Index: main/trunk/greenstone3/build.properties.in
===================================================================
--- main/trunk/greenstone3/build.properties.in	(revision 29844)
+++ main/trunk/greenstone3/build.properties.in	(revision 29845)
@@ -30,4 +30,6 @@
 # default servlet to start with
 server.default.servlet=/library
+# whether to make the greenstone pages publicly accessible or only to this machine
+server.external.access=true
 
 # The context name of your GS3 digital library. By default this will be "greenstone3". 
Index: main/trunk/greenstone3/build.xml
===================================================================
--- main/trunk/greenstone3/build.xml	(revision 29844)
+++ main/trunk/greenstone3/build.xml	(revision 29845)
@@ -123,4 +123,12 @@
   <condition property="privileged.attribute" value="privileged='true'" else=""> 
     <equals arg1="7" arg2="${tomcat.version.major}"/>
+  </condition>
+
+  <!-- external access to the GS3 pages or not 
+       https://tomcat.apache.org/tomcat-7.0-doc/config/valve.html -->
+  <condition property="allowed.IPs" 
+	     value=".*" 
+	     else="(127\.0\.0\.1|::1|0:0:0:0:0:0:0:1)"> 
+    <matches pattern="^(1|true|yes)$" string="${server.external.access}"/>
   </condition>
 
@@ -1342,5 +1350,6 @@
         <filter token="gsdl3webhome" value="${web.home}"/>
         <filter token="gsdl3webwritablehome" value="${web.writablehome}"/>
-	<filter token="privilegedattribute" value ="${privileged.attribute}"/>
+	<filter token="privilegedattribute" value="${privileged.attribute}"/>
+	<filter token="allowedIPs" value="${allowed.IPs}"/>
       </filterset>
     </copy>
Index: main/trunk/greenstone3/resources/java/server.properties
===================================================================
--- main/trunk/greenstone3/resources/java/server.properties	(revision 29844)
+++ main/trunk/greenstone3/resources/java/server.properties	(revision 29845)
@@ -2,5 +2,4 @@
 Server2Settings.Port=Apache port:
 Server2Settings.URL=Library URL prefix:
-Server2Settings.ExternalAccess=Allow external connections
 Server2Settings.AddressResolutionMethod=Address resolution method
 Server2Settings.ResolveIP=Get local IP and resolve to a name
@@ -27,4 +26,5 @@
 ServerSettings.SettingChanged=The new settings will be available when you press Enter Library/Restart Library.
 ServerSettings.SettingsUnchangedPortOccupied=Unable to run the Greenstone server on port {0}. It appears to already be in use.
+ServerSettings.ExternalAccess=Allow external connections
 
 ServerControl.EnterLibrary=Enter Library
Index: main/trunk/greenstone3/resources/tomcat/greenstone3.xml.in
===================================================================
--- main/trunk/greenstone3/resources/tomcat/greenstone3.xml.in	(revision 29844)
+++ main/trunk/greenstone3/resources/tomcat/greenstone3.xml.in	(revision 29845)
@@ -25,3 +25,7 @@
 	     file. -->
 	<Manager pathname="SESSIONS.ser" />
+
+	<!-- Allow all machines or just this machine: 127.0.0.1 (IPv4) and 0:0:0:0:0:0:0:1 (IPv6, needed on windows)
+	     https://tomcat.apache.org/tomcat-7.0-doc/config/valve.html -->
+	<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="@allowedIPs@"/>
 </Context>
Index: main/trunk/greenstone3/src/java/org/greenstone/server/BaseProperty.java
===================================================================
--- main/trunk/greenstone3/src/java/org/greenstone/server/BaseProperty.java	(revision 29844)
+++ main/trunk/greenstone3/src/java/org/greenstone/server/BaseProperty.java	(revision 29845)
@@ -8,4 +8,5 @@
     public final String KEEPPORT;
     public final String START_BROWSER;
+    public final String ALLOW_EXTERNAL_ACCESS;
 
     public final String DEFAULT_SERVLET = "server.default.servlet";
@@ -22,5 +23,10 @@
     public final String SERVER_SETTINGS;
     
