The Apache Jakarta Tomcat 5 Servlet/JSP Container

Changelog

General

Update web.xml files to 2.4 schema (from 2.3 DTD) where applicable. (yoavs) 32235: align conf/web.xml MIME types with Apache HTTPD. (yoavs) 31132: Modified startup scripts for better OS/400 -x/-r handling. (yoavs) 22679: Added misc note on accessing session ID to SSL-HowTo. (yoavs) When the package protection is not used, do not create the doPrivileged objects so we don't suffer the performance hit (jfarcand) 32282: Modify Windows Uninstaller to remove webapps and webapps/ROOT only if user asks to remove everything. (yoavs)

Catalina

31273: Add support for derefaliases in JNDIRealm. (markt) 31623: Better OS400 support in setclasspath.sh. (yoavs) 31592: Allow specification of digest encoding for realms. (yoavs) 31945: Added and updated Connector documentation. (yoavs) 31739: Minor documentation corrections for realm-howto and AJP docs. (yoavs) 31753: Minor inconsistencies in JDBC and DataSourceRealm#authenticate. (yoavs) 31683: Minor clarifications to realm documentation. (yoavs) 31851: UserTransaction in DefaultContext broken. (yoavs) 32130: Check for null or empty file listing in FileStore#keys. (yoavs) 32276: Add developer info to Realm How-To. (yoavs) 32082: Add protected getPrincipals method to MemoryRealm for easier extension. (yoavs) 32023: CGIServlet fails to handle post message with multipart/form data. (yoavs) 32269: JNDIRealm fails with InvalidNameException to authenticate users if LDAP distinguished name (DN) contains slash or double quote character(s). (yoavs)

Coyote

Jasper

Fixed default compiler target VM setting (to 1.3) so that compilation on J2SE 5.0 works out of the box. (yoavs) Exposed compilerSourceVM and compilerTargetVM options to JspC. (yoavs) Updated JspC usage messages to include recently added configurable parameters. (yoavs) 29866: JspReader#skipUntil may try to read beyond the end of the file. (yoavs) 32330: JspC changes context classloader. (yoavs)

Cluster

Webapps

31707: Broken JavaScript confirmation in HTML manager. (yoavs) Removed hard-coded admin context path. (yoavs) 31732: Fix Japanese localization of Manager's list command. (yoavs) 31656: Make admin webapp build on Struts 1.2. (yoavs) 32019: Remove maxlength=64 on env entry value in admin webapp. (yoavs)

General

Added Xalan note in RELEASE-NOTE section on XML parsers. (yoavs) 30756: Bad syntax in sample web.xml. (yoavs) Enhanced Japanese resource bundles. (yoavs) 30568: Incomplete setup.html documentation for launching jsvc. (yoavs)

Catalina

Use CatalinaDigester on shutdown so you can use a sytem property to configure the port. (funkman) Fix memory leak when Security Manager is turned on. (jfarcand) 28914: threadPriority attribute ignored. (yoavs) 30763: added failOnError attribute to UndeployTask. (yoavs) 30624: Enhanced null checking in RealmBase#findSecurityConstraints. (yoavs) Added explicit close of randomIS DataInputStream to ManagerBase for better resource handling. (yoavs) Added processTlds context attribute to allow disabling TLD processing. (yoavs) Backport if-else logic for SSI servlet from 4.1 (funkman) StandardClassLoader: Output the name of the repository if it failed to load. (funkman) 31001: Missing domain attribute in MBean description for createStandardService. (yoavs) 30636: NPE in DigesterFactory when resources cannot be located. (yoavs) 30415: Directories ending in .war not handled well. (yoavs) 31052: BeanFactory swallows root cause of exception. (yoavs) 29914: Better lifecycle support for DefaultContext. (yoavs) Set the FORM notes even when caching so that clustering with SSO works properly. (remm) 30869: Make sure JAAS realm name is legal. (yoavs) 31277: Clarified automatic application deployment section of Host configuration page. (yoavs) 28631: JAASRealm enhancements to support custom user, role class names, use Commons-Logging. (yoavs) 31364: Missing resource in org.apache.catalina.core.LocalString.properties. (yoavs) 31362: Missing -Xdebug in catalina.bat when using JPDA and Security. (yoavs) 30949: Make sure ApplicationDispatcher unwraps requests even if include fails. (yoavs) 31511: Don't call setenv.bat if not found in *using-launcher scripts. (yoavs) 31549: Add name of resource to load failed messaged in WebappClassLoader. (yoavs)

