Tomcat 5.5.26 (fhanik)

General

Use Eclipse JDT 3.3.1. (pero)
Use new commons download location. (markt)
Use commons-launcher 1.1. (markt)
Use commons-digester 1.8. (markt)
Use Xerces 2.9.1. (markt)
Remove usused commons-httpclient. (funkman)
Use commons-collections 3.2. (markt)
Use commons-fileupload 1.2. (markt)
Use MX4J 3.0.2. (markt)
Use JUnit 3.8.2. (markt)
Use NSIS 2.34. (markt)
Use Struts 1.2.9. (markt)
Use JAF 1.1.1. (markt)
Use JTA 1.1. (markt)
Use JavaMail 1.4.1. (markt)
Use PureTLS 0.9b5. (markt)
Use commons-pool 1.4. (markt)
43594: Use setenv from CATALINA_BASE (if set) in preference to the one in CATALINA_HOME. Patch provided by Shaddy Baddah. (markt)
Fix CVE-2007-5342 by limiting permissions granted to JULI. (markt)

Catalina

38131: WatchedResource doesn't work if app is outside host appbase webapps. Patch provided by Peter Lynch (pero)
Set correct sessionCounter at StandardManager after reload sessions. (pero)
Fix NPE situation at AccessLogValve (pero)
30949: Improve previous fix. Ensure requests are recycled on cross-context includes and forwards when an exception occurs in the target page. (markt)
43216: Set correct StandardSession#accessCount as system property STRICT_SERVLET_COMPLIANCE is true after application restart with SESSION.ser file. Patch provided by Takayuki Kaneko (pero)
Made session createTime accessible for all SessionManager via JMX (pero)
Support logging of all response header values at ExtendedAccessLogValve (ex. add x-O(Set-Cookie) to your pattern). (pero)
Support logging of current thread name at AccessLogValve (ex. add %I to your pattern). Usefull to compare access logging entry later with a stacktraces. (pero)
o.a.juli.ClassLoaderLogManager handle more then one system property replacement at file logging.properties. (pero)
43236: Reset usingWriter and associated flags when response is reset. (markt)
43241: ServletContext.getResourceAsStream() not spec compliant. Patch provided by John Kew. (markt)
43675: Fix a possible logging related class loader leak. (markt)
43687: Remove conditional headers on Form Auth replay, since the UA (esp. FireFox) isn't expecting it. (billbarker)
Fix bug in CGI Servlet that caused it to fail when a CGI resource was included in another resource. (markt)
Cookie handling/parsing changes! The following behavior has been changed with regards to Tomcat's cookie handling:
a) Cookies containing control characters, except 0x09(HT), are rejected using an InvalidArgumentException.
b) If cookies are not quoted, they will be quoted if they contain tspecials(ver0) or tspecials2(ver1) characters.
c) Escape character '\\' is allowed and respected as a escape character, and will be unescaped during parsing.
43839: URL based session tracking fails when session cookie from parent context is present. Based on a patch by Yuan Qingyun. (markt)
43887: Include exception in the log message. (markt)
43914: Location headers must be encoded. Patch provided by Ivan Todoroski. (markt)
43957: Service.bat didn't configure logging correctly. Patch provided by Richard Fearn. (markt)
44041: Fix duplicate class definition error under load. (markt)
44084: JASSRealm is broken for application provided Principals. Patch provided by Noah Levitt. (markt)

Jasper

43702: Reduce length of unnecessarily long class names for the inner helper class when using simple tags. (markt)
43757: Rather than use string matching to work out the line in the JSP with the error, use the SMAP info and the knowledge that for a scriptlet there is a one to one line mapping. (markt)

Cluster

Fix FarmWarDeployer can be only configured at host subelement (pero)
Fix wrong && at ReplicationValve (pero)
DeltaManager sessionCounter must be also increment at relicated sessions. (pero)
Made attribute createTime accessible for all DataSenders. (pero)

Webapps

Fix CVE-2007-5461, an important information disclosure vulnerability in the WebDAV Servlet. (markt)
43611: Provide an error message when trying to upload a WAR for a context that has been defined in server.xml. (markt)
44094: Add note to docs about side-effects of setting privileged on a context. (markt)

Coyote

43479: Fix memory leak cleaning up sendfile connections. (markt)
43622: Don't always overwrite min compression size with default. (markt)
43995: No timeout for sendfile (TODO item had been forgotten). (markt)

Přílohy