Changeset 38768

Timestamp:

2024-02-22T17:45:11+13:00 (3 months ago)

Author:

davidb

Message:

Fixed spelling mistake, updated the comment about its purpose

File:

• main/trunk/greenstone3/resources/tomcat/greenstone3.xml.svn (modified) (1 diff)

main/trunk/greenstone3/resources/tomcat/greenstone3.xml.svn

@@ -61 +61 @@
     <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="@allowedIPs@"/>
 
-    <!-- Allows us to include the file rewrite.config in web/WEB-INF
+    <!-- Allows us to include the file:
+           <GSDL3SRCHOME>/web/WEB-INF/rewrite.config
          Currently used (by default) to monitor for GS3 DL calls that use:
-           &href=...
-         and disable them, as malicieous users can uses this to mount an Open Redirect attack -->
+           &href=... and rl=0 ...
+         and rewrite them so they are forbidden by the server.
+         This is because malicious users can use this form of CGI URL supported by Greenstone3
+         to mount an Open Redirect attack -->
     <Valve className="org.apache.catalina.valves.rewrite.RewriteValve"/>