Webapps

29526: Manager redeployment locked JAR because of context.xml stream. (yoavs) Added JavaScript confirmation for "dangerous" manager tasks. (yoavs) 29485: Added JavaScript confirmation prompts to HTML Manager actions. (yoavs) 31058: Ensure StatusTransformer escapes query string for XML. (yoavs) CGI Servlet: Revert the fix for 27090 as it introduced a JDK 1.4 dependency. (markt)

Jasper

30984: Added compilerTargetVM option to Jasper. (yoavs) 31171: Wrap to avoid ClassCastException in PageContextImpl. (yoavs) 31257: Added specification of endorsed dirs if forking. (yoavs) 31510: Set response=null in JspWriterImpl#recycle to aid in JBoss memory leak. (yoavs)

Coyote

31018: Race condition in SystemLogHandler. (yoavs)

General

30239: Updated IIS how-to to link to Wiki page with instrutions for IIS 5 and IIS 6 configurations. (yoavs) 30238: Replaced isapi_redirector.dll isapi_redirect.dll in installation script for consistency. (yoavs) 29584: Enhanced and clarified JNDI documentation. (yoavs) 30245: Corrected Connector documentation to list "address" as a common attribute. (yoavs) 29826: Modified setclasspath.bat exit code to 1. (yoavs) Updated status page, mostly rewritten. (yoavs) Updated Jakarta-Commons dependencies: BeanUtils to 1.7.0, Collections to 3.1. (yoavs) Removed classic compiler directives from Ant build, as we use modern anyways. (yoavs) Modified RELEASE-PLAN-5.0.html to indicate status given start of work on Tomcat 5.next. (yoavs) Added command lines utilities version.sh, version.bat to let you know what version is installed. (funkman)

Catalina

30602: Subject is not available during the first call to the servlet which use the basic authentication (jfarcand) 29831: Added support for Boolean property to BeanFactory. (yoavs) 28875: Made ErrorReportValve use UTF-8 encoding by default. (yoavs) 30325: Only set CATALINA_HOME if not already set (in bin/catalina.sh). (yoavs) 30144: Made SSIServlet check resource MimeType before using text/html and UTF-8 default. (yoavs) 29406: Made JAASRealm configurable as to whether it should use the context ClassLoader or the default ClassLoader by adding a useContextClassLoader boolean attribute. (yoavs) If ServletResponse.getWriter() is called and no char encoding has been specified, set response char encoding to default (ISO-8859-1) so that it is reflected in getContentType() and Content-Type header, as required by the Servlet Spec (Bugtraq 6152759) (luehe) 29869: Better JMX/JSR77 support in StandardContext and StandardWrapper. (remm) Fixed broken link to JK documenration from AJP Connector reference page. (yoavs) 30587: Typo in ExtendedAccessLogValve. (yoavs) 30561: Broken restart of NamingService. (yoavs) 29668: NPE in HostConfig, directory created for deployed WAR instead of xml file. (yoavs) 30179: Improved Bootstrap catalina.properties handling. (yoavs) 30762: Servlet#destroy was called before contextDestroyed. (yoavs) 30650: Added explicit comments on session equals() implementation. (yoavs)

Coyote

30770: Check that the browser actually sent a user-agent header before using it. (billbarker) Default charset not included in Content-Type response header if no char encoding was specified (see Bugtraq 6152759). (luehe)

Jasper

29971: Commented out page directive is parsed. (luehe) 30067: 'Scripting elements are disallowed here' exception behind scriptless tag. (luehe) 30073: NPE when compiling .jspx with broken xml format in jspcmode. (luehe) 30291: Smap for a tag should not include its body. (kinman) 30289: Incorrect Smap for multiple line java expression. (kinman)

Cluster

Webapps

29779: Admin/Examples SetCharacterEncodingFilter wrong package. (yoavs) 30354: manager-howto.xml used wrong Ant task. (yoavs)

General

Updated dependencies on commons-dbcp (to 1.2.1), commons-pool (to 1.2), and commons-logging (to 1.0.4). (yoavs) 29368: Replaced references to xmlParserAPIs.jar with xml-apis.jar, as the former is now deprecated in Xerces. Users wishing to use old versions of Xerces that don't have xml-apis.jar can still do so without a problem. Users wishing to build tomcat using xmlParserAPIs.jar instead of xml-apis.jar can also do so with a trivial edit in the build.xml file. (yoavs)

Catalina

29048: Made DataSourceRealm easier to extend. (yoavs) 29472: Embedded overrides add/remove Connector, but not findConnectors (luehe) 29561: NullPointerException in Compiler.java:547 (luehe) ServletResponse.setContentType sets response encoding after getWriter was called (Bugtraq 5062838) (luehe)

