From: tony mancill <tmancill@debian.org>
Subject: CVE-2010-4172 patches for 6.0.28
Description: Backport changes in tomcat6's SVN tree to 6.0.28.
Origin: http://svn.apache.org/viewvc?view=revision&revision=1037779
Forwarded: not-needed

Index: tomcat6-6.0.24/java/org/apache/catalina/manager/JspHelper.java
===================================================================
--- tomcat6-6.0.24.orig/java/org/apache/catalina/manager/JspHelper.java	2011-01-13 15:26:19.000000000 -0600
+++ tomcat6-6.0.24/java/org/apache/catalina/manager/JspHelper.java	2011-01-13 15:26:49.000000000 -0600
@@ -58,7 +58,7 @@
     }
     private static String localeToString(Locale locale) {
         if (locale != null) {
-            return locale.toString();//locale.getDisplayName();
+            return escapeXml(locale.toString());//locale.getDisplayName();
         } else {
             return "";
         }
Index: tomcat6-6.0.24/webapps/manager/sessionDetail.jsp
===================================================================
--- tomcat6-6.0.24.orig/webapps/manager/sessionDetail.jsp	2011-01-13 15:27:06.000000000 -0600
+++ tomcat6-6.0.24/webapps/manager/sessionDetail.jsp	2011-01-13 15:29:17.000000000 -0600
@@ -30,8 +30,10 @@
 <% String path = (String) request.getAttribute("path");
    Session currentSession = (Session)request.getAttribute("currentSession");
    HttpSession currentHttpSession = currentSession.getSession();
-   String currentSessionId = currentSession.getId();
-   String submitUrl = ((HttpServletRequest)pageContext.getRequest()).getRequestURL().toString();
+   String currentSessionId = JspHelper.escapeXml(currentSession.getId());
+   String submitUrl = JspHelper.escapeXml(response.encodeURL(
+           ((HttpServletRequest) pageContext.getRequest()).getRequestURI() +
+           "?path=" + path));
 %>
 <head>
     <meta http-equiv="content-type" content="text/html; charset=iso-8859-1"/>
@@ -45,7 +47,7 @@
 	<title>Sessions Administration: details for <%= currentSessionId %></title>
 </head>
 <body>
-<h1>Details for Session <%= JspHelper.escapeXml(currentSessionId) %></h1>
+<h1>Details for Session <%= currentSessionId %></h1>
 
 <table style="text-align: left;" border="0">
   <tr>
@@ -86,7 +88,13 @@
   </tr>
 </table>
 
-<p style="text-align: center;"><button type="button" onclick="window.location.reload()">Refresh</button></p>
+<form method="post" action="<%= submitUrl %>">
+  <div>
+    <input type="hidden" name="sessionId" value="<%= currentSessionId %>" />
+    <input type="hidden" name="action" value="sessionDetail" />
+    <input type="submit" value="Refresh" />
+  </div>
+</form>
 
 <div class="error"><%= JspHelper.escapeXml(request.getAttribute("error")) %></div>
 <div class="message"><%= JspHelper.escapeXml(request.getAttribute("message")) %></div>
@@ -120,7 +128,16 @@
    	String attributeName = (String) attributeNamesEnumeration.nextElement();
 %>
 		<tr>
-			<td align="center"><form action="<%= submitUrl %>"><div><input type="hidden" name="path" value="<%= path %>" /><input type="hidden" name="action" value="removeSessionAttribute" /><input type="hidden" name="sessionId" value="<%= currentSessionId %>" /><input type="hidden" name="attributeName" value="<%= attributeName %>" /><input type="submit" value="Remove" /></div></form></td>
+            <td align="center">
+                <form method="post" action="<%= submitUrl %>">
+                    <div>
+                        <input type="hidden" name="action" value="removeSessionAttribute" />
+                        <input type="hidden" name="sessionId" value="<%= currentSessionId %>" />
+                        <input type="hidden" name="attributeName" value="<%= JspHelper.escapeXml(attributeName) %>" />
+                        <input type="submit" value="Remove" />
+                    </div>
+                </form>
+            </td>
 			<td><%= JspHelper.escapeXml(attributeName) %></td>
 			<td><% Object attributeValue = currentHttpSession.getAttribute(attributeName); %><span title="<%= attributeValue == null ? "" : attributeValue.getClass().toString() %>"><%= JspHelper.escapeXml(attributeValue) %></span></td>
 		</tr>
@@ -128,7 +145,11 @@
 	</tbody>
 </table>
 
