升级Tomcat版本 apache-tomcat-7.0.77
diff --git a/tomcat-uid/webapps/host-manager/WEB-INF/jsp/403.jsp b/tomcat-uid/webapps/host-manager/WEB-INF/jsp/403.jsp
index 569bd29..c87aeb1 100644
--- a/tomcat-uid/webapps/host-manager/WEB-INF/jsp/403.jsp
+++ b/tomcat-uid/webapps/host-manager/WEB-INF/jsp/403.jsp
@@ -14,6 +14,7 @@
See the License for the specific language governing permissions and
limitations under the License.
--%>
+<%@ page session="false" trimDirectiveWhitespaces="true" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
@@ -34,13 +35,13 @@
</p>
<p>
If you have already configured the Host Manager application to allow access
- and you have used your browser's back button, used a saved book-mark or
+ and you have used your browsers back button, used a saved book-mark or
similar then you may have triggered the cross-site request forgery (CSRF)
protection that has been enabled for the HTML interface of the Host Manager
- application. You will need to reset this protection by returning to the
+ application. You will need to reset this protection by returning to the
<a href="<%=request.getContextPath()%>/html">main Host Manager page</a>.
Once you return to this page, you will be able to continue using the Host
- Manager appliction's HTML interface normally. If you continue to see this
+ Manager application's HTML interface normally. If you continue to see this
access denied message, check that you have the necessary permissions to
access this application.
</p>
@@ -59,11 +60,10 @@
<user username="tomcat" password="s3cret" roles="admin-gui"/>
</pre>
<p>
- Note that for Tomcat 6.0.30 onwards, the roles required to use the host
- manager application were changed from the single <tt>admin</tt> role to the
+ Note that for Tomcat 7 onwards, the roles required to use the host manager
+ application were changed from the single <tt>admin</tt> role to the
following two roles. You will need to assign the role(s) required for
- the functionality you wish to access. Note the <tt>admin</tt> role is still
- valid but by-passes the CSRF protection.
+ the functionality you wish to access.
</p>
<ul>
<li><tt>admin-gui</tt> - allows access to the HTML GUI</li>
@@ -74,8 +74,6 @@
To maintain the CSRF protection:
</p>
<ul>
- <li>The deprecated <tt>admin</tt> role should not be assigned to any
- user.</li>
<li>Users with the <tt>admin-gui</tt> role should not be granted the
<tt>admin-script</tt> role.</li>
<li>If the text interface is accessed through a browser (e.g. for testing