Database Reference
In-Depth Information
Servlet
Provides
Impact of disabling
Java WebStart of Java
Admin Client
Disables the ability to download the Java Admin
Client from eXist as a Java WebStart application.
If you are not allowing remote users to download
the Java Admin Client for eXist from your eXist
server via Java WebStart, then this should be
disabled.
org.exist.webstart.
JnlpServlet
XForms support through
the betterForm engine
Disables server-side XForms support through
betterForm.
If you are not using XForms or are using
XSLTForms or another XForms rendering engine,
then you should disable these servlets, the filter,
and the listener.
org.directwebremoting.serv
let.
DwrServlet
de.betterform.agent.web.serv
let.
XFormsPostServlet
FormsServlet
XFormsInspectorServlet
ResourceServlet
ErrorServlet
BfServletContextListener
de.betterform.agent.web.fil
ter.
XFormsFilter
a Disabling the logging service is not recommended.
Disabling autodeployment of EXPath packages
eXist provides a mechanism to autodeploy applications, extension libraries, and data
provided as EXPath packages to the database at startup time. Any EXPath package
placed in the $EXIST_HOME/autodeploy folder will be loaded into the database at
startup time.
While this is not a threat from within eXist, should someone compromise the user
account under which you run the eXist server, he could potentially place a malicious
package into the autodeploy folder that would be loaded the next time the database
was restarted. Such a package might contain XQuery scripts that perform further
nefarious actions, and these could potentially be invoked remotely.
You can disable the autodeploy folder by commenting out the AutoDeploymentTrig
ger line in $EXIST_HOME/conf.xml . For example:
<!-- trigger class="org.exist.repo.AutoDeploymentTrigger"/ -->
 
Search WWH ::




Custom Search