Best unofficial Apache Server developers community
Username
Forgot password?
Sign in with Twitter account
Sign in with Facebook account
List archives

DO NOT REPLY New: FORM authentication POST replay broken for AJP

svn commit: r1240700 - in /tomcat/tc7.0.x/trunk: ./ conf/web.xml webapps/docs/changelog.xml
(19 lines)
svn commit: r1240795 - /tomcat/trunk/java/org/apache/catalina/core/StandardEngine.java
(19 lines)
Feb 5, 2012
Bugzilla
Bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=52606

             Bug #: 52606
           Summary: FORM authentication POST replay broken for AJP
           Product: Tomcat 7
           Version: 7.0.25
          Platform: PC
        OS/Version: Windows XP
            Status: NEW
          Severity: regression
          Priority: P2
         Component: Connectors
        AssignedTo: d### @tomcat.apache.org
        ReportedBy: knst.ko### @gmail.com
    Classification: Unclassified


Reported and discussed in the following thread on us### @:
"Form Authentication POST data not preserved?"
http://markmail.org/message/pldgbe4jbnb46ha4
http://marc.info/?t=132830976900001&r=1&w=2

This supposedly has the same trigger as the issue reported in Comment 9 in
bug
51940 [3], that is consuming the body of the original request before
replacing
it.

[3] https://issues.apache.org/bugzilla/show_bug.cgi?id=51940#c9

In AbstractAjpProcessor$SocketInputBuffer#doRead() there is a check for
"endOfStream" flag. If the flag is set the method returns immediately and
does
not use the bodyBytes field that was initialized to replay the body.

The fix is to add the following line to "REQ_SET_BODY_REPLAY" case in
AbstractAjpProcessor#action(), as confirmed on the use### @ thread:

  endOfStream = false;


In 6.0.x implementation of AjpProcessor$SocketInputBuffer and of replay
action
is the same, but I have not tested whether this bug can be triggered there
or
not.




