IP Filtering in Tomcat 6 - security

I know to filter using ip in tomcat 6,I have to use he bleow code
Valve className=”org.apache.catalina.valves.RemoteAddrValve” allow=”10.10.1[12]..*”/>
this works for me.But,How can I restrict access to a specific servlet.The above blocks for the entire application,I want to balock access for specifi servlet.I tried the below in web.xml,but its display tomcat error page 404
<filter>
<filter-name>R</filter-name>
<filter-class>org.apache.catalina.valves.RemoteAddrValve</filter-class>
<init-param>
<param-name>allow</param-name>
<param-value>172\.16\.18\..*</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>R</filter-name>
<url-pattern>*/json</url-pattern>
</filter-mapping>

you can not use star(*) int the start of url pattern.

Related

Proper activeweb configuration for pages with foreign language characters

I have just created new web application based on activeweb framework and by default it shows me "?" for all foreign language characters. Something like this:
? ????????? ??????
???? ????????? ??
?????? ??????????
? ??? ???? ??????????
??????????? ????????
English characters are displayed ok.
Here is my web.xml config:
<display-name>activeweb</display-name>
<session-config>
<session-timeout>30</session-timeout>
</session-config>
<filter>
<filter-name>dispatcher</filter-name>
<filter-class>org.javalite.activeweb.RequestDispatcher</filter-class>
<init-param>
<param-name>exclusions</param-name>
<param-value>css,img,fonts,images,js,html,GwtExample,ico</param-value>
</init-param>
<init-param>
<param-name>root_controller</param-name>
<param-value>home</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>dispatcher</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
I expect that this problem might be related to encoding in activeweb internals or I have to apply special setting. Do you know how to fix it?
This happens because ActiveWeb does nothing about encoding by default, and what you get comes from the servlet container.In order to force a specific encoding (UTF-8, I assume), you need to add a line of configuration to the web.xml file:
<filter>
<filter-name>dispatcher</filter-name>
<filter-class>org.javalite.activeweb.RequestDispatcher</filter-class>
<init-param>
<param-name>exclusions</param-name>
<param-value>css,images,js,ico</param-value>
</init-param>
<init-param>
<param-name>root_controller</param-name>
<param-value>home</param-value>
</init-param>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
</filter>
This will force UTF-8 encoding on request as well as response.

Conflict between use of hx:fileupload and tomahawk tree2 component in the application

I'm using hx:fileupload component which allows the user to open local file system and browse to the file. In the same application I have used tomahawk tree2 component to display hierarchical directory structure.
Earlier to adding tree2 component, fileupload was working perfect but when I added the filter tag corresponding to tomahawk tree2 in web.xml file, getFileupload1().getFilename() method of hx:fileupload component (where getFileupload1() is getter method of hx:fileupload component) return null exception.
Filter tag code:
<filter>
<filter-name>MyFacesExtensionsFilter</filter-name>
<filter-class>org.apache.myfaces.webapp.filter.ExtensionsFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>MyFacesExtensionsFilter</filter-name>
<servlet-name>Faces Servlet</servlet-name>
</filter-mapping>
<filter-mapping>
<filter-name>MyFacesExtensionsFilter</filter-name>
<url-pattern>*.jsf</url-pattern>
</filter-mapping>
If i remove filter tag from web.xml file, fileupload component resumes to work properly but Tree2 component won't work.
Please help to make both components work together in the application.
Thank you
I have done the following updations:
Implemented ExtensionsFilter filter servlet by removing if (ServletFileUpload.isMultipartContent(httpRequest)) {} block from the original ExtensionsFilter source code file.
updated web.xml code
<filter>
<filter-name>MyFacesExtensionsFilter</filter-name>
<filter-class>pagecode.ExtensionsFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>MyFacesExtensionsFilter</filter-name>
<servlet-name>Faces Servlet</servlet-name>
</filter-mapping>
<filter-mapping>
<filter-name>MyFacesExtensionsFilter</filter-name>
<url-pattern>/faces/myFacesExtensionResource/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>MyFacesExtensionsFilter</filter-name>
<url-pattern>*.jsf</url-pattern>
</filter-mapping>
Please help. Thanks.
The ExtensionsFilter also automatically parses multipart/form-data requests as part of its job for Tomahawk's <t:inputFileUpload>. This is not disableable by configuration.
You have basically 2 options:
Copy the source code of ExtensionsFilter under the same license and remove the whole if (ServletFileUpload.isMultipartContent(httpRequest)) {} block (lines 347-350) so that it doesn't parse multipart/form-data requests anymore and use this filter instead.
Replace <hx:fileUpload> by <t:inputFileUpload>.

