升级Tomcat版本 apache-tomcat-7.0.77
diff --git a/tomcat-uidm/webapps/manager/WEB-INF/web.xml b/tomcat-uidm/webapps/manager/WEB-INF/web.xml
index 3d7fefe..4dd97ce 100644
--- a/tomcat-uidm/webapps/manager/WEB-INF/web.xml
+++ b/tomcat-uidm/webapps/manager/WEB-INF/web.xml
@@ -17,9 +17,11 @@
-->
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
- version="2.5">
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
+ http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
+ version="3.0"
+ metadata-complete="true">
<display-name>Tomcat Manager Application</display-name>
<description>
@@ -42,6 +44,19 @@
<param-name>debug</param-name>
<param-value>2</param-value>
</init-param>
+ <!-- Uncomment this to show proxy sessions from the Backup manager or a
+ StoreManager in the sessions list for an application
+ <init-param>
+ <param-name>showProxySessions</param-name>
+ <param-value>true</param-value>
+ </init-param>
+ -->
+ <multipart-config>
+ <!-- 50MB max -->
+ <max-file-size>52428800</max-file-size>
+ <max-request-size>52428800</max-request-size>
+ <file-size-threshold>0</file-size-threshold>
+ </multipart-config>
</servlet>
<servlet>
<servlet-name>Status</servlet-name>
@@ -60,63 +75,7 @@
<!-- Define the Manager Servlet Mapping -->
<servlet-mapping>
<servlet-name>Manager</servlet-name>
- <url-pattern>/list</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/expire</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/sessions</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/start</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/stop</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/install</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/remove</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/deploy</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/undeploy</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/reload</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/save</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/serverinfo</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/roles</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/resources</url-pattern>
- </servlet-mapping>
- <servlet-mapping>
- <servlet-name>Manager</servlet-name>
- <url-pattern>/findleaks</url-pattern>
+ <url-pattern>/text/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>Status</servlet-name>
@@ -132,11 +91,25 @@
</servlet-mapping>
<filter>
+ <filter-name>SetCharacterEncoding</filter-name>
+ <filter-class>org.apache.catalina.filters.SetCharacterEncodingFilter</filter-class>
+ <init-param>
+ <param-name>encoding</param-name>
+ <param-value>UTF-8</param-value>
+ </init-param>
+ </filter>
+
+ <filter-mapping>
+ <filter-name>SetCharacterEncoding</filter-name>
+ <url-pattern>/*</url-pattern>
+ </filter-mapping>
+
+ <filter>
<filter-name>CSRF</filter-name>
<filter-class>org.apache.catalina.filters.CsrfPreventionFilter</filter-class>
<init-param>
<param-name>entryPoints</param-name>
- <param-value>/html,/html/,/html/list</param-value>
+ <param-value>/html,/html/,/html/list,/index.jsp</param-value>
</init-param>
</filter>
@@ -145,107 +118,48 @@
<servlet-name>HTMLManager</servlet-name>
</filter-mapping>
- <!-- Define reference to the user database for looking up roles -->
- <resource-env-ref>
- <description>
- Link to the UserDatabase instance from which we request lists of
- defined role names. Typically, this will be connected to the global
- user database with a ResourceLink element in server.xml or the context
- configuration file for the Manager web application.
- </description>
- <resource-env-ref-name>users</resource-env-ref-name>
- <resource-env-ref-type>
- org.apache.catalina.UserDatabase
- </resource-env-ref-type>
- </resource-env-ref>
-
<!-- Define a Security Constraint on this Application -->
+ <!-- NOTE: None of these roles are present in the default users file -->
<security-constraint>
<web-resource-collection>
- <web-resource-name>Manager commands</web-resource-name>
- <url-pattern>/list</url-pattern>
- <url-pattern>/expire</url-pattern>
- <url-pattern>/sessions</url-pattern>
- <url-pattern>/start</url-pattern>
- <url-pattern>/stop</url-pattern>
- <url-pattern>/install</url-pattern>
- <url-pattern>/remove</url-pattern>
- <url-pattern>/deploy</url-pattern>
- <url-pattern>/undeploy</url-pattern>
- <url-pattern>/reload</url-pattern>
- <url-pattern>/save</url-pattern>
- <url-pattern>/serverinfo</url-pattern>
- <url-pattern>/roles</url-pattern>
- <url-pattern>/resources</url-pattern>
- <url-pattern>/findleaks</url-pattern>
- </web-resource-collection>
- <auth-constraint>
- <!-- NOTE: 1. These roles are not present in the default users file
- 2. The manager role is deprecated, it will be removed in
- Tomcat 7.
