[CR #311651] The EP Web application (onepage) consists of some directories that are accessible to anyone.
Workaround: Configure EAServer to restrict access to the onepage files.
Restricting access to onepage files
Start Jaguar Manager, and connect to EAServer.
Expand these successive folders: Servers | Jaguar | Installed Web Applications.
Highlight onepage, and select File | Web Application Properties. This displays the Web Application Properties dialog box.
Select the Role Mapping tab, and click Add. This creates a new row in the row mapping table.
In the new row, under J2EE Role, enter “No Access”. In the same row, under Jaguar Role, select “nobody” from the drop-down list.
Select the Security tab, and under Security Constraints, click Add. This adds a new row to the Security Constraints list.
Highlight the new row, and click Web Resource Collection | Edit. The Web Resource Collection dialog box displays.
Click Add. This creates a new collection called “securityzone.”
Highlight securityzone, and select all the collection attributes: Get, Post, Put, Delete, Options, and Trace.
Under URL Patterns, click Add. This creates a new row in the URL Patterns list.
In the new row, enter “/config/*” as the URL, then click OK. This restricts access to all the files under the onepage/config directory.
On the Security tab, select Enable Authorization and Authorized Roles | Edit. The Select Roles dialog box displays.
Select No Access, and click OK.
In Jaguar Manager, highlight Jaguar, and select File | Shutdown.
Restart EAServer, then reconnect to EAServer from Jaguar Manager.
