to pass on these >> very small pro

Re: Proposed .dsp and source change to jk for apache 2.0

2010-09-08 Thread William A. Rowe Jr.
On 9/8/2010 12:57 PM, Rainer Jung wrote: > > +1 to everything you suggested to change. If you improve the dsps, you might > want to take > a look at > > https://issues.apache.org/bugzilla/show_bug.cgi?id=43303 Yea, I'm happy to add .rc's (VERSION resources) to the binaries, should be straightfo

Re: svn commit: r995901 - /tomcat/jk/trunk/native/common/portable.h

2010-09-10 Thread William A. Rowe Jr.
On 9/10/2010 12:48 PM, mt...@apache.org wrote: > Author: mturk > Date: Fri Sep 10 17:48:15 2010 > New Revision: 995901 > > URL: http://svn.apache.org/viewvc?rev=995901&view=rev > Log: > Oops. We should really do something with that portable.h svn rm it. The make files need simple cat portable.h.i

Re: svn commit: r995901 - /tomcat/jk/trunk/native/common/portable.h

2010-09-11 Thread William A. Rowe Jr.
On 9/11/2010 12:23 AM, Mladen Turk wrote: > On 09/10/2010 08:06 PM, William A. Rowe Jr. wrote: >> On 9/10/2010 12:48 PM, mt...@apache.org wrote: >>> Author: mturk >>> Date: Fri Sep 10 17:48:15 2010 >>> New Revision: 995901 >>> >>> URL: ht

Re: [ANN] Apache Tomcat Connectors 1.2.30 released

2010-09-13 Thread William A. Rowe Jr.
On 3/1/2010 4:45 AM, Mladen Turk wrote: > The Apache Tomcat team announces the immediate availability of > Apache Tomcat Connectors 1.2.30 stable. With this release, following the retirement of httpd-1.3 from all maintenance, would this be a good time to declare this the final native/apache-1.3/ c

Re: [ANN] Apache Tomcat Connectors 1.2.30 released

2010-09-13 Thread William A. Rowe Jr.
On 9/13/2010 4:15 PM, William A. Rowe Jr. wrote: > On 3/1/2010 4:45 AM, Mladen Turk wrote: >> The Apache Tomcat team announces the immediate availability of >> Apache Tomcat Connectors 1.2.30 stable. > > With this release, following the retirement of httpd-1.3 from all main

Re: [ANN] Apache Tomcat Connectors 1.2.30 released

2010-09-13 Thread William A. Rowe Jr.
On 9/13/2010 4:38 PM, Rainer Jung wrote: > > I don't have any problem of freezing the 1.3 support concerning features and > minor bugs, > but I find it a bit surprising for users to suddenly stop supporting 1.3. In > my opinion we > should still do security fixes when needed and critical bugs. M

Re: [ANN] Apache Tomcat Connectors 1.2.30 released

2010-09-13 Thread William A. Rowe Jr.
On 9/13/2010 6:11 PM, Tim Whittington wrote: > I agree with this approach. > > I'd like to get a 1.2.31 release out sometime to release the ISAPI > Redirector log rotation though, before we start on 1.3. Just to make sure there is no confusion, I'm speaking of dropping apache-1.3, prior to 1.2.31

Re: Proposed .dsp and source change to jk for apache 2.0

2010-09-14 Thread William A. Rowe Jr.
On 9/11/2010 5:03 PM, Tim Whittington wrote: > +1 from me. > > I've been maintaining my own VS 2003 (and now 2005) solution for a while now > with Apache 2.0/2.2 projects. Once this is committed, you should be able to load the .dsp into vs.net thru vs 2010 and convert with minimal issues. -

Re: Proposed .dsp and source change to jk for apache 2.0

2010-09-14 Thread William A. Rowe Jr.
On 9/8/2010 12:57 PM, Rainer Jung wrote: > > +1 to everything you suggested to change. If you improve the dsps, you might > want to take > a look at > > https://issues.apache.org/bugzilla/show_bug.cgi?id=43303 Just worked though jk.rc and it was fairly straight forward, just adding a JK_DLL_SUF

Re: [ANN] Apache Tomcat Connectors 1.2.30 released

2010-09-14 Thread William A. Rowe Jr.
On 9/13/2010 4:15 PM, William A. Rowe Jr. wrote: > On 3/1/2010 4:45 AM, Mladen Turk wrote: >> The Apache Tomcat team announces the immediate availability of >> Apache Tomcat Connectors 1.2.30 stable. > > With this release, following the retirement of httpd-1.3 from all main

Re: svn commit: r996836 - in /tomcat/jk/trunk/native: apache-2.0/mod_jk.c apache-2.0/mod_jk.dsp iis/Makefile.amd64 iis/Makefile.ia64 iis/Makefile.x86 iis/isapi.dsp

2010-09-14 Thread William A. Rowe Jr.
On 9/14/2010 6:00 AM, wr...@apache.org wrote: > Author: wrowe > Date: Tue Sep 14 11:00:40 2010 > New Revision: 996836 > > URL: http://svn.apache.org/viewvc?rev=996836&view=rev > Log: > Identify JK_ISAPI for jk_version.h PACKAGE definition > > Modified: > tomcat/jk/trunk/native/iis/Makefile.am

Re: svn commit: r996836 - in /tomcat/jk/trunk/native: apache-2.0/mod_jk.c apache-2.0/mod_jk.dsp iis/Makefile.amd64 iis/Makefile.ia64 iis/Makefile.x86 iis/isapi.dsp

2010-09-14 Thread William A. Rowe Jr.
On 9/14/2010 10:10 AM, Mladen Turk wrote: > > A little bit messy for RM to rename the files once when created, > but allows to limit the number of directories. Certainly easier than trying to wring out the version-decorated file names straight from the build system :) I'll take a look at other d

Re: [ANN] Apache Tomcat Connectors 1.2.30 released

2010-09-15 Thread William A. Rowe Jr.
On 9/14/2010 5:48 PM, Rainer Jung wrote: > On 14.09.2010 01:14, William A. Rowe Jr. wrote: >> On 9/13/2010 6:11 PM, Tim Whittington wrote: >>> I agree with this approach. >>> >>> I'd like to get a 1.2.31 release out sometime to release the ISAPI >>&g

<    1   2   3   >