-
1. Re: don't give client jsp files
chudak May 28, 2004 5:47 PM (in response to zhangj)Precompile all your jsp's and put them in the war instead of the jsp's.
-
2. Re: don't give client jsp files
genman May 28, 2004 7:03 PM (in response to zhangj)
You can precompile your JSPs using JSPC in ant.
The web.inc is used as part of the web.xml file. -
3. Re: don't give client jsp files
hbaxmann May 29, 2004 5:51 AM (in response to zhangj)Not precompiled JSP's could be a real security flaw. Under some circumstances the client will be able to generate his own code and send it to the container.
< %
System.exit(0)
% >
will be very funny then.
unfortunately in german: http://tomcat.objektpark.org/pdf/04_04_tomcat_JM.pdf
bax -
4. Re: don't give client jsp files
zhangj May 31, 2004 2:07 PM (in response to zhangj)I tryed this:
made a jsp file put under default\deploy\myweb.war\myjsp.jsp
call this jsp from browser,this jsp compiled and generated class is default\work\MainEngine\localhost\myjsp_jsp.class
delete default\deploy\myweb.war\myjsp.jsp and put myjsp_jsp.class under default\deploy\myweb.war\,use jar create a myweb.war.
delete myweb.war folder and put myweb.war file under deploy,the myweb.war file is contain myjsp_jsp.class,but when I call this jsp from browser myjsp.jsp it doesn't work.
where am I wrong? -
5. Re: don't give client jsp files
zhangj Jun 2, 2004 9:42 AM (in response to zhangj)any body knows?