Another security bug??

Question

All,
I am running Weblogic with SP3. In my web application configured to use
form-based authentication. In the web.xml file I have:
<servlet>
<servlet-name>InfIIPSchedulerServlet</servlet-name>
<servlet-class>examples.servlets.InfIIPSchedulerServlet</servlet-class>
<load-on-startup>2</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>InfIIPSchedulerServlet</servlet-name>
<url-pattern>InfIIPSchedulerServlet</url-pattern>
</servlet-mapping>
<servlet-name>InfIIPSchedulerServlet</servlet-name>
<url-pattern>jsp/InfIIPSchedulerServlet</url-pattern>
</servlet-mapping>
<security-constraint>
<web-resource-collection>
<web-resource-name>iip</web-resource-name>
<description>Informatica Information Platform (IIP)</description>
<url-pattern>/jsp/*</url-pattern>
</web-resource-collection>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
</login-config>
public class InfIIPSchedulerServlet {
public void service(HttpServletRequest req, HttpServletResponse res)
throws ServletException, IOException
HttpSession session = req.getSession(false);
res.setContentType("text/plain");
ServletOutputStream out = res.getOutputStream();
try {
if (session == null) {
out.println("Session is null");
} else {
out.println("Session is " + session.toString());
InfIIPSession ss =
(InfIIPSession)session.getAttribute(com.informatica.viewer.util.InfHttpSessi
onNames.USER_IIPSESSION );
Context context = ss.getContext();
out.println("<BR>Remote user is ");
out.println(req.getRemoteUser());
out.println("<BR>Principal is ");
out.println(req.getUserPrincipal().getName());
out.println("<BR>Principal in Context is ");
out.println((String)context.getEnvironment().get(Context.SECURITY_PRINCIPAL)
} catch (NamingException ne) {
throw new ServletException(ne.getMessage());
After loged in successfully, a welcome page came up. I got the following
output when invoking the servlet with url
http://localhost:7001/iip/InfIIPSchedulerServlet
Session is weblogic.servlet.internal.session.MemorySession@69abf940
<BR>Remote user is
dtseng
<BR>Principal is
guest
<BR>Principal in Context is
dtseng
With url http://localhost:7001/iip/jsp/InfIIPSchedulerServlet the output
become
Session is weblogic.servlet.internal.session.MemorySession@69abf940
<BR>Remote user is
dtseng
<BR>Principal is
dtseng
<BR>Principal in Context is
dtseng
The difference is that the first url is not a protected resource, while
the second is. Why req.getUserPrincipal().getName() returns different values
depending on the context in which is is executed? Is this a security bug?

Answer 1

I would like to see this feature of the phone given a significant overhaul. Instead of just displaying the dail pad, I'd like to have the choice of programming in certain numbers which could offered for dialing in place of the dial pad being shown for the Emergency call feature. Perhaps upto 10 numbers could be programmed in, so you could add the emergency numbers for your area and any other numbers you think would be useful. Of course, this should be optional so that the user has the choice of only allowing calls to the pre-registered numbers, the display of the numpad or both.
That way, everyone would be happy, no?