Coyote

Jasper

29597: Added -javaEncoding attribute support to JspC command-line. (yoavs) 29418: Same thing, -javaEncoding added to help with this umlauts bug. (yoavs)

Cluster

Webapps

Fix CGI servlet so it correctly handles binary responses (eg images) - Ported from TC4. (markt)

General

28335: Fixed JavaDocs. (yoavs) Changed build dependency on JUnit from 3.7 to 3.8.1. (yoavs) Added ant-launcher.jar (Ant 1.6 and later) to common/lib, as it's required by the Launcher scripts. (yoavs) 28989: Added ant-launcher.jar to launcher classpath. (yoavs) 24723: Corrected JNDI DataSources documentation and added explicit notes about a couple of common problems. (yoavs) 29258: Added explanation about jmx.jar bootstrap classpath setup to release notes. (yoavs)

Catalina

29133: Fixed stop -force option processing in bin/catalina.sh. (yoavs) 28943: Fixed CURRENT_DIR missing % signs in bin/startup.bat. (yoavs) 29255: common/lib/naming-factory.jar missing MailSession and SendMail factories. (yoavs) 29038: Create directories above context xml file as needed. (yoavs) 28533: Fixed without-jni check in jk_java.m4. (yoavs) 28940: Added UTF-8 encoding directive to Deployer build. (yoavs)

Coyote

29162: Added quote escape for mod_jk module location. (yoavs) 28837: Added Solaris includes to JK native build script. (yoavs) 28914: Added threadPriority attribute and related code. (yoavs) 29108: Fix chunked encoding on EBCDIC machines (remm) 29166: Tweak expectations to work with pipelining (assuming the client will correctly not send the request entity body unless it gets a 100) (remm)

Jasper

Added support for JSP compilations in a clustered environment: Make sure each server always uses the most recent version of a servlet class file, even if it was generated by another server instance. (luehe) Include javac errors whose line numbers cannot be mapped to JSP page in error message that is returned to client. (luehe) Added setJspFiles() method, to allow comma-separated list of JSPs to be specified from ant. (luehe)

Cluster

Webapps

28914: Added management code for threadPriority. (yoavs)

General

Fix some manifests (remm)

Catalina

javadocs correction: getMaxActive() actually returns max number of sessions that have been active at the same time, as opposed to (StandardManager.)getMaxActiveSessions(), which returns the limit (or -1) (luehe) Make those classes in deploy non final so it is possible to customized them (jfarcand) 28971: Regression: the server cookies should be parsed after the context is mapped, otherwise, the session cookie is never considered valid, and it will use the last one (remm). 28959: Fix again mark/reset functionality, and minimize the size of the allocated buffer (remm) Make SingleSignOnEntry constructor public from package protected, submitted by Brian Stansberry (remm) 22176: Allow username and/or password to start and/or end in a space when using BASIC authentication (markt) 22413: response.encodeURL(response.encodeURL("xxx.jsp") now works correctly in root context (markt) Fix subject lost problem with JAAS realm, submitted by Janne Vaananen (jfarcand) Fixed parsing of some multi range requests, and generate MIME boundaries starting with a CRLF (remm)

Coyote

28850: Enable parsing error messages in the given Locale by using MessageFormat.setLocale (billbarker, luehe)

Jasper

Fix a bug where the out-dated version of TagInfo instance of a tag file is used when compiling the tag file (kinman) Small-icon and large-icon values are not retrieved (luehe) When fragment element is used, type and rtexprvalue are not set correctly (luehe) 28603: JspC Ant task does not detect errors on a second compile (luehe) 28840: NPE when using an Iterator for items in a JSTL forEach tag, and add support for java.util.Map and java.util.Enumeration (luehe) Refactoring of Mark (luehe) 28696: xsi:schemaLocation should be a valid attribute for jsp:root (kinman) 28604: If compiling from JspC, the absolute (instead of context-relative) path of the JSP that caused the error is now printed (when compiling from JspServlet, we continue to print only the context-relative path of the JSP) (luehe) Fixed error messages for jsp.error.variable.both/alias (luehe) Added setter for xpoweredBy in JSPc (luehe)

Cluster

Refactored the session message to be an interface, so that all base classes are interfaces implemented by the different modules (fhanik) Supporting TTL and so time out settings for multicast sockets (fhanik)

