Return-Path: Delivered-To: apmail-tomcat-dev-archive@www.apache.org Received: (qmail 76578 invoked from network); 11 May 2010 10:26:34 -0000 Received: from unknown (HELO mail.apache.org) (140.211.11.3) by 140.211.11.9 with SMTP; 11 May 2010 10:26:34 -0000 Received: (qmail 79853 invoked by uid 500); 11 May 2010 10:26:33 -0000 Delivered-To: apmail-tomcat-dev-archive@tomcat.apache.org Received: (qmail 79711 invoked by uid 500); 11 May 2010 10:26:33 -0000 Mailing-List: contact dev-help@tomcat.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: "Tomcat Developers List" Delivered-To: mailing list dev@tomcat.apache.org Received: (qmail 79697 invoked by uid 99); 11 May 2010 10:26:33 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 11 May 2010 10:26:33 +0000 X-ASF-Spam-Status: No, hits=-1443.1 required=10.0 tests=ALL_TRUSTED,AWL X-Spam-Check-By: apache.org Received: from [140.211.11.9] (HELO minotaur.apache.org) (140.211.11.9) by apache.org (qpsmtpd/0.29) with SMTP; Tue, 11 May 2010 10:26:32 +0000 Received: (qmail 76563 invoked from network); 11 May 2010 10:26:11 -0000 Received: from unknown (HELO ?127.0.0.1?) (127.0.0.1) by 127.0.0.1 with SMTP; 11 May 2010 10:26:11 -0000 Message-ID: <4BE930C3.3020707@apache.org> Date: Tue, 11 May 2010 06:26:11 -0400 From: Tim Funk User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.9) Gecko/20100317 Thunderbird/3.0.4 MIME-Version: 1.0 To: dev@tomcat.apache.org Subject: Re: CSRF prevention filter and Tomcat 5/6 References: <4BE452F2.6040305@apache.org> <4BE82AA1.6070807@apache.org> In-Reply-To: <4BE82AA1.6070807@apache.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit +1 to E -Tim On 5/10/2010 11:47 AM, Mark Thomas wrote: > On 10/05/2010 13:25, Konstantin Kolinko wrote: >>> Thoughts? >>> >> >> It is possible to combine A+C: >> >> E. Use a different name for the new role that allows access to GUI >> interface only, >> "manager-gui", as well as new "manager-script", "manager-jmx", >> "manager-status". >> >> We can even rename "manager" -> "manager-gui" in Tomcat 7. >> >> The "manager" role is preserved as is, but is documented as >> "deprecated" and is no longer recommended for use. > > I like it. Neat solution. --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org For additional commands, e-mail: dev-help@tomcat.apache.org