<?xml version="1.0" encoding="ISO-8859-1" standalone="no"?>
<!DOCTYPE web-xml [
	<!ENTITY servlets-config SYSTEM "servlets.xml">
]>


<!-- this is based on a sample web.xml file provided by 
http://jakarta.apache.org/tomcat/tomcat-4.0-doc/appdev/web.xml.txt
-->
<web-app>
	<display-name>GSDL3</display-name>
	<description>
		Greenstone digital library version 3.
	</description>
	
	<!-- We set up a threadlocal thing storing one domparser per thread. we must clear those. 
	     Filters are run in the  order specified here, and clean up happens in reverse order, so this filter
	     must come first in the list -->
	<filter>
	  <filter-name>threadLocalCleanup</filter-name>
	  <filter-class>org.greenstone.gsdl3.core.ThreadLocalCleanUpFilter</filter-class>
	</filter>
	
	<filter-mapping>
	  <filter-name>threadLocalCleanup</filter-name>
	  <url-pattern>/*</url-pattern>
	</filter-mapping>
	
	<filter>
		<filter-name>Greenstone URL Filter</filter-name>
		<filter-class>org.greenstone.gsdl3.core.URLFilter</filter-class>
	</filter>

	<filter-mapping>
		<filter-name>Greenstone URL Filter</filter-name>
		<url-pattern>*</url-pattern>
	</filter-mapping>
  
	<!-- Context initialization parameters that define shared
	String constants used within your application, which
	can be customized by the system administrator who is
	installing your application.  The values actually
	assigned to these parameters can be retrieved in a
	servlet or JSP page by calling:

	String value =
	getServletContext().getInitParameter("name");

	where "name" matches the <param-name> element of
	one of these initialization parameters.

	You can define any number of context initialization
	parameters, including zero.
	-->
  
	<context-param>
		<param-name>webmaster</param-name>
		<param-value>greenstone-users@lists.sourceforge.net</param-value>
		<description>
			The EMAIL address of the administrator to whom questions
			and comments about this application should be addressed.
		</description>
	</context-param>
  

	<!-- Servlet definitions for the servlets that make up
	your web application, including initialization
	parameters.  With Tomcat, you can also send requests
	to servlets not listed here with a request like this:

	http://localhost:8080/{context-path}/servlet/{classname}

	but this usage is not guaranteed to be portable.  It also
	makes relative references to images and other resources
	required by your servlet more complicated, so defining
	all of your servlets (and defining a mapping to them with
	a servlet-mapping element) is recommended.

	Servlet initialization parameters can be retrieved in a
	servlet or JSP page by calling:

	String value =
	getServletConfig().getInitParameter("name");

	where "name" matches the <param-name> element of
	one of these initialization parameters.

	You can define any number of servlets, including zero.
	-->

	<!-- For client side text fetching - do we even use this?? -->
	<servlet>
		<servlet-name>grabtext</servlet-name>
		<description>Grabs text for client-side display with minimal overhead.</description>
		<servlet-class>org.greenstone.gsdl3.ClientSideServlet</servlet-class>
	</servlet>

        <servlet-mapping>
		<servlet-name>grabtext</servlet-name>
		<url-pattern>/grabtext</url-pattern>
	</servlet-mapping>

	<!-- See servlets.xml - contains all the main greenstone servlets -->
	&servlets-config;

	-->
	<!-- Metadata Analysis tool-->
        <!--
	<servlet>
		<servlet-name>mat</servlet-name>
		<description>Metadata Analysis Tool</description>
		<servlet-class>org.greenstone.mat.servlet.MatServlet</servlet-class>
	</servlet>

	<servlet-mapping>
		<servlet-name>mat</servlet-name>
		<url-pattern>/mat</url-pattern>
	</servlet-mapping>

        -->


  <!-- Define the default session timeout for your application,
  in minutes.  From a servlet or JSP page, you can modify
  the timeout for a particular session dynamically by using
  HttpSession.getMaxInactiveInterval(). -->

  <session-config>
    <session-timeout>240</session-timeout>    <!-- 4 hours -->
    <cookie-config>
      <http-only>true</http-only>
      <secure>true</secure>
    </cookie-config>
  </session-config>


<!-- Deny access to contents of URL pattern /logs/*, although greenstone.log is the important one. It appears the url pattern has to be relative to the web directory. 
http://stackoverflow.com/questions/5333266/tomcat-deny-access-to-specific-files
and http://www.coderanch.com/t/84442/Tomcat/write-correct-url-pattern-security -->
  <security-constraint>
    <web-resource-collection>
        <web-resource-name>log files</web-resource-name>
        <description>No direct access to greenstone's logs.</description>
        <url-pattern>/logs/*</url-pattern>
        <http-method>POST</http-method>
        <http-method>GET</http-method>
    </web-resource-collection>
    <auth-constraint>
        <description>No direct browser access to log files. By having no role-name element here, no access will be granted to anyone.</description>
    </auth-constraint>
  </security-constraint>

</web-app>
