log4j.xml in the ESAPI jar is used by default in web applications

[GoogleCodeExporter]

What steps will reproduce the problem?
1. Make a WEB project with a custom log4j.properties file that includes the 
ESAPI jar.
2. Deploy to an application server such as Tomcat.
3. Watch the logs be output using the configuration in the log4j.xml file 
from the ESAPI jar.

What is the expected output? What do you see instead?
The configuration in the local log4j.properties should be used instead of 
the ESAPI log4j configuration. 

What version of the product are you using? On what operating system?
ESAPI 2.0_rc6, Log4j 1.2, Tomcat, Windows XP.

Please provide any additional information below.
Log4j by default looks for a log4j.xml file in the classpath and when that 
one cannot be found it looks for a log4j.properties file. This issue can be 
solved by writing your own configuration using XML, however the properties 
file format is much easier to edit and is preferred by some developers that 
don't need the extra configuration options available with the XML 
configuration.

I don't really see the reason for having a configuration file for Log4j in 
EASPI in the first place, but someone could perhaps enlighten me?

Original issue reported on code.google.com by mandus.e...@gmail.com on 20 Apr 2010 at 1:36

[GoogleCodeExporter]

As of 2.0 RC7, log4j.xml is no longer included in the ESAPI jar file. The 
log4j.xml or log4j.properties on your own classpath should take precedence. 

Please download the latest JAR or build from source and this issue should be 
fixed. 

Original comment by augu...@gmail.com on 30 Sep 2010 at 3:50

• Changed state: Fixed