Update

See comment below for an update on what needs to be done to address this issue.

Problem description:

I have noticed that when the documentation instructions are followed from here:
http://confluence.atlassian.com/display/JIRA043/Installing+JIRA+on+Tomcat+6.0

Due to step 4 instructions:

Tomcat does not come with some libraries required to run JIRA. To fix this, download

http://downloads.atlassian.com/software/jira/downloads/jira-jars-tomcat-distribution-4.3-tomcat-6x.zip
and copy the contained jars to Tomcat's lib/ directory. (Be sure to remove existing versions of these JAR before copying the new ones.)

In particular, to prevent exceptions related to logging, please ensure that commons-logging-1.0.4.jar and log4j-1.2.15.jar are present in Tomcat's /lib/ directory. Also ensure that these files are not present in Tomcat's webapps/jira/WEB-INF/lib directory.

Additionally, if you are running Sun's distribution of Tomcat, download tomcat-dbcp.jar and copy it to the tomcat6/lib directory.

The jar files below will end up in both of the directories:

• <TOMCAT>\webapp\jira\WEB-INF\lib
• <TOMCAT>\lib

Impact analysis:

Due to this, JIRA may possibly encounter errors like:

java.lang.RuntimeException: XSRF white list failure

Even if not, it does not make sense that there should be duplicate jar files accessible to JIRA.

Suggested resolution:

• Either these jar files can be removed from the JIRA jars tomcat distribution libraries:
  http://downloads.atlassian.com/software/jira/downloads/jira-jars-tomcat-distribution-4.3-tomcat-6x.zip
• Or the documentation needs to be updated to warn about these duplicates and ask the user to delete them if they exist.

Note: tested with JIRA 4.3. The same problem may exist with massive amount of JIRA versions

Thank you very much,
Ali
Atlassian Support