-    protected BaseProperty(String version, String web_port, String autostart, String startbrowser, String keepport) 
+    protected BaseProperty(String version, 
+			   String web_port,
+			   String autostart, 
+			   String startbrowser, 
+			   String keepport,
+			   String allowExternalAccess) 
     {
 	// property names
@@ -33,4 +39,5 @@
 	START_BROWSER = startbrowser;
 	KEEPPORT = keepport;
+	ALLOW_EXTERNAL_ACCESS = allowExternalAccess;
     }
 
Index: main/trunk/greenstone3/src/java/org/greenstone/server/BaseServerSettings.java
===================================================================
--- main/trunk/greenstone3/src/java/org/greenstone/server/BaseServerSettings.java	(revision 29844)
+++ main/trunk/greenstone3/src/java/org/greenstone/server/BaseServerSettings.java	(revision 29845)
@@ -22,4 +22,5 @@
     protected JCheckBox autoEnter;
     protected JCheckBox keepPortToggle;
+    protected JCheckBox allowConnections;
 
     protected JSpinner portNumber_spinner = null;
@@ -35,4 +36,5 @@
     protected String browserPath = "";
     protected boolean useDefaultBrowser = true;
+    protected boolean externalaccess = false;
 
     protected JDialog self;
@@ -102,4 +104,16 @@
 	keepPortToggle.setBackground(bg_color);
 
+	boolean allowCons = false;
+	String externalAccessStr = server.config_properties.getProperty(BaseServer.Property.ALLOW_EXTERNAL_ACCESS, "1").trim();
+	allowConnections = new JCheckBox(server.dictionary.get("ServerSettings.ExternalAccess"), allowCons);
+	if(externalAccessStr.equals("1") || externalAccessStr.equals("true")) {
+	    this.externalaccess = true;
+	    allowCons = true;
+	    allowConnections.setSelected(true);
+	} else {
+	    allowConnections.setSelected(false);
+	}
+	
+	allowConnections.setBackground(bg_color);
 
 	JButton save_button = new JButton(BaseServer.dictionary.get("ServerSettings.OK"));
@@ -125,8 +139,9 @@
 	port_panel.setBackground(bg_color);
 
-	JPanel top_panel = new JPanel(new GridLayout(3,1));
+	JPanel top_panel = new JPanel(new GridLayout(4,1));
 	top_panel.add(port_panel);
 	top_panel.add(keepPortToggle);
 	top_panel.add(autoEnter);
+	top_panel.add(allowConnections);
 
 	JPanel comb_panel = createServletPanel();
@@ -252,4 +267,11 @@
 	    }
 
+	    boolean oldExternalAccess = externalaccess;
+	    externalaccess = allowConnections.isSelected() ? true : false;
+	    if (oldExternalAccess != externalaccess) {
+		has_changed = true;
+		require_restart = true;
+		server.reconfigRequired();
+	    } // else require_restart remains what it had been
 
 	    // call subclass' onSave method, which may indicate (further) changes,
@@ -287,4 +309,5 @@
 		
 		// call the subclass' save() method to save custom elements
+		// and to save externalAccess in a custom manner for both GS2 and GS3
 		save(scriptReadWrite, newFileLines);
 		
Index: main/trunk/greenstone3/src/java/org/greenstone/server/Server2Property.java
===================================================================
--- main/trunk/greenstone3/src/java/org/greenstone/server/Server2Property.java	(revision 29844)
+++ main/trunk/greenstone3/src/java/org/greenstone/server/Server2Property.java	(revision 29845)
@@ -9,5 +9,6 @@
 	// Initialising customised final variables 
 	// Version number, WEB_PORT
-	super("2", "portnumber", property_prefix+"autoenter", property_prefix+"start_browser", "keepport");
+	super("2", "portnumber", property_prefix+"autoenter", property_prefix+"start_browser",
+	      "keepport", "externalaccess");
     }
 
Index: main/trunk/greenstone3/src/java/org/greenstone/server/Server2Settings.java
===================================================================
--- main/trunk/greenstone3/src/java/org/greenstone/server/Server2Settings.java	(revision 29844)
+++ main/trunk/greenstone3/src/java/org/greenstone/server/Server2Settings.java	(revision 29845)
@@ -17,10 +17,8 @@
 {
     protected JComboBox prefix_combobox;
-    protected JCheckBox allowConnections;
     protected JRadioButton[] hostRadioButtons = new JRadioButton[4];
 
