11<?xml version =" 1.0" encoding =" UTF-8" ?>
22<!--
3- Copyright 2010-2022 BusinessCode GmbH, Germany
3+ Copyright 2010-2026 BusinessCode GmbH, Germany
44
55 Licensed under the Apache License, Version 2.0 (the "License");
66 you may not use this file except in compliance with the License.
1717<!--
1818 Standard web.xml for BCD-UI 4 applications.
1919 -->
20- <web-app xmlns =" http ://xmlns.jcp.org /xml/ns/javaee "
20+ <web-app xmlns =" https ://jakarta.ee /xml/ns/jakartaee "
2121 xmlns : xsi =" http://www.w3.org/2001/XMLSchema-instance"
22- xsi : schemaLocation =" http ://xmlns.jcp.org /xml/ns/javaee http ://xmlns.jcp.org /xml/ns/javaee /web-app_3_1 .xsd"
23- version =" 3.1 " >
22+ xsi : schemaLocation =" https ://jakarta.ee /xml/ns/jakartaee https ://jakarta.ee /xml/ns/jakartaee /web-app_6_0 .xsd"
23+ id = " WebApp_ID " version =" 6.0 " >
2424
2525 <display-name >ProjectName</display-name >
2626
2727 <!--
2828 BCD-UI 4 Filters
2929 -->
3030
31+ <!-- http header security options -->
32+ <filter >
33+ <filter-name >httpHeaderSecurity</filter-name >
34+ <filter-class >org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class >
35+ <init-param >
36+ <param-name >antiClickJackingEnabled</param-name >
37+ <param-value >true</param-value >
38+ </init-param >
39+ <init-param >
40+ <param-name >antiClickJackingOption</param-name >
41+ <param-value >SAMEORIGIN</param-value >
42+ </init-param >
43+ <init-param >
44+ <param-name >hstsEnabled</param-name >
45+ <param-value >true</param-value >
46+ </init-param >
47+ <init-param >
48+ <param-name >hstsMaxAgeSeconds</param-name >
49+ <param-value >63072000</param-value >
50+ </init-param >
51+ <init-param >
52+ <param-name >hstsIncludeSubDomains</param-name >
53+ <param-value >true</param-value >
54+ </init-param >
55+ <init-param >
56+ <param-name >hstsPreload</param-name >
57+ <param-value >true</param-value >
58+ </init-param >
59+ <init-param >
60+ <param-name >blockContentTypeSniffingEnabled</param-name >
61+ <param-value >true</param-value >
62+ </init-param >
63+ <init-param >
64+ <param-name >xssProtectionEnabled</param-name >
65+ <param-value >true</param-value >
66+ </init-param >
67+ </filter >
68+ <filter-mapping >
69+ <filter-name >httpHeaderSecurity</filter-name >
70+ <url-pattern >/*</url-pattern >
71+ </filter-mapping >
72+
73+ <!-- CORS Filter, enable it if you want to allow cross origin resource sharing in your application.
74+ <filter>
75+ <filter-name>CorsFilter</filter-name>
76+ <filter-class>de.businesscode.bcdui.web.filters.CorsFilter</filter-class>
77+ </filter>
78+ <filter-mapping>
79+ <filter-name>CorsFilter</filter-name>
80+ <url-pattern>/*</url-pattern>
81+ </filter-mapping>
82+ -->
83+
3184 <!-- filter for identifying requests from MS Office applications like Word or Excel to not redirect to login page, enable if needed -->
3285 <!--
3386 <filter>
4093 </filter-mapping>
4194 -->
4295
96+ <!-- ensure utf8 character encoding, must be placed before shiro filter -->
97+ <filter >
98+ <filter-name >setCharacterEncodingFilter</filter-name >
99+ <filter-class >org.apache.catalina.filters.SetCharacterEncodingFilter</filter-class >
100+ <init-param >
101+ <param-name >encoding</param-name >
102+ <param-value >UTF-8</param-value >
103+ </init-param >
104+ </filter >
105+ <filter-mapping >
106+ <filter-name >setCharacterEncodingFilter</filter-name >
107+ <url-pattern >/*</url-pattern >
108+ </filter-mapping >
109+
43110 <!-- Security filter for authentication and authorization, see https://shiro.apache.org/configuration.html -->
44111 <filter >
45112 <filter-name >bcdui4.ShiroFilter</filter-name >
46- <filter-class >org.apache.shiro .web.servlet .ShiroFilter</filter-class >
113+ <filter-class >de.businesscode.bcdui .web.filters .ShiroFilter</filter-class >
47114 </filter >
48115 <filter-mapping >
49116 <filter-name >bcdui4.ShiroFilter</filter-name >
54121 <filter >
55122 <filter-name >bcdui4.RequestLifeCycleFilter</filter-name >
56123 <filter-class >de.businesscode.bcdui.web.filters.RequestLifeCycleFilter</filter-class >
124+ <init-param >
125+ <param-name >ContentSecurityPolicy</param-name >
126+ <param-value >default-src 'self' 'unsafe-eval' 'unsafe-inline';object-src 'none'; img-src 'self' blob: data:</param-value >
127+ </init-param >
57128 </filter >
58129 <filter-mapping >
59130 <filter-name >bcdui4.RequestLifeCycleFilter</filter-name >
171242 <url-pattern >/bcdui/*</url-pattern >
