portals-jetspeed-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Raphaël Luta <raphael.l...@networks.groupvu.com>
Subject Re: Servlet 2.2 Spec. and serving files from the WEB-INF directory
Date Wed, 07 Mar 2001 20:19:07 GMT
David Sean Taylor wrote:
> 
> I've been trying to get Jetspeed to run with a particular vendor for quite a
> while now.
> I am not disclosing the name of the vendor, I replaced it below with
> *VENDOR-PRODUCT*
> I assume Websphere doesn't have a problem with serving files from the
> WEB-INF directory.
> Agreed that it makes it nice to have one WAR file for distribution, but any
> thoughts on 'breaking' the 2.2 spec?
> 
> > I've run into a possible bug in our servlet container. Jetspeed is built
> > using Model 2 which involves lots of servlets, forwards, includes,
> > templates and lots of other crap that pretty much makes a webapp
> > unmaintainable. Most of Jetspeed's template resources, in the form of jsp
> > pages, are found in its WEB-INF directory. This is where the problem comes
> > in. According to the Servlet 2.2 spec section 9.4, "No file contained in
> > the WEB-INF directory may be served directly to a client." So
> *VENDOR-PRODUCT*
> > returns a 403 Forbidden error whenever a request is made to the container
> > that results in jsp template files being requested out of the WEB-INF
> > directory. Tomcat, on the other hand, does not prevent access to the
> > WEB-INF directory for template files. So the question is, are we doing the
> > correct thing according to the spec? Is processing a template file
> > considered serving a file directly to a client?
> 

Processing a template is not serving a file in the general case, especially 
Velocity templates sitting in WEB-INF should never cause any issue, however
JSPs are a special case and I'm not sure how Turbine handles JSPs as 
templates, if you use any RequestDispatcher method, the servlet container
may certainly treat this as if the included file has been forwarded directly
to the client...

I put the templates in the WEB-INF directory because for systems such as 
Velocity, they should never be accessed directly from a client so WEB-INF
was a natural solution.

Can you try to move the JSP templates to the base webapp directory
and use ${webapp.dir}/templates/jsp as the base JSP template dir ?

--
Raphaël Luta - raphael.luta@networks.groupvu.com
Vivendi Universal Networks - Services Manager / Paris

Mime
View raw message