* Jetty: Disable TRACE and OPTIONS in console and eepsite

2010-06-29 02:29:42 +00:00
parent 2025fe7c20
commit 22ea79a4ff
4 changed files with 61 additions and 0 deletions
--- a/installer/resources/jetty.xml
+++ b/installer/resources/jetty.xml
@@ -176,6 +176,14 @@
          <Arg>
            <New class="org.mortbay.http.handler.ResourceHandler">
              <Set name="redirectWelcome">FALSE</Set>
+              <!-- disable TRACE and OPTIONS ref: http://osdir.com/ml/java.jetty.support/2003-11/msg00014.html -->
+              <Set name="AllowedMethods">
+                <Array type="String">
+                  <Item>GET</Item>
+                  <Item>HEAD</Item>
+                  <Item>POST</Item>
+                </Array>
+              </Set>
 	    </New>
          </Arg>
        </Call>