Webapps

21502: Obtain number of active sessions directly, submitted by Angus Mezick (markt) 21790: Modify noshade references to align with XHTML reference guide, submitted by Henning Schmiedehausen (markt)

General

Bad CVS tagging (remm)

Webapps

Change to list any additionally JNDI data-sources that are present in the web.xml file, but not defined either globally or at the context level, on the context level maintenance page to make it possible to click on the data-source and edit it (amyroh)

General

New procrun binaries (mturk) Fix the problems with paths having spaces in service.bat (mturk) 28333: Add a message about cvs login in the case where checkout fails in the Ant netbuild (remm)

Catalina

When the webapp specific JspServlet inherits the mappings from the global JspServlet, we need to wipe out the wrapper corresponding to the global JspServlet from the mapper (luehe) If there's a non fatal exception (with validation), no exception will be rethrown by the digester. This will make the webapp startup fail if the XML is invalid and XML validation is enabled, even if the error isn't fatal (= the webapp would run without errors if validation was disabled) (remm) 28262: Fix redeployment after removal of a war, submitted by Peter Rossbach (remm) 28107: Simplify Ant tasks declarations, submitted by Matt Raible (remm) Remove the hadcoding of the extension validator (remm) 13924: The spec states if an error page declaration doesn't match the original exception and the exception is an instance of ServletException then the exception should be unwrapped and a second pass made of the error page declarations (markt, luehe) 28272: Deploy manager command should use context.xml from war file (luehe) Added support for exception chaining if JDK 1.4 is present (luehe) Optimization: delay parsing of the cookies (remm) 19521: Add warning to RequestDumperValve docs to make users aware of possible side effects (markt) java.lang.NoClassDefFoundError: org/apache/tomcat/util/compat/JdkCompat during startup on some systems (luehe) Avoid NPE if there are no extensions, and validating extensions is attempted (remm) 19545: CGI issues with CONTENT_LENGTH (markt) Expose more of the session management methods at the top-level Manager interface (luehe) 18141: Support parameters with multiple values in CGI servlet (markt) 9851: Digest authentication failed with Mozilla and other issues re RFC2617 (markt) Always introspect for protocol hadlers, so that the attributes are meaningful (remm) Remove static reference in the memory protocol handler, since the JMX registration is functional (remm) Stop the manager earlier, so that listeners are still present (remm) Allow extending SSO functionality, submitted by Brian Stansberry (remm)

Coyote

Set the RMI port to the one provided in parameter in JK (hgomez) Small memory usage optimization in the adapter (remm) Treat the IS, OS, reader and writer as facades, which will be cleared after each request if the security manager is enabled (remm) 19254: Provide a basic implementation for the clean-native target, submitted by marcs (markt) Test and related updates for the in memory protocol handler, allowing to specify the URI as a String, or (better) a char array (remm) 28674: Make duplicate more friendly to a subsequent reallocation (remm) Fix URI normalization where the URI is "/." (remm)

Jasper

28244: XML Comment between jsp:attribute causes attributes after the comment to be ignored (kinman) 19049: Clarify error message when nesting exceptions, submitted by Joseph Shraibman (markt) 28361: foreach no longer works in tag file (luehe) Added support for exception chaining if JDK 1.4 is present (luehe) Moved check for JSP resource existence into synchronized block (if JspServletWrapper==null), to avoid having multiple threads check for it simultaneously (luehe) Added number of JSPs that have been *re*loaded to set of monitorable attributes (luehe) Fix a bug where a custom tag with tagdependent body type is not handled correctly in XML syntax (kinman) 28380: Javac error with ':' and '.' in attribute names (kinman) When in deployment (ie., !development) mode, save any compilation exceptions and rethrow them (instead of recompiling and getting the same exception over and over again) until the next scheduled recompilation (luehe) Close URLConnection's InputStream after getting lastModified date, submitted by martin (luehe) 28147: Remove canonicalization, which is not very useful here, and can cause trouble with symlinks, submitted by Rick Wong (remm) 28603: JspC Ant task does not detect errors on a second compile (luehe) 28604: JspC should not display the whole stack trace of errors (luehe) Fixed another incidence where URLConnection was not closed when checking for lastModified date of included resources (luehe)

Cluster

28161: The "smart" queue will now use the session message getUniqueId instead of sessionId, this makes sure that no messages are overridden when the queue fills up (fhanik) The async replication thread will now properly exit when members join or leave the cluster (fhanik) Make sure to close the channel upon server stop (fhanik) Membership alive time gets updated with each new broad cast, this will keep the membership updated with the exact lifetime of each node, the cluster sorts its members by desc alive time, and change the started flag to be set earlier in the DeltaManager (fhanik) Added all the interestOps to the synchronized blocks to guarantee non blocking behaviour at all times, submitted by Rainer Jung (fhanik) Added in the ability to run the DeltaManager/DeltaSession without a container, so that a different clustering plug in can be used to backup sessions in a primary/secondary store (fhanik) Setting the interface on the multicast service if there is a bind address (fhanik)

