Uploaded image for project: 'Application Server 3  4  5 and 6'
  1. Application Server 3 4 5 and 6
  2. JBAS-1896

Disable full class and resource access by default in RMI dynamic class loading service

    XMLWordPrintable

Details

    • Documentation (Ref Guide, User Guide, etc.), Compatibility/Configuration

    Description

      Blanket access to non-ejb classes and resources should be disabled by default in the org.jboss.web.WebService:

      <mbean code="org.jboss.web.WebService"
      name="jboss:service=WebService">
      <attribute name="Port">8083</attribute>
      <!-- Should resources and non-EJB classes be downloadable -->
      <attribute name="DownloadServerClasses">false</attribute>
      <attribute name="Host">${jboss.bind.address}</attribute>
      <attribute name="BindAddress">${jboss.bind.address}</attribute>
      <!-- Use the default thread pool for dynamic class loading -->
      <depends optional-attribute-name="ThreadPool"
      proxy-type="attribute">jboss.system:service=ThreadPool</depends>
      </mbean>

      Attachments

        Activity

          People

            starksm64 Scott Stark (Inactive)
            starksm64 Scott Stark (Inactive)
            Votes:
            1 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: