Block Directory Listings

[jcash]

How do you stop directory listings in JBoss?

When the http requests maps to a physical directory location within a deployed war file, the contents of that directory are listed in the response. How can this default behavior be stopped, so that a 'resource not found' or other similar exception is thrown.

On tomcat the following entry in web.xml should work.

<init-param>
 <param-name>listings</param-name>
 <param-value>false</param-value>
</init-param>

but this doesn't work within JBoss.

Any help would be much apprecieated.

[anguyen]

I haven't tried this, but it looks it should work.

To change this setting for all webapps deployed in JBoss, change deploy/jbossweb-tomcat55.sar/conf/web.xml:

from

 <servlet>
 <servlet-name>default</servlet-name>
 <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
 <init-param>
 <param-name>debug</param-name>
 <param-value>0</param-value>
 </init-param>
 <init-param>
 <param-name>listings</param-name>
 <param-value>true</param-value>
 </init-param>
 <load-on-startup>1</load-on-startup>
 </servlet>

to

 <servlet>
 <servlet-name>default</servlet-name>
 <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
 <init-param>
 <param-name>debug</param-name>
 <param-value>0</param-value>
 </init-param>
 <init-param>
 <param-name>listings</param-name>
 <param-value>false</param-value>
 </init-param>
 <load-on-startup>1</load-on-startup>
 </servlet>

[jcash]

Thanks, that works fine. I also managed to get it to work by moving the complete servlet and servlet-mappings sections to the web.xml within my deployed WAR file. This allowed me to have different list directory settings on a per deployed application basis.

It is also possible to copy the sections, so that the web.xml in tomcat provides the default behaviour but the deployed xml can override that behaviour. In order to get this to work the servlet name needs to be changed in the deployed web.xml file.

Thanks

Jamie