     // 0 to 3: 0 is resolved (hostname) from local IP, 1 is local IP address, 2 is localhost, 3 is 127.0.0.1
     protected int address_resolution_method = 2;
-    protected int externalaccess = 0;
 
     public Server2Settings(BaseServer server) 
@@ -33,13 +31,4 @@
 	JPanel server2panel = new JPanel();
 	server2panel.setLayout(new BorderLayout());
-
-	boolean allowCons = false;
-	String externalAccess = server.config_properties.getProperty("externalaccess", "").trim();
-	if(!externalAccess.equals("") && externalAccess.equals("1")) {
-	    this.externalaccess = 1;
-	    allowCons = true;
-	}
-	allowConnections = new JCheckBox(server.dictionary.get(BaseServer.Property.SERVER_SETTINGS+".ExternalAccess"), allowCons);
-	allowConnections.setBackground(bg_color);
 	
 	JPanel connect_panel = new JPanel(new GridLayout(4, 1));
@@ -67,5 +56,4 @@
 
 	JPanel comb_panel = new JPanel(new BorderLayout());	
-	comb_panel.add(allowConnections, BorderLayout.NORTH);
 	comb_panel.add(connect_panel, BorderLayout.CENTER);
 	return comb_panel;
@@ -75,5 +63,5 @@
     {
 	// superclass detects changes to port and autoenter
-	// handle changes to address_resolution_method and externalAccess/allowConnections here
+	// handle changes to address_resolution_method here
 
 	boolean hasChanged = false;
@@ -87,12 +75,4 @@
 		server.reconfigRequired();
 	    }
-	}
-
-	int oldExternalAccess = externalaccess;
-	externalaccess = allowConnections.isSelected() ? 1 : 0;
-	if (oldExternalAccess != externalaccess) {
-	    hasChanged = true;
-	    requireRestart = true;
-	    server.reconfigRequired();
 	}
 
@@ -116,5 +96,6 @@
 
 	// external access - onSave() would have updated this value
-	newFileLines = scriptReadWrite.queryReplace(newFileLines, "externalaccess", Integer.toString(externalaccess));
+	// Its possible values are specific to the version of Greenstone: 0 or 1 for GS2 (true or false for GS3)
+	newFileLines = scriptReadWrite.queryReplace(newFileLines, BaseServer.Property.ALLOW_EXTERNAL_ACCESS, externalaccess ? "1" : "0");
 	
 	// work out the host (default is address_resolution_method 2: localhost)
Index: main/trunk/greenstone3/src/java/org/greenstone/server/Server3Property.java
===================================================================
--- main/trunk/greenstone3/src/java/org/greenstone/server/Server3Property.java	(revision 29844)
+++ main/trunk/greenstone3/src/java/org/greenstone/server/Server3Property.java	(revision 29845)
@@ -10,5 +10,6 @@
 	// Version number, WEB_PORT, autoenter, startbrowser
 	// For GS3, the last two are controlled by the same property
-	super("3", "tomcat.port", "server.auto.start", "server.auto.start", "server.keep.port");
+	super("3", "tomcat.port", "server.auto.start", "server.auto.start", 
+	      "server.keep.port", "server.external.access");
     }
 
Index: main/trunk/greenstone3/src/java/org/greenstone/server/Server3Settings.java
===================================================================
--- main/trunk/greenstone3/src/java/org/greenstone/server/Server3Settings.java	(revision 29844)
+++ main/trunk/greenstone3/src/java/org/greenstone/server/Server3Settings.java	(revision 29845)
@@ -105,4 +105,8 @@
 	String newKeepPort = (new Boolean(keepPortToggle.isSelected())).toString();
 	newFileLines = scriptReadWrite.queryReplace(newFileLines, BaseServer.Property.KEEPPORT, newKeepPort);
+	
+	// external access - BaseServerSettings.actionPerformed() would have updated this value
+	// Its possible values are specific to the version of Greenstone: 0 or 1 for GS2 (true or false for GS3)
+	newFileLines = scriptReadWrite.queryReplace(newFileLines, BaseServer.Property.ALLOW_EXTERNAL_ACCESS, externalaccess ? "true" : "false");
 
 	String newServletDef = (String) servlet_combobox.getSelectedItem();