Reply
Tags: bugzillareplayauthenticationapache
Messages in this thread
DO NOT REPLY New: FORM authentication POST replay broken for AJP
Form Authentication POST data not preserved?
February 3, 2012 04:51:53 PM
I posted a query recently wherein I thought that POST data was being lost *only* if the user had been authenticated, their session timed out, and then they POST'ed to a URL requiring authentication -- thus having their request interrupted for a…
DO NOT REPLY New: NPE during the form authentication when form-login-config is missed
May 27, 2011 07:04:52 AM
https://issues.apache.org/bugzilla/show_bug.cgi?id=51277 Bug #: 51277 Summary: NPE during the form authentication when form-login-config is missed Product: Tomcat 7 Version: 7.0.12 …
DO NOT REPLY data lost when post a multipart/form-data form
July 23, 2010 09:52:21 AM
https://issues.apache.org/bugzilla/show_bug.cgi?id=49035 --- Comment #2 from Alexandre PETRILLO <alexandre.petrillo@gmail.com> 2010-07-23 10:52:16 EDT --- This is a simple jsp testcase. There is a form with enctype="multipart/form-data" and…
DO NOT REPLY data lost when post a multipart/form-data form
July 23, 2010 09:48:38 AM
https://issues.apache.org/bugzilla/show_bug.cgi?id=49035 --- Comment #1 from Alexandre PETRILLO <alexandre.petrillo@gmail.com> 2010-07-23 10:48:30 EDT --- Created an attachment (id=25798) -->…
DO NOT REPLY data lost when post a multipart/form-data form
August 10, 2010 02:00:02 AM
https://issues.apache.org/bugzilla/show_bug.cgi?id=49035 Michael Diener <md### @gmx.de> changed: What |Removed |Added
DO NOT REPLY New: Form Authentication Valve should restore request body on PUT method
October 3, 2011 11:15:34 AM
https://issues.apache.org/bugzilla/show_bug.cgi?id=51940 Bug #: 51940 Summary: Form Authentication Valve should restore request body on PUT method Product: Tomcat 6 Version: 6.0.33 …
Created: (SLING-1564) have the form authentication handler include the login form as a resource rath
June 21, 2010 09:05:55 PM
have the form authentication handler include the login form as a resource rather than doing a redirect
Created: (AMQ-2832) Possible replay of old messages post index recovery from journal - data files co
July 16, 2010 09:07:51 AM
Possible replay of old messages post index recovery from journal - data files containing acks reclaimed/cleaned up in error
authentication and cookie authentication from web form examples
August 13, 2010 08:54:35 PM
I would like to see some examples of a html form sending register, login, forgot password etc to couchdb database and how the results are processed from a html page. I have read the wiki and the definitive guide but neither really have an example…
Form post as submission...
July 22, 2010 02:17:17 PM
I'm doing a form submission as a way to enter information into a Sling repository. I need a little advice on how to approach the following problem. I have an order and the order has line times, and the line times are ordinal. I want to end up…
Re: Form post as submission...
July 23, 2010 08:56:11 AM
On Fri, Jul 23, 2010 at 15:24, Justin Edelson <justinedelson@gmail.com> wrote: > Pretty sure :nameHint can't be used for anything other than the > top-level node submitted in a post. > > <input type="text" name="name"…
Submitting POST with x-www-form-encoded
July 19, 2011 05:00:50 PM
I need to POST to a login form with the specification <form name="loginForm" METHOD="post" ACTION="/arsys/servlet/LoginServlet" enctype="x-www-form-encoded"> For this I have to questions 1. I dont understand how the form action is…
allow exceptions for certain fields in a form POST
January 17, 2012 11:09:37 AM
Hi all, I currently have rules setup with LocationMatch which will allow exceptions for the entire web page . will it be possible to allow exceptions for only certain fields in the page? Regards, Abey
HttpComponents 4.0.1 - POST + File Transfer + Form
December 10, 2010 01:58:50 AM
Hi to all, I have the following http://imagebin.ca/view/vt_QBTQ6.html form which i like to post data to...and i have the following code: DefaultHttpClient httpClient = new DefaultHttpClient(); String triggerJobUrl =…
POST form parameter parsing order
December 30, 2011 03:36:05 AM
Hello All, I am using Tomcat 5.5.30 and am affected by the hashtable collision DoS vulnerability. I wanted to know if the Request parameter parsing is always invoked? Or is it only performed once a servlet asks for a parameter? Meaning if my…
Modify the body of a post request Multipar/form-data?
June 10, 2010 01:34:26 AM
Hi, I have a Firefox module that encrypts the body content for a POST and GET request. The apache module must decrypt the content and send a crypted reply to the client. So, in my apache module, i have a filter to modify the body. For a POST …
Clarify the optional use of application/x-www-form-urlencoded for POST operation parameters in the D
August 22, 2011 08:41:24 AM
From: marios <mari### @redhat.com> Signed-off-by: marios <mari### @redhat.com> --- site/content/api.mdown | 105 +++++++++++++++++++++++++++++++++++++
