Return-Path: Delivered-To: apmail-db-derby-commits-archive@www.apache.org Received: (qmail 25146 invoked from network); 25 Jul 2007 18:51:22 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2) by minotaur.apache.org with SMTP; 25 Jul 2007 18:51:22 -0000 Received: (qmail 34813 invoked by uid 500); 25 Jul 2007 18:51:23 -0000 Delivered-To: apmail-db-derby-commits-archive@db.apache.org Received: (qmail 34789 invoked by uid 500); 25 Jul 2007 18:51:23 -0000 Mailing-List: contact derby-commits-help@db.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: List-Post: Reply-To: "Derby Development" List-Id: Delivered-To: mailing list derby-commits@db.apache.org Received: (qmail 34760 invoked by uid 99); 25 Jul 2007 18:51:23 -0000 Received: from herse.apache.org (HELO herse.apache.org) (140.211.11.133) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 25 Jul 2007 11:51:23 -0700 X-ASF-Spam-Status: No, hits=-99.5 required=10.0 tests=ALL_TRUSTED,NO_REAL_NAME X-Spam-Check-By: apache.org Received: from [140.211.11.3] (HELO eris.apache.org) (140.211.11.3) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 25 Jul 2007 11:51:21 -0700 Received: by eris.apache.org (Postfix, from userid 65534) id 588E91A981A; Wed, 25 Jul 2007 11:51:01 -0700 (PDT) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: svn commit: r559555 - in /db/derby/code/branches/10.3/java/drda/org/apache/derby/drda: server.policy template.policy Date: Wed, 25 Jul 2007 18:51:01 -0000 To: derby-commits@db.apache.org From: dag@apache.org X-Mailer: svnmailer-1.1.0 Message-Id: <20070725185101.588E91A981A@eris.apache.org> X-Virus-Checked: Checked by ClamAV on apache.org Author: dag Date: Wed Jul 25 11:50:59 2007 New Revision: 559555 URL: http://svn.apache.org/viewvc?view=rev&rev=559555 Log: DERBY-2963 Merged from trunk as svn merge -r 559435:559436 https://svn.apache.org/repos/asf/db/derby/code/trunk . Original comment: DERBY-2963 Extending SocketPermission to all hosts ("*") in the default policy file to make server start compatible with pre-10.3 versions which allowed any host to connect if no security manager was used. Also added comment that user may want to restrict this permission. Modified: db/derby/code/branches/10.3/java/drda/org/apache/derby/drda/server.policy db/derby/code/branches/10.3/java/drda/org/apache/derby/drda/template.policy Modified: db/derby/code/branches/10.3/java/drda/org/apache/derby/drda/server.policy URL: http://svn.apache.org/viewvc/db/derby/code/branches/10.3/java/drda/org/apache/derby/drda/server.policy?view=diff&rev=559555&r1=559554&r2=559555 ============================================================================== --- db/derby/code/branches/10.3/java/drda/org/apache/derby/drda/server.policy (original) +++ db/derby/code/branches/10.3/java/drda/org/apache/derby/drda/server.policy Wed Jul 25 11:50:59 2007 @@ -28,6 +28,16 @@ // // This permission lets the Network Server manage connections from clients. // - permission java.net.SocketPermission "${derby.security.host}", "accept"; + +// Accept connections from any host. Derby is listening to the host +// interface specified via the -h option to "NetworkServerControl +// start" on the command line, via the address parameter to the +// org.apache.derby.drda.NetworkServerControl constructor in the API +// or via the property derby.drda.host; the default is localhost. +// You may want to restrict allowed hosts, e.g. to hosts in a specific +// subdomain, e.g. "*.acme.com". + + permission java.net.SocketPermission "*", "accept"; + }; Modified: db/derby/code/branches/10.3/java/drda/org/apache/derby/drda/template.policy URL: http://svn.apache.org/viewvc/db/derby/code/branches/10.3/java/drda/org/apache/derby/drda/template.policy?view=diff&rev=559555&r1=559554&r2=559555 ============================================================================== --- db/derby/code/branches/10.3/java/drda/org/apache/derby/drda/template.policy (original) +++ db/derby/code/branches/10.3/java/drda/org/apache/derby/drda/template.policy Wed Jul 25 11:50:59 2007 @@ -40,6 +40,16 @@ // // This permission lets the Network Server manage connections from clients. // - permission java.net.SocketPermission "${derby.security.host}", "accept"; + +// Accept connections from any host. Derby is listening to the host +// interface specified via the -h option to "NetworkServerControl +// start" on the command line, via the address parameter to the +// org.apache.derby.drda.NetworkServerControl constructor in the API +// or via the property derby.drda.host; the default is localhost. +// You may want to restrict allowed hosts, e.g. to hosts in a specific +// subdomain, e.g. "*.acme.com". + + permission java.net.SocketPermission "*", "accept"; + };