If you install the web server according the standard configuration, a directory listing is accessible in the browser for some of the ITP/OnLine application folders. It is possible to change this behavior in the web server configuration.
For JBoss, you have to look for the file web.xml and change the parameter value to 'false'. You can find this web.xml file for example in: \jboss-4.0.0\server\default\deploy\jbossweb-tomcat50.sar\web.xml.
The following setting determines that directory listings are not shown.
<servlet>
<servlet-name>default</servlet-name>
<servlet-class>
org.apache.catalina.servlets.DefaultServlet
</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>0</param-value>
</init-param>
<init-param>
<param-name>listings</param-name>
<param-value>false</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>