Webapps

Add missing keys - connector.useBodyEncodingForURI allowTrace (amyroh) Add DataSourceRealm support in admin webapp (amyroh) 20786: Manger webapp session output not formatted correctly for session inactive for less than 10 minutes (markt) 28524: Exception throw when creating new JNDI data source (amyroh) Display GlobalNamingResource config if web.xml has resource-ref definition without Context Resource config (amyroh) Change to list any additionally JNDI data-sources that are present in the web.xml file, but not defined either globally or at the context level, on the context level maintenance page to make it possible to click on the data-source and edit it (amyroh)

General

New procrun 2 Windows wrapper (mturk) Xerces 2.6.2 (remm)

Catalina

Fix getContext("/") so current context is returned if called whilst in the root context (markt) Refactor the Extension validator without using a singleton pattern to fix a possible NPE (remm) Allow webapp to override JspServlet (settings) inherited from global web.xml (luehe)

Coyote

Add detection for JDK 1.5 (billbarker) 16157: Set AuthType on HttpServletRequest, submitted by Kan Ogawa (markt) Add public method consistently (jfarcand)

Jasper

Moved initialization of 'varName' to where it is needed (luehe) Allow disable tag pooling for ant task (and command line option) in jspc (funkman) 28236: when reallocating, make the buffer grow faster (512 bytes at a time was not sufficient) (remm)

Modules

28131: Fix expiration of delta sessions (fhanik) access() on a session should not set isNew false (fhanik) 28259: fixed the blocking interestOps(), although selector.select() still doesn't wakeup when a new request comes in (fhanik)

Webapps

Remove resource bundle which was causing problems in the admin webapp (remm)

General

Updated procrun binaries (mturk)

Catalina

Add support for xml validation/namespaceAware at the context level (jfarcand) 18479: Non-serializable sessions attributes should be removed (so valueUnbound is called) (markt) javax.naming.NamingException after a Stop/Start cycle of a web app (jfarcand) 18626: Make clear which file digester failed to parse (markt) When principal caching is disabled, the saved request wasn't used by the FORM authenticator (remm)

Coyote

27917: Make certain that the endpoint is closed, even if Apache has already dropped the connection (billbarker) Change to the absolute path using %CD% for setting CATALINA_HOME (mturk) gzip compression can also be used in HTTP 1.0 (hgomez)

Jasper

27830: undefined EL variable in unterpreted text (XML syntax) causes "null" (instead of) "" to be generated (kinman) Return 500 error code if JSP error page mechanism is invoked (the current impl used to return 200) (luehe) 16830: bodyContent content not reset when a tag is reused (kinman) 27948: NPE with null fragment (luehe) 27665: Nested tags with scripting variables generates invalid code (kinman) 28058: JspRuntimeLibrary.getContextRelativePath() can throw StringIndexOutOfBoundsException (kinman)

General

Update to Apache License 2.0 (billbarker, hgomez, jfarcand, luehe)

Catalina

The defaultHostName may be alias, so we need to also try to find if the registered hosts' aliases contains the defaultHostName (jfarcand) 27108: Use catalina.home in the docBase for all core webapps (remm) 27077: Port fix for NPE is data source realm (remm) Fix some setters and operations in MBeans (remm) 27127: Shutdown doesn't work with custom server port and non-default config file (remm) Fix logging of errors when pausing and resuming connector (remm) 27293: Fix if-unmodified-since check, using the old-and-simple trick of adding 1000 (remm) Provide an implementation for getName() and getPassword() in UserDatabaseRealm, to add support for client cert (markt) 27309: NPE fix if there's no local session when doing cross context (remm) 27276: Fix NPE when a null password is set, submitted by Rohan Lenard (remm) Reuse already existing util code in deployer (remm) Clone arrays returned by getParameterValues() and getCookies() when a security manager is in place (luehe) Register all classloaders with JMX, so that Tomcat is actually manageable through JMX remote, and move jmx.jar to bin (remm) 19852: Don't remove application parameters on stop (makt) Avoid serializing Subject/Principal when persisting the session (jfarcand) Make stats counters volatile (remm) 27447; Pos should be reset in case of a long line (of course), and reset/skip is useless (it is allowed to just put another mark) (remm) Fix mark/reset functionality (remm) 27478: Fix crossContext flag when dispatching back to the original context (remm) Much less verbose logging when there's a bad cookie (remm) Add two MIME types, submitted by Scott Pontillo (remm) Add error message about the absence of JMX when running standalone (remm) Initialize accessCount to 0, and call access when creating a session and in crossContext creations as well (remm, luehe) 17690: Display more helpful error message if docBase is invalid for a WAR (mart) 17859: Provide cygwin friendly JAVA_ENDORSED_DIRS property (markt) Include session cookies in HttpServletRequest.getCookies() (luehe) 18369: Prevent npe in StoreBase if a sql exception occurs (markt) 27752: Due to the use of the '#' special char to replace '/', the URL must be handled in a special way (remm)

