This document discusses a fix for a serious weakness found in the demo system (GEOS-1792). The following patch eliminates the problem by disabling the demo section of the web interface, it works for Geoserver 1.4.x, 1.5.x and 1.6.x.
All users are strongly encouraged to upgrade to the latest stable version (1.6.2a and newer), which fixes this issue.
Locate the XML file
WEB-INF/struts-config.xml
If you downloaded the Windows installer, and chose the default installation path, it will be in
C:\Program Files\GeoServer 1.5.4\webapps\geoserver\WEB-INF
If you are running Tomcat then you will find it in Tomcats webapps-directory, under geoserver.
Open the file in a text editor(we do not recommend Notepad, but you can try Notepad++) and comment out the following section:
<forward name="welcome.demoRequest" path="/demoRequest.do"/>
so that is looks like this
<!-- <forward name="welcome.demoRequest" path="/demoRequest.do"/> -->
and save the file. Then remember to restart GeoServer.
If you prefer diffs:
Index: 1.5.x/geoserver/web/src/main/webapp/WEB-INF/struts-config.xml
===================================================================
--- 1.5.x/geoserver/web/src/main/webapp/WEB-INF/struts-config.xml
(revision 7710)
+++ 1.5.x/geoserver/web/src/main/webapp/WEB-INF/struts-config.xml
(working copy)
@@ -141,11 +141,12 @@
<forward
name="welcome.demo"
path="/demo.do"/>
-
+
+ <!--
<forward
name="welcome.demoRequest"
path="/demoRequest.do"/>
-
+ -->
<!-- Appearance -->
<forward name="style" path="/style.css"/>
====================================================================