tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jeanfrancois Arcand <jfarc...@apache.org>
Subject Re: cvs commit: jakarta-tomcat-jasper/jasper2/src/share/org/apache/jasper JspC.java
Date Wed, 22 Jan 2003 19:07:02 GMT
The only problem I see by removing the package org.apache.jsp is that 
when Tomcat run under the security manager, it is no longer possible to 
protect an application from package insertion/access (dangerous).

It is  still possible to protect the application by manually adding the 
new package name under the conf/tomcat.properties file. This will have 
to be documented somewhere.

-- Jeanfrancois


Remy Maucherat wrote:

> Hans Bergsten wrote:
>
>> Remy Maucherat wrote:
>> See my previous mail; you do _not_ need to have a package statement
>> for the generated servlet class. Adding it just complicates life.
>
>
> Ooops, sorry, I'm trying to do plenty of things at once, and 
> misunderstood your reply.
> I'll remove the org.apache.jsp since it's not needed.
>
>> As long as there's no prefix added to the package name, yes. If you
>> add a package name prefix, the JspC in TC 4.1.18 (with the patch we're
>> talking about here) generates "package org.apache.jsp.foo;" for a
>> JSP page in the context-relative dir "foo" and places the class file
>> in "<JspC-outdir>/foo". Hence, a structure mismatch that will cause
>> confusion.
>
>
> Indeed.
>
> Remy
>
>
> -- 
> To unsubscribe, e-mail:   
> <mailto:tomcat-dev-unsubscribe@jakarta.apache.org>
> For additional commands, e-mail: 
> <mailto:tomcat-dev-help@jakarta.apache.org>
>
>


--
To unsubscribe, e-mail:   <mailto:tomcat-dev-unsubscribe@jakarta.apache.org>
For additional commands, e-mail: <mailto:tomcat-dev-help@jakarta.apache.org>


Mime
View raw message