form-based authentication
September 10, 2010 07:08:56 PM
In one of our projects, we are trying to use form-based authentication in CRX. We have Apache Sling API 2.1.0 (org.apache.sling.api), Apache Sling Authentication Service (org.apache.sling.auth.core) 1.0.2 and Apache Form Based Authentication…
form based authentication with CRX
September 21, 2010 12:51:59 PM
I have built sling from svn and form based authentication works as expected. When starting Sling, <http://localhost:8080/system/console/slingauth> http://localhost:8080/system/console/slingauth shows "Apache Sling Form Based Authentication…
Form Authentication vs. Tomcat Restart
December 6, 2011 05:12:58 PM
When doing a graceful shutdown of Tomcat, the sessions are persisted to disk and then re-read on startup (at least in all reasonably recent versions). Oddly, however, form-based authentication does not seem to survive a graceful restart. …
Broken links and styles on form post to mysql, is it because of mysql_real_escape_string ?
February 24, 2011
in order to keep safe was told to use mysql_real_escape_string before sending to Mysql if i'd be displayed well i do: .... $b =…
Form dynamics broken in Firefox
May 31, 2011
I am currently in the process of creating a simple CMS designed specifically for the needs of my customer. The overall design uses a mysql database…
Form GET works, Form POST does not
April 2, 2011
I have a simple form that behaves as expected when method="GET" , but when method="POST" , it does not. FORM: <form action="/login"…
Starcraft replay regex, bracket troubles
May 19, 2011
[2v2] race=[TPvZP] map=[Monlyth Ridge] players=[player 1(T)(w), player 2(P)(L) vs player3(Z)(W), player4(P)(W)] Length=[00-10-06] Working in a…
Form authentication with Tomcat
January 20, 2011
I am trying to implement form based authentication with Tomcat. All my secured servlets are mapped under mydomain/myapp. I am able to secure this…
Tomcat FORM based authentication, on every page
May 28, 2011
Hi, I would like to use authentication form on every page (in the header of the page), so user could authenticated from any page. I'm using Tomcat's…
Can I use a form to submit credentials to Basic Authentication?
February 23, 2011
I have a site that's using Basic Authentication via .htaccess and a .htpasswd file. I would really like to be able to have a form that would submit…
Login authentication with jquery modal form
March 30, 2011
What I want to do is when some one enters Name , Email , Password and Hit Button Create an Account . It should go to mysql database and check if…
Problems with C# HTTP Post with Authentication
May 24, 2011
Hello Community, I'm trying to send some XML through HTTP Post. But I'm getting 401 Unauthorized . Funny thing is when I access the URL through the…
Java Digest Authentication POST XML
March 31, 2011
I am in need of some help getting DIGEST Authentication to work. I am using the apache 4.1 library. When i try to login i get. Exception in thread…
Programmatically download file from servlet using form authentication on Tomcat
March 23, 2011
Hello, We have a servlet which generates a report and allows user to download it as a CSV file. The servlet is deployed on Tomcat and secured using…
SSL form POST from one site to another
May 23, 2011
I am attempting to do a POST securely from one website to another. Instead of trying to do our own encryption or hashing I would like to use SSL. Is…
How to use foreach in php form post
March 26, 2011
I am trying to use a foreach LOOP to read every element in a form array to post to the mysql table. It prints the right statement but when i use…
In Ruby language, how to post data to a web page that need authentication?
January 6, 2011
Hi, I use e-texteditor as my primary editor, in which you can execute dynamic languages directly, such as Ruby, Python, Perl etc. Now I want to…
POST form values over HTTPS
January 30, 2011
Hi there I'm fairly unfamiliar with HTTPS, but I know it's secure, what I want to know is when a user logs in with details on a form, are the…
Htaccess form POST doesn't work?
April 4, 2011
Hi, I have a form with an action that redirects to a page; <form method="post" action="active"> The "active" page is a rewritten rule;…
Can a PDF fillable form post itself to an HTTPS URL?
January 7, 2011
I am building a webapp that will display PDFs. The PDFs have fillable forms. Instead of making the user save the form, and then re-upload it to the…
Post form with file upload
April 24, 2011
I was searching an HTML form which consists of some text-box, radio-button, check-box, text-area, select-option and browse fields with validation.…
Cross Domain AJAX POST / HTTPS / Header Authentication?!
April 1, 2011
I have to issues: 1) I've tried using JsonP, but can't get POSTing to work. Essentially, I'm trying to authenticate with an API, passing a…
Http Form post in web hosted environment
April 22, 2011
Hi guys, I am newbie in PHP, HTML, MYSQL & web hosting. i have mamp setup on my development machine. Everything went well. When i put the file…