Setting Vaadin session-timeout parameter

I am using Vaadin 7.1.7 and I can't figure out how to set session-timeout
parameter (to, say, 1min).
As far as I can tell, Vaadin 7.x.x does not produce web.xml, it uses #VaadinServletConfiguration annotation but there doesn't seem to be a session-timeout parameter.
As far as I know there are 2 ways to set session-timeout in Vaadin 7.
In the web.xml:
<session-config>
<session-timeout>1</session-timeout> <!-- 1 minute -->
</session-config>
<servlet>
<servlet-name>MyServlet</servlet-name>
<servlet-class>com.xyz.web.MyServlet</servlet-class>
<init-param>
<description>My Main Page</description>
<param-name>UI</param-name>
<param-value>com.xyz.web.MyUI</param-value>
</init-param>
<init-param>
<description>Enable Session Timeout (heartbeat can't keep alive)</description>
<param-name>closeIdleSessions</param-name>
<param-value>true</param-value>
</init-param>
</servlet>
<servlet-mapping>
<servlet-name>MyServlet</servlet-name>
<url-pattern>/*</url-pattern>
</servlet-mapping>
Or we can set it programmatically (current session only):
VaadinSession.getCurrent().getSession().setMaxInactiveInterval(60); // 1 minute
It seems the servlet 3.0 annotations do not help: link
More help here: link

ADF Model: Could not load user defined filter in web.xml: oracle.adf.model.servlet.ADFBindingFilter

Just facing a problem since some days.
Could not load user defined filter in web.xml: oracle.adf.model.servlet.ADFBindingFilter
web.xml
<filter>
<filter-name>trinidad</filter-name>
<filter-class>org.apache.myfaces.trinidad.webapp.TrinidadFilter</filter-class>
</filter>
<filter>
<filter-name>adfBindings</filter-name>
<filter-class>oracle.adf.model.servlet.ADFBindingFilter</filter-class>
</filter>
Libs
May be someone already faces this issue?
Thanks for any suggestions!

Spring MVC WebApp Issue

We are using Spring MVC 3 for our WebApplication. I see a strange behavior from the application. When a user perform a action (ex: button click) , i see the controllers logs are logged twice and so are the subsequent calls in the controller .Controllers we used are default,singleton.
So,
I would like to print the thread information in the controller(like threadName. tried Thread.getName()..was Unique).. any help?
How do i make sure that there is only one Spring container
loaded? -- any Suggestions?
log4j Prop:
`log4j.appender.ROLL_FILE=org.apache.log4j.RollingFileAppender
log4j.appender.ROLL_FILE.File=/ws/was/dept/logs/${module.jvm.instance}_module.log
log4j.appender.ROLLING_FILE.Append=true
log4j.additivity.ROLLING_FILE.Append=false
log4j.appender.ROLLING_FILE.MaxFileSize=10MB
log4j.appender.ROLLING_FILE.MaxBackupIndex=20
log4j.appender.ROLLING_FILE.layout=org.apache.log4j.PatternLayout
log4j.appender.ROLLING_FILE.layout.ConversionPattern=[module] %d - %c -%-4r [%t] %-5p %c %x - %m
Web.xml :
<display-name>module</display-name>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath*:/spring/int/root-int-context.xml,/WEB-INF/spring/root- context.xml</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<servlet>
<servlet-name>appServlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/appServlet.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>`
<servlet-mapping>
<servlet-name>appServlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
..........
.........
.........
Thanks
Use Thread.getId() to get the unique thread ID.
Check your logger configuration - I'm guessing you are using log4j or slfj - you might have more than one logger that intercepts the message adds appenders on-top of the appenders defined in the parent logger this might cause two messages to be printed - so check if you have that and define additivity to be false.
I would like to print the thread information in the controller(like threadName. tried Thread.getName()..was Unique)
Use a logging framework. You can find several examples. Check here for configuring logback
How do i make sure that there is only one Spring container loaded?
I really don't understand what you mean here, but if have defined contextConfigLocation appropriately in your web.xml, the Spring container would be loaded correctly
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath*:/META-INF/spring/*.xml
</param-value>

Resources