Coyote

27050: keystoreFile parameter, when specified as relative, is not treated relative to $CATALINA_BASE or catalina.base property (luehe) Fix JMX Request registration in JK (billbarker) 27033: Encode the address in the protocol name (remm) Set minSpareThreads / maxSpareThreads in JK (hgomez) 27299: Make sure HexUtils is accessed before some output is made (remm) 20184, 24763: getLen returns the length excluding the header (truk) In makeSpace, we should compare the desiredSpace to the limit, so that we actually allow enough (remm) 27513: Fix off by one when terminating threads, submitted by Sergei Zhirikov (remm) Add flag to disable optimized output (which causes problem when using the buffers for input) (remm) Fix problems with finding the Adapter in TC 5 (billbarker) 27629: Call close to release native memory, submitted by Christian Nester (remm) 27704: Result of request.getServletPath() wrong in case JSP inside jsp-property-group (luehe) If using clientAuth="want", then don't change it to "need" when requesting the cert for CLIENT-CERT auth (billbarker) Fix exception when attempting to pause the channel w/o specifying an address, and fix problem where requests weren't being unregistered because of a misformatted Msg (billbarker) Fix thread unregistration in JK (billbarker)

Jasper

When security is on, propagate potential ClassNotFoundException instead of swallowing it and just dumping its stack trace (luehe) Add some intellignece to the compiler for generating code for useBean action. Generate direct instantiation (use new) when possible, use bean.instantiate when bean name is specified, and for the case of invalid bean class, either issue a translation time error (instead of javac error), or generate codes to throw InstantiationException at runtime, depending on a new compiler switch, errorOnUseBeanInvalidClassAttribute(defaulted to true) (kinman) According to the spec, it is a fatal error for the taglib directive to appear after actions using the prefix introduced by it (remm) Close input stream to web.xml (luehe) 27300: Wrong Smap when jsp comments are present (remm) 27330: pageContext not defined in the body of nest tags (kinman) 27338: Wrong Smap line for CDATA in scriptlets in .jspx pages (kinman) 27368: Annotate several node types with missing Java line information (kinman) hen a.jsp jsp:includes b.jsp that jsp:includes c.jsp, the context relative path for c.jsp is computed incorrectly (kinman) Added JSP monitoring facility (luehe) 27517: The pageEncoding attribute is not used, when charset value is set (luehe) Fix SMAP mapping for inner classes (kinman) 27520: Avoid NPE when folder is not readable (remm) 16113: Removing then replacing a jsp page continues to give a 404, submitted by Torsten Fohrer (kinman) 14359: Remove last traces of largefile option (markt) 27642: trimSpaces property not settable via command-line options (luehe) 18005: Provide a better error message if session expires during login process (markt) 27664: Welcome files not found in combination with jsp-property-group (luehe) 14228: Fix access to environment entries during webapp early startup (remm) 13499: If page output is unbuffered, illegal state exception is no longer thrown on forward if and only if nothing has been written to the page (markt)

Webapps

27307: Improvements to DataSource HOWTO, submitted by Felipe Leme (remm) Escape '?' in generated XML of status servlet, submitted by Peter Lin (remm) 25160: Improve I18N for admin, submitted by Takashi Okamoto (amyroh) 20770: Admin Tool removes "workDir" attribute from "context" (amyroh) 16507: Update valve docs to provide pointer to the Jakarta Regexp docs (markt) Add JSP status info to the status servlet (luehe, remm) 24085: Display group and role list when validation fails (amyroh)