172243 <url-pattern >/vfs/*</url-pattern >
173244 <url-pattern >*.vfsxml</url-pattern >
245+ <url-pattern >*.js</url-pattern >
246+ <url-pattern >*.zip</url-pattern >
174247 </servlet-mapping >
175248
176249 <!-- I18nServlet -->
189262 <!-- servlet>
190263 <servlet-name>bcdui4.SubjectPreferences</servlet-name>
191264 <servlet-class>de.businesscode.bcdui.web.servlets.SubjectPreferences</servlet-class>
265+ <init-param>
266+ <param-name>cookieMaxAge</param-name>
267+ <param-value>31536000</param-value>
268+ </init-param>
192269 <load-on-startup>1</load-on-startup>
193270 </servlet>
194271 <servlet-mapping>
213290 </servlet-mapping>
214291-->
215292
293+ <!-- Download servlet
294+ <servlet>
295+ <servlet-name>bcdui4.SchedulerDownload</servlet-name>
296+ <servlet-class>de.businesscode.bcdui.toolbox.DownloadServlet</servlet-class>
297+ <init-param>
298+ <param-name>clearDaysFiles</param-name>
299+ <param-value>14</param-value>
300+ </init-param>
301+ <init-param>
302+ <param-name>clearDaysStats</param-name>
303+ <param-value>60</param-value>
304+ </init-param>
305+ <init-param>
306+ <param-name>downloadFolder</param-name>
307+ <param-value>your absolute path to the download folder (sftp) or file path to local files</param-value>
308+ </init-param>
309+ <init-param>
310+ <param-name>sftpHost</param-name>
311+ <param-value>your sftp host</param-value>
312+ </init-param>
313+ <init-param>
314+ <param-name>sftpPwd</param-name>
315+ <param-value>your sftp password</param-value>
316+ </init-param>
317+ <init-param>
318+ <param-name>sftpUser</param-name>
319+ <param-value>your sftp user name</param-value>
320+ </init-param>
321+ <init-param>
322+ <param-name>sftpPort</param-name>
323+ <param-value>your sftp port, default 22</param-value>
324+ </init-param>
325+ <init-param>
326+ <param-name>downloadPage</param-name>
327+ <param-value>your download html page for redirect</param-value>
328+ </init-param>
329+ -->
330+
216331 <!-- Evaluates and executes WrsRequests to the database -->
217332 <servlet >
218333 <servlet-name >bcdui4.WrsServlet</servlet-name >
336451 <url-pattern >/bcdui/servlets/WrsNextIdentifierServlet/*</url-pattern >
337452 </servlet-mapping >
338453
339- <!-- WYSIWYG Excel export Servlet -->
340- <!-- PLEASE NOTE: Consider setting maxPostSize in your server config -->
454+ <!-- Binding id/caption/description getter -->
341455 <servlet >
342- <servlet-name >bcdui4.Html2ExcelServlet</servlet-name >
343- <servlet-class >de.businesscode.bcdui.toolbox.MirrorServlet</servlet-class >
344- <init-param >
345- <param-name >header:Content-Type</param-name >
346- <param-value >application/vnd.ms-excel</param-value >
347- </init-param >
348-
349- <!-- set this to true if your server.xml connector is not using UTF-8 URIEncoding, otherwise set it to false -->
350- <init-param >
351- <param-name >EncodeUTF8</param-name >
352- <param-value >true</param-value >
353- </init-param >
354-
456+ <servlet-name >bcdui4.BindingInfo</servlet-name >
457+ <servlet-class >de.businesscode.bcdui.web.servlets.BindingInfo</servlet-class >
355458 </servlet >
356459 <servlet-mapping >
357- <servlet-name >bcdui4.Html2ExcelServlet </servlet-name >
358- <url-pattern >/bcdui/servlets/Html2ExcelServlet /*</url-pattern >
460+ <servlet-name >bcdui4.BindingInfo </servlet-name >
461+ <url-pattern >/bcdui/servlets/BindingInfo /*</url-pattern >
359462 </servlet-mapping >
360463
361464 <!-- Session listener for session logging -->
374477 a thread which keeps the application from shutting down
375478 EHcache is for example used by shiro, check your web.xml -->
376479 <listener >
377- <listener-class >net.sf.ehcache.constructs.web .ShutdownListener</listener-class >
480+ <listener-class >de.businesscode.bcdui.cache .ShutdownListener</listener-class >
378481 </listener >
379482
380483 <!-- i18n configuration -->
398501 <tracking-mode >COOKIE</tracking-mode >
399502 </session-config >
400503
504+ <!-- require SSL -->
505+ <!-- security-constraint>
506+ <web-resource-collection>
507+ <web-resource-name>SPNEGO AUTHENTICATION</web-resource-name>
508+ <url-pattern>/*</url-pattern>
509+ </web-resource-collection>
510+ <user-data-constraint>
511+ <transport-guarantee>CONFIDENTIAL</transport-guarantee>
512+ </user-data-constraint>
513+ </security-constraint -->
514+
515+ <!-- welcome pages -->
516+ <welcome-file-list >
517+ <welcome-file >index.html</welcome-file >
518+ </welcome-file-list >
401519</web-app >
0 commit comments