-<p style="text-align: center;"><button type="button" onclick="window.close()">Close window</button></p>
+<form method="post" action="<%=submitUrl%>">
+  <p style="text-align: center;">
+    <input type="submit" value="Return to session list" />
+  </p>
+</form>
 
 <%--div style="display: none;">
 <p>
Index: tomcat6-6.0.24/webapps/manager/sessionsList.jsp
===================================================================
--- tomcat6-6.0.24.orig/webapps/manager/sessionsList.jsp	2011-01-13 15:29:33.000000000 -0600
+++ tomcat6-6.0.24/webapps/manager/sessionsList.jsp	2011-01-13 15:32:12.000000000 -0600
@@ -26,7 +26,9 @@
 
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
 <% String path = (String) request.getAttribute("path");
-   String submitUrl = ((HttpServletRequest)pageContext.getRequest()).getRequestURI() + "?path=" + path;
+   String submitUrl = JspHelper.escapeXml(response.encodeURL(
+           ((HttpServletRequest) pageContext.getRequest()).getRequestURI() +
+           "?path=" + path));
    Collection activeSessions = (Collection) request.getAttribute("activeSessions");
 %>
 <head>
@@ -38,10 +40,10 @@
 	<meta name="author" content="Cedrik LIME"/>
 	<meta name="copyright" content="copyright 2005-2010 the Apache Software Foundation"/>
 	<meta name="robots" content="noindex,nofollow,noarchive"/>
-	<title>Sessions Administration for <%= path %></title>
+	<title>Sessions Administration for <%= JspHelper.escapeXml(path) %></title>
 </head>
 <body>
-<h1>Sessions Administration for <%= path %></h1>
+<h1>Sessions Administration for <%= JspHelper.escapeXml(path) %></h1>
 
 <p>Tips:</p>
 <ul>
@@ -55,13 +57,13 @@
 <form action="<%= submitUrl %>" method="post" id="sessionsForm">
 	<fieldset><legend>Active HttpSessions informations</legend>
 		<input type="hidden" name="action" id="sessionsFormAction" value="injectSessions"/>
-		<input type="hidden" name="sort" id="sessionsFormSort" value="<%= (String) request.getAttribute("sort") %>"/>
+		<input type="hidden" name="sort" id="sessionsFormSort" value="<%= JspHelper.escapeXml(request.getAttribute("sort")) %>"/>
 		<% String order = (String) request.getAttribute("order");
 		   if (order == null || "".equals(order)) {
 		   	order = "ASC";
 		   }
 		%>
-		<input type="hidden" name="order" id="sessionsFormSortOrder" value="<%= order %>"/>
+		<input type="hidden" name="order" id="sessionsFormSortOrder" value="<%= JspHelper.escapeXml(order) %>"/>
 		<input type="submit" name="refresh" id="refreshButton" value="Refresh Sessions list" onclick="document.getElementById('sessionsFormAction').value='refreshSessions'; return true;"/>
 		<%= JspHelper.formatNumber(activeSessions.size()) %> active Sessions<br/>
 		<table border="1" cellpadding="2" cellspacing="2" width="100%">
@@ -95,11 +97,11 @@
 <% Iterator iter = activeSessions.iterator();
    while (iter.hasNext()) {
    	Session currentSession = (Session) iter.next();
-   	String currentSessionId = currentSession.getId();
+   	String currentSessionId = JspHelper.escapeXml(currentSession.getId());
 %>
 				<tr>
 					<td>
-<input type="checkbox" name="sessionIds" value="<%= currentSessionId %>" /><a href="<%= submitUrl %>&amp;action=sessionDetail&amp;sessionId=<%= currentSessionId %>" target="_blank"><%= JspHelper.escapeXml(currentSessionId) %></a>
+<input type="checkbox" name="sessionIds" value="<%= currentSessionId %>" /><a href="<%= submitUrl %>&amp;action=sessionDetail&amp;sessionId=<%= currentSessionId %>"><%= currentSessionId %></a>
 					</td>
 					<td style="text-align: center;"><%= JspHelper.guessDisplayLocaleFromSession(currentSession) %></td>
 					<td style="text-align: center;"><%= JspHelper.guessDisplayUserFromSession(currentSession) %></td>
@@ -118,7 +120,11 @@
 	</fieldset>
 </form>
 
-<p style="text-align: center;"><button type="button" onclick="window.close()">Close window</button></p>
+<form method="get" action="<%=request.getContextPath()%>/html">
+  <p style="text-align: center;">
+    <input type="submit" value="Return to main page" />
+  </p>
+</form>
 
 <%--div style="display: none;">
 <p>