Modules

26988: Remove unnecessary line feeds from stdin stream of the CGI servlet, submitted by Kevin Schantz (markt) Fix some docs bugs, including 27183 (remm, markt) 27090: Make parameter encoding configurable (markt) 27100: Remove lock obsfucation functionality as it breaks a number of webdav clients and does not appear to be covered by the webdav spec (markt) Some minor clustering updates (fhanik) Reenabled the doRun flag in the multicast service (fhanik) 27190: Ensure webdav servlet returns correct status in response to MOVE request (markt) The new and valid flags have to be set before the creation listeners are invoked (fhanik) Added in the server ip and port for debug purposes when logging a ACK timeout (fhanik)

General

Updates and additions to Spanish translations, submitted by Jesus Marin (larryi) Remove nearly all compiler warnings: remaining bad imports, deprecated digester and modeler usage (remm) Add new build targets for Gumpy (billbarker) Update to NSIS 2.0 (remm) Update to latest commons-daemon (mturk) Add support for silent installations in the NSIS script (remm)

Catalina

12363: valueBound() must be called before the object is made available via getAttribute(), submitted by Pablo Morales (makt) 26237: fixed a typo in MemoryUserDatabase which would cause problems if the pathname is aboslute, submitted by Xavier Poinsard (remm) 26261: don't call expire after calling isValid, submitted by Paul Harvey (remm) Use response encoding when generating error report (luehe) 26051: session must not expire even if the request processing time is bigger than the session timeout (remm) Optimize session access: remove synchronization, minimize object allocation for events, and reduce the amount of hashtable lookups (remm) Replaced SC_INTERNAL_SERVER_ERROR with SC_FORBIDDEN if anonymous access is not allowed (luehe) 11042: comment in server.xml now shows that connectionTimeout should be set to 0 rather than -1 to disable timeout (markt) Try to fix some character corruption in non-English resource strings in the nightly build (larryi) Improvements to session activity tracking, handling the case where the session is new, as well as cross context (remm) 26341: when calling the removeAttributes during session expiration, notified attributes should see the session as invalid (remm) 26010: '_' was an inappropriate character to replace the path separator, since it's a common character in HTTP; '#' will be used instead (remm) Add missing setUseContextClassLoader call to avoid possible classloader issue when Tomcat is embedded (jfarcand) Update service shutdown procedure: pause connectors, wait for a while, stop the container, stop connectors (remm) Strip out any path parameter when doing request dispatcher mapping (luehe) Throw the proper exception type when a name is already bound, submitted by Robert Kruger (remm) 26414: add support for liking to user transactions, submitted by Robert Kruger (remm) 26373: initialize mapper before load on startup servlets (remm) Ignore setBufferSize()/setLocale() calls on included response (luehe) 26611: forward + include was hiding the special forward request attributes (remm) 26487: RFC 2254 done on whole string instead of just DN, submitted by Jeff Tulley (funkman) 26715: Call endAccess after reading a session from storage so that the session properly timeouts, submitted by Jochen Strunk (remm) Fix rule matching algorithm for one character constraints, such as /s/* (billbarker) Added support for configurable session id length (luehe) The forward request attributes must reflect the original request, so only set them if the request being passed doesn't have them (remm) 26838: refactor once again the enum algorithm (remm) 14283: Catch and log exceptions in listeners (markt)

Coyote

Fix JMX self-registration of JK when loading the "normal" way (billbarker) Add an option to allow the admin to *not* JMX register the requests, since reclaiming memory can be difficult in JNI mode (billbarker) Add request unregistration, to avoid the memory leak which was affecting HTTP (billbarker) Fix the problem that every Handler was getting added twice (billbarker) Handle unregistering Requests for ChannelUnix (billbarker) Don't create a monitor thread unless maxSpareThreads is smaller than maxThreads (remm) Allow configuring the size of the HTTP header buffer, which represents the majority of the memory allocated by Tomcat; the new default value is 4KB (remm) Allow the option to only "want" client authentication, submitted by Michael Becker (billbarker) Implement clean shutdown of the connectors, using new pause and resume methods on the connector interface (remm) Add support for connector pause to JK (billbarker) Cleanup the logging for unknown packets in JK (remm) Avoid java.util.ConcurrentModificationException seen with very high load in RequestGroupInfo (luehe) 26492: consider all session ids sent as cookies until one is valid; also don't create cookie objects from sessionId cookies, which seems consistent with sessionId hiding from the URL (remm) 25805: add localDataSource flag, based on code submitted by Neil Katin (remm) 26567: the mapper will complain if the default host is not known, which could make mapping fail without a way to easily identify the cause (remm) 25363: Expose the SSL attributes in getAttributeNames() (remm) Make sure a filter is always added in all cases (remm)

