Return-Path: 
 <dev-return-64009-apmail-tomcat-dev-archive=tomcat.apache.org@tomcat.apache.org>
Delivered-To: apmail-tomcat-dev-archive@www.apache.org
Received: (qmail 62752 invoked from network); 9 Nov 2005 19:51:57 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (209.237.227.199)
  by minotaur.apache.org with SMTP; 9 Nov 2005 19:51:57 -0000
Received: (qmail 3969 invoked by uid 500); 9 Nov 2005 19:51:41 -0000
Delivered-To: apmail-tomcat-dev-archive@tomcat.apache.org
Received: (qmail 3881 invoked by uid 500); 9 Nov 2005 19:51:41 -0000
Mailing-List: contact dev-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:dev-help@tomcat.apache.org>
List-Unsubscribe: <mailto:dev-unsubscribe@tomcat.apache.org>
List-Post: <mailto:dev@tomcat.apache.org>
List-Id: <dev.tomcat.apache.org>
Reply-To: "Tomcat Developers List" <dev@tomcat.apache.org>
Delivered-To: mailing list dev@tomcat.apache.org
Received: (qmail 3851 invoked by uid 500); 9 Nov 2005 19:51:41 -0000
Delivered-To: apmail-jakarta-tomcat-dev@jakarta.apache.org
Received: (qmail 3843 invoked by uid 99); 9 Nov 2005 19:51:40 -0000
X-ASF-Spam-Status: No, hits=-9.4 required=10.0
	tests=ALL_TRUSTED,NO_REAL_NAME
X-Spam-Check-By: apache.org
Received: from [209.237.227.194] (HELO minotaur.apache.org) (209.237.227.194)
    by apache.org (qpsmtpd/0.29) with SMTP; Wed, 09 Nov 2005 11:51:40 -0800
Received: (qmail 62468 invoked by uid 65534); 9 Nov 2005 19:51:20 -0000
Message-ID: <20051109195120.62467.qmail@minotaur.apache.org>
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: svn commit: r332127 - in /tomcat/container/tc5.5.x:
 catalina/src/conf/web.xml
 catalina/src/share/org/apache/catalina/servlets/DefaultServlet.java
 webapps/docs/changelog.xml webapps/docs/default-servlet.xml
Date: Wed, 09 Nov 2005 19:51:19 -0000
To: tomcat-dev@jakarta.apache.org
From: markt@apache.org
X-Mailer: svnmailer-1.0.5
X-Virus-Checked: Checked by ClamAV on apache.org
X-Spam-Rating: minotaur.apache.org 1.6.2 0/1000/N

Author: markt
Date: Wed Nov  9 11:50:47 2005
New Revision: 332127

URL: http://svn.apache.org/viewcvs?rev=332127&view=rev
Log:
Fix bug 37150. Turn off directory listings by default and add a warning to the docs.

Modified:
    tomcat/container/tc5.5.x/catalina/src/conf/web.xml
    tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/servlets/DefaultServlet.java
    tomcat/container/tc5.5.x/webapps/docs/changelog.xml
    tomcat/container/tc5.5.x/webapps/docs/default-servlet.xml

Modified: tomcat/container/tc5.5.x/catalina/src/conf/web.xml
URL: http://svn.apache.org/viewcvs/tomcat/container/tc5.5.x/catalina/src/conf/web.xml?rev=332127&r1=332126&r2=332127&view=diff
==============================================================================
--- tomcat/container/tc5.5.x/catalina/src/conf/web.xml (original)
+++ tomcat/container/tc5.5.x/catalina/src/conf/web.xml Wed Nov  9 11:50:47 2005
@@ -34,7 +34,10 @@
   <!--                       resources to be served.  [2048]                -->
   <!--                                                                      -->
   <!--   listings            Should directory listings be produced if there -->
-  <!--                       is no welcome file in this directory?  [true]  -->
+  <!--                       is no welcome file in this directory?  [false] -->
+  <!--                       WARNING: Listings for directories with many    -->
+  <!--                       entries can be slow and may consume            -->
+  <!--                       significant proportions of server resources.   -->
   <!--                                                                      -->
   <!--   output              Output buffer size (in bytes) when writing     -->
   <!--                       resources to be served.  [2048]                -->
@@ -74,7 +77,7 @@
         </init-param>
         <init-param>
             <param-name>listings</param-name>
-            <param-value>true</param-value>
+            <param-value>false</param-value>
         </init-param>
         <load-on-startup>1</load-on-startup>
     </servlet>

Modified: tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/servlets/DefaultServlet.java
URL: http://svn.apache.org/viewcvs/tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/servlets/DefaultServlet.java?rev=332127&r1=332126&r2=332127&view=diff
==============================================================================
--- tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/servlets/DefaultServlet.java (original)
+++ tomcat/container/tc5.5.x/catalina/src/share/org/apache/catalina/servlets/DefaultServlet.java Wed Nov  9 11:50:47 2005
@@ -94,7 +94,7 @@
     /**
      * Should we generate directory listings?
      */
-    protected boolean listings = true;
+    protected boolean listings = false;
 
 
     /**

Modified: tomcat/container/tc5.5.x/webapps/docs/changelog.xml
URL: http://svn.apache.org/viewcvs/tomcat/container/tc5.5.x/webapps/docs/changelog.xml?rev=332127&r1=332126&r2=332127&view=diff
==============================================================================
--- tomcat/container/tc5.5.x/webapps/docs/changelog.xml (original)
+++ tomcat/container/tc5.5.x/webapps/docs/changelog.xml Wed Nov  9 11:50:47 2005
@@ -64,6 +64,10 @@
         <bug>37264</bug>: JNDI resources were no longer available when stopping listeners,
         submitted by Bogdan Calmac (remm)
       </fix>
+      <fix>
+        <bug>37150</bug>: Turn off directory listing by default and add a warning
+        regarding enabling listing of directories with many entries. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">

Modified: tomcat/container/tc5.5.x/webapps/docs/default-servlet.xml
URL: http://svn.apache.org/viewcvs/tomcat/container/tc5.5.x/webapps/docs/default-servlet.xml?rev=332127&r1=332126&r2=332127&view=diff
==============================================================================
--- tomcat/container/tc5.5.x/webapps/docs/default-servlet.xml (original)
+++ tomcat/container/tc5.5.x/webapps/docs/default-servlet.xml Wed Nov  9 11:50:47 2005
@@ -89,6 +89,10 @@
         value may be <b>true</b> or <b>false</b>
         <br />
         Welcome files are part of the servlet api.
+        <br />
+        <b>WARNING:</b> Listings of directories containing many entries are
+        expensive. Multiple requests for large directory listings can consume
+        significant proportions of server resources.
     </td>
   </tr>
   <tr>



---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org