1 Apache端
1.1 編輯APACHE_HOME/conf/httpd.conf
添加以下語句, 把APACHE_HOME改成相應(yīng)目錄.
LoadModule jk_module modules/mod_jk.so
JkWorkersFile "APACHE_HOME/conf/workers.properties"
JkLogFile "APACHE_HOME/logs/mod_jk.log"
JkMount /*.jsp worker1
JkMount /*/servlet/* worker1
1.2 生成workers.properties配置文件
生成如下配置文件文件,
worker.list=worker1
worker.worker1.type=ajp13
worker.worker1.host=localhost
worker.worker1.port=8009
2 Tomcat端
2.1 編輯TOMCAT_HOME/conf/server.xml
在Host element下添加相應(yīng)Context,
<!-- Test Context -->
<Context path="/test" docBase="APACHE_HOME/htdocs/test" reloadable="true"
crossContext="true"/>
2.2 編輯TOMCAT_HOME/conf/web.xml (可選)
Tomcat 4.1.12之后的版本缺省配置下不能用/servlet/*的方式來調(diào)用/WEB-INF/classes路徑下的servlet. 4.1.12的RELEASE-NOTES提及以下變化,
Starting with Tomcat 4.1.12, the invoker servlet is no
longer available by default in all webapps. Enabling it for all webapps
is possible by editing $CATALINA_HOME/conf/web.xml to uncomment the
"/servlet/*" servlet-mapping definition.
Using the invoker servlet in a production environment
is not recommended and is unsupported. More details are available on
the Tomcat FAQ at http://tomcat.apache.org/faq/misc.html#invoker.
其實(shí)還需要Tomcat 5.0之后的版本還需要去掉web.xml另一段語句的注釋, 蹊蹺的是官方文檔沒提到.
也許因?yàn)闊o法消滅這個(gè)安全漏洞, 黔驢技窮的開發(fā)人員只好宣布, "Using /servlet/
to map servlets is evil, absolutely evil". 這個(gè)解決方案真是convenient,
absolutely convenient.
簡而言之, 用戶需要去掉以下段落的注釋,
<servlet>
<servlet-name>invoker</servlet-name>
<servlet-class>
org.apache.catalina.servlets.InvokerServlet
</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>0</param-value>
</init-param>
<load-on-startup>2</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>invoker</servlet-name>
<url-pattern>/servlet/*</url-pattern>
</servlet-mapping>