Jasper

26191: fix classcast exception is JSP document parser, submitted by Trond Aasan (remm) 26242: add back a setVerbose setter to jspc for compatibility with Ant (remm) 26276: generated TLD inconsistent after tagfile changes (kinman) 26335: modification check for tagfiles does not work recursively (kinman) 26432: Incorrect mapping for url pattern in jsp property group (kinman) Implicit "pageContext" object no longer exposed in tag files, to comply with JSP spec (luehe) 26628: Fix handling of a EL function with no arguments (remm) Convert selected tag attribute types to their Fully-Qualified-Name equivalents if the taglib is JSP 1.2 based (luehe) Ported (from org.apache.catalina.startup.TldConfig) ability to ignore (for TLD scanning purposes) JARs (in the classloader delegation chain) that are known not to contain any TLDs (luehe) 13960, 13961: Javadocs fixes, submitted by David Medinets (markt) 26796: include fails when tag files are referenced in a tag directives (kinman) Parser for JSP pages in XML syntax ignores custom action's body type (luehe)

Modules

12361: support CGI scripts in unpacked WARs: scripts are extracted to the context work directory before execution (markt) Add support for URIEncoding, useBodyEncodingForURI, and allowTrace properties on the connector (larryi) Updating the admin webapp for the change in type of clientAuth (billbarker) Add WebDAV webapp to TC5 (markt) 13805: update docs to show that the shared directory is relative to CATALINA_BASE not CATALINA_HOME (markt) Added in distributed expire logic for the delta session (fhanik) Added in a module cluster interface (fhanik) Refactored a lot of the cluster code: the cluster element has sub elements, makes the configuration is modular (fhanik) Document other methods for load balancing (remm) Document that Context elements should not be placed in server.xml (yoavs, remm) Add examples, introductory notes, and a brief how-to notes for tag plugins (kinman) Fixed bug with the fact that the manager base has a static variable called name, caused session messages to be sent to the wrong managers (fhanik) Fixed serialization of principal when replicating data (fhanik) Port various session fixes (fhanik) Small docs updates for CGI and others (idarwin) 26906: The destination path needs to be normalised after the protocol and host has been removed (if present) (markt) Lock token must be returned after lock creation, submitted by Pieter van Prooijen (markt)

General

Fix packaging of the source .tar.gz (remm) Fix bug in the netbuild where the script would always attempt to checkout the sources (jfclere) 26162: Fix typo in the minimal config (remm)

Catalina

Remove CGI servlet dependency on JDK 1.4 (markt) 26171: Fix NPE in AccessLogValve during a reload (yoavs)

Coyote

Fix memory leak when spare threads are destroyed (remm, fhanik)

Modules

Implemented the ability to not expire sessions on shutdown, since that will expire them across the cluster (fhanik) Fix initialization of the session in delta manager (fhanik)

General

Add minimal server.xml (yoavs) Upgrade to Xerces 2.6.0 (remm) Add service.bat for NT service installation/uninstallation (mturk) 10286: Fix license typos (markt) Upgrade to NSIS RC 2, and add metadata to the generated installer (remm) New jsvc 1.0 Unix daemon wrapper (remm) New procrun 1.0 Windows service wrapper (billbarker)

Catalina

Properly implement new API methods getLocalName and getLocalPort (jfarcand) 25193: Don't attempt to parse the parameters if the request body wasn't fully read (remm) 25234: isValid already expires sessions, so backgroundProcess shouldn't call expire again, submitted by Paul Harvey (remm) Sync catalina.properties included in the JAR with the main one (remm) Fix WebDAV servlet issues: 23999, 24001, 24005 (markt) Managers cleanup, add stats and JMX for the PersistentManager (remm) Cache the result of getURLs, which was a major performance problem when using RMI from Tomcat (remm) Fix authentication and authorization compliance with the final specification; also optimize algorithm (billbarker, remm) 7080: Handle a null username correctly, submitted by Tim Walsh (markt) JNDI realm fixes: 23190, 16541 (funkman) 23885: Strings for JAAS realm (funkman) 5762: Include port in HTTP_HOST environment variable, submitted by Martin Dengler (markt) 5759: CGI servlet does not support extension mapping (markt) 25593: Set all common resources attributes on start, including allowLinking (remm) Reset the repositories array on certain method calls, and override addURL to set hasExternalRepositories to true (remm) Improve creation of cross context sessions: they will now timeout correctly and they will appear as new when created (remm) 8859: Correct namespace handling for lock owners in WebDAV servlet (markt) Add a minTime attribute on servlets (remm)