- 3. Use the manager-script role to take advantage of the new
- CSRF protection. Using the manager role or assigning both
- the manager-script and manager-gui roles to the same user
- will bypass the CSRF protection. -->
- <role-name>manager-script</role-name>
- <role-name>manager</role-name>
- </auth-constraint>
- </security-constraint>
-
- <security-constraint>
- <web-resource-collection>
- <web-resource-name>HTML Manager commands</web-resource-name>
+ <web-resource-name>HTML Manager interface (for humans)</web-resource-name>
<url-pattern>/html/*</url-pattern>
</web-resource-collection>
<auth-constraint>
- <!-- NOTE: 1. These roles are not present in the default users file
- 2. The manager role is deprecated, it will be removed in
- Tomcat 7.
- 3. Use just the manager-gui role to take advantage of the new
- CSRF protection. Assigning the manager role or manager-gui
- role along with either the manager-script or manager-jmx
- roles to the same user will bypass the CSRF protection. -->
<role-name>manager-gui</role-name>
- <role-name>manager</role-name>
</auth-constraint>
</security-constraint>
-
<security-constraint>
<web-resource-collection>
- <web-resource-name>JMX proxy</web-resource-name>
+ <web-resource-name>Text Manager interface (for scripts)</web-resource-name>
+ <url-pattern>/text/*</url-pattern>
+ </web-resource-collection>
+ <auth-constraint>
+ <role-name>manager-script</role-name>
+ </auth-constraint>
+ </security-constraint>
+ <security-constraint>
+ <web-resource-collection>
+ <web-resource-name>JMX Proxy interface</web-resource-name>
<url-pattern>/jmxproxy/*</url-pattern>
</web-resource-collection>
<auth-constraint>
- <!-- NOTE: 1. These roles are not present in the default users file
- 2. The manager role is deprecated, it will be removed in
- Tomcat 7.
- 3. Use the manager-jmx role to take advantage of the new
- CSRF protection. Using the manager role or assigning both
- the manager-jmx and manager-gui roles to the same user
- will bypass the CSRF protection. -->
<role-name>manager-jmx</role-name>
- <role-name>manager</role-name>
</auth-constraint>
</security-constraint>
-
<security-constraint>
<web-resource-collection>
- <web-resource-name>Status</web-resource-name>
+ <web-resource-name>Status interface</web-resource-name>
<url-pattern>/status/*</url-pattern>
</web-resource-collection>
<auth-constraint>
- <!-- NOTE: 1. These roles are not present in the default users file
- 2. The manager role is deprecated, it will be removed in
- Tomcat 7. -->
- <role-name>manager-status</role-name>
<role-name>manager-gui</role-name>
<role-name>manager-script</role-name>
<role-name>manager-jmx</role-name>
- <role-name>manager</role-name>
+ <role-name>manager-status</role-name>
</auth-constraint>
</security-constraint>
-
<!-- Define the Login Configuration for this Application -->
<login-config>
<auth-method>BASIC</auth-method>
@@ -273,16 +187,10 @@
</security-role>
<security-role>
<description>
- The role that is required to access to the Manager Status pages
+ The role that is required to access to the Manager Status pages
</description>
<role-name>manager-status</role-name>
</security-role>
- <security-role>
- <description>
- Deprecated role that can access all Manager functionality
- </description>
- <role-name>manager</role-name>
- </security-role>
<error-page>
<error-code>401</error-code>
@@ -292,5 +200,9 @@
<error-code>403</error-code>
<location>/WEB-INF/jsp/403.jsp</location>
</error-page>
+ <error-page>
+ <error-code>404</error-code>
+ <location>/WEB-INF/jsp/404.jsp</location>
+ </error-page>
</web-app>