[java-identity-provider COMMIT] /trunk/idp-war/src/main/webapp/WEB-INF/web.xml

[noreply at shibboleth.net]

Author: rdw
Date: Fri Dec 11 10:51:07 2015
New Revision: 8025

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8025&view=rev
Log:
IDP-876 forbid directory enumeration within the IdP

https://issues.shibboleth.net/jira/browse/IDP-876

Apply patch provided in the above case

Modified:
    trunk/idp-war/src/main/webapp/WEB-INF/web.xml

Modified: trunk/idp-war/src/main/webapp/WEB-INF/web.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-war/src/main/webapp/WEB-INF/web.xml?rev=8025&r1=8024&r2=8025&view=diff
==============================================================================
--- trunk/idp-war/src/main/webapp/WEB-INF/web.xml	(original)
+++ trunk/idp-war/src/main/webapp/WEB-INF/web.xml	Fri Dec 11 10:51:07 2015
@@ -136,6 +136,15 @@
         <servlet-name>shibboleth_jsp</servlet-name>
         <url-pattern>/shibboleth</url-pattern>
     </servlet-mapping>
+    
+    <servlet>
+        <servlet-name>default</servlet-name>
+        <servlet-class>org.eclipse.jetty.servlet.DefaultServlet</servlet-class>
+        <init-param>
+            <param-name>dirAllowed</param-name>
+            <param-value>false</param-value>
+        </init-param>
+    </servlet>
 
     <!--
     Uncomment to use container managed authentication. The new servlet spec (3.1)