SecurityException when rendering template

[Migrated From Jforum.net]

Maybe someone here will be able to help, I have taken this as far as I can for now...

I'm developing a web portal based around JForum, and rathe than integration JForum into a CMS I'm extending it to become the CMS. Right now I have two directories in my work dir: jforum and crapaud.

jforum is the CVS tree and crapaud contains the jars, my code, custom config, and a symlink to src/net/jforum. The idea is that I can continue to base my stuff around updates in CVS.

Anyway, as it stands there are very few changes from the base code right now, and so crapaud is very close to jforum in content, with only DB changes, and few small things (I've subclassed JForum to Crapaud as my entry point.

However, after building I try to access this page: http://testserver:8080/crapaud/forums/list.page and I get this Expcetion in the logs:

java.lang.SecurityException: /home/arawak/work/jforum/templates/default/forum_base_en_US.htm doesn't start with /home/arawak/work/crapaud/templates/
        at freemarker.cache.FileTemplateLoader$2.run(FileTemplateLoader.java:153)
        at java.security.AccessController.doPrivileged(Native Method)
        at freemarker.cache.FileTemplateLoader.findTemplateSource(FileTemplateLoader.java:141)
        at freemarker.cache.TemplateCache.acquireTemplateSource(TemplateCache.java:523)
        at freemarker.cache.TemplateCache.findTemplateSource(TemplateCache.java:499)
        at freemarker.cache.TemplateCache.getTemplate(TemplateCache.java:329)
        at freemarker.cache.TemplateCache.getTemplate(TemplateCache.java:229)
        at freemarker.template.Configuration.getTemplate(Configuration.java:426)
        at freemarker.template.Configuration.getTemplate(Configuration.java:391)
        at net.jforum.Command.process(Unknown Source)
        at net.jforum.JForum.service(Unknown Source)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:237)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:157)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:214)
        at org.apache.catalina.core.StandardValveContext.invokeNext(StandardValveContext.java:104)
        at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:520)
        at org.apache.catalina.core.StandardContextValve.invokeInternal(StandardContextValve.java:198)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:152)
        at org.apache.catalina.core.StandardValveContext.invokeNext(StandardValveContext.java:104)
        at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:520)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:137)
        at org.apache.catalina.core.StandardValveContext.invokeNext(StandardValveContext.java:104)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
        at org.apache.catalina.core.StandardValveContext.invokeNext(StandardValveContext.java:102)
        at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:520)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
        at org.apache.catalina.core.StandardValveContext.invokeNext(StandardValveContext.java:104)
        at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:520)
        at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:929)
        at org.apache.coyote.tomcat5.CoyoteAdapter.service(CoyoteAdapter.java:160)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:799)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.processConnection(Http11Protocol.java:705)
        at org.apache.tomcat.util.net.TcpWorkerThread.runIt(PoolTcpEndpoint.java:577)
        at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:683)
        at java.lang.Thread.run(Thread.java:536)

For some reason freemarker is trying to load the template from the wrong path.

My Context entry in server.xml looks like:

        <Context path="/crapaud" docBase="/home/arawak/work/crapaud" debug="0" reloadable="true">
            <Logger className="org.apache.catalina.logger.FileLogger" prefix="crapaud_log." suffix=".txt" timestamp="true"/>
        </Context>

and web.xml is

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE web-app
    PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
    "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
    <listener>
        <listener-class>com.caribbeancricket.ForumSessionListener</listener-class>
    </listener>

    <servlet>
                <servlet-name>crapaud</servlet-name>
                <servlet-class>com.caribbeancricket.Crapaud</servlet-class>

                <init-param>
                        <param-name>development</param-name>
                        <param-value>true</param-value>
                </init-param>
    </servlet>

    <servlet>
        <servlet-name>install</servlet-name>
        <servlet-class>net.jforum.InstallServlet</servlet-class>

        <init-param>
                        <param-name>development</param-name>
                        <param-value>true</param-value>
                </init-param>
    </servlet>

    <!-- SERVLETS -->
    <servlet-mapping>
        <servlet-name>install</servlet-name>
        <url-pattern>/install/install.page</url-pattern>
    </servlet-mapping>

        <servlet-mapping>
        <servlet-name>crapaud</servlet-name>
        <url-pattern>*.page</url-pattern>
    </servlet-mapping>

    <!-- SESSION -->
    <session-config>
        <session-timeout>10</session-timeout>
    </session-config>
</web-app>

Anyone know why this is happening?

Arawak
[originally posted on jforum.net by Arawak]

[Migrated From Jforum.net]

Okay, everyone can relax now, I figured it out :-)

My templates/default was a symlink to the jforum directory!

Doh!

Arawak
[originally posted on jforum.net by Arawak]

[Migrated From Jforum.net]

yeah, I was going to ask if wasn't the symlink the root of the problem!!

Rafael
[originally posted on jforum.net by Rafael Steil]