diff -ur commons-logging/src/java/org/apache/commons/logging/impl/Log4jProxy.java commons-logging-1.1.0-jboss-patched/src/java/org/apache/commons/logging/impl/Log4jProxy.java
--- commons-logging/src/java/org/apache/commons/logging/impl/Log4jProxy.java	2007-02-12 00:59:42.000000000 -0700
+++ commons-logging-1.1.0-jboss-patched/src/java/org/apache/commons/logging/impl/Log4jProxy.java	2009-07-16 09:58:23.000000000 -0600
@@ -27,6 +27,7 @@
 import java.net.URL;
 
 import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 
 /**
  * A Log implementation that reflectively queries for the log4j Logger methods
@@ -61,7 +62,17 @@
       {
          public Object run()
          {
-            ClassLoader loader = Thread.currentThread().getContextClassLoader();
+            ClassLoader loader = null;
+            if(!LogFactory.useTCCL)
+            {
+               loader = LogFactory.thisClassLoader;
+            }
+            // Fall back to the original behavior
+            if(LogFactory.useTCCL || loader == null)
+            {
+
+               loader = Thread.currentThread().getContextClassLoader();
+            }
             // Validate that TCL can actually see the log4j classes
             try
             {
@@ -73,7 +84,6 @@
                ClassLoader testCL = levelClass.getClassLoader();
                if( testCL != loggerClass.getClassLoader()
                   || testCL != categoryClass.getClassLoader()
-                  || testCL != loggerClass.getClassLoader()
                   || testCL != priorityClass.getClassLoader() )
                {
                   loader = Log4jProxy.class.getClassLoader();
diff -ur commons-logging/src/java/org/apache/commons/logging/impl/LogFactoryImpl.java commons-logging-1.1.0-jboss-patched/src/java/org/apache/commons/logging/impl/LogFactoryImpl.java
--- commons-logging/src/java/org/apache/commons/logging/impl/LogFactoryImpl.java	2007-02-11 13:24:21.000000000 -0700
+++ commons-logging-1.1.0-jboss-patched/src/java/org/apache/commons/logging/impl/LogFactoryImpl.java	2009-06-30 12:12:54.000000000 -0600
@@ -184,7 +184,9 @@
      * Determines whether logging classes should be loaded using the thread-context
      * classloader, or via the classloader that loaded this LogFactoryImpl class.
      */
-    private boolean useTCCL = true;
+    // false by default to prohibit webapps 
+    // moved to LogFactory protected boolean useTCCL
+    //private boolean useTCCL = true;
 
     /**
      * The string prefixed to every message output by the logDiagnostic method.
diff -ur commons-logging/src/java/org/apache/commons/logging/LogFactory.java commons-logging-1.1.0-jboss-patched/src/java/org/apache/commons/logging/LogFactory.java
--- commons-logging/src/java/org/apache/commons/logging/LogFactory.java	2007-02-11 13:24:39.000000000 -0700
+++ commons-logging-1.1.0-jboss-patched/src/java/org/apache/commons/logging/LogFactory.java	2009-07-16 09:58:41.000000000 -0600
@@ -66,6 +66,7 @@
      * context class loader (TCCL), or not. By default, the TCCL is used.
      */
     public static final String TCCL_KEY = "use_tccl";
+    public static boolean useTCCL = false;
 
     /**
      * The name (<code>org.apache.commons.logging.LogFactory</code>) of the property 
@@ -178,7 +179,8 @@
      * AccessControllers etc. It's more efficient to compute it once and
      * cache it here.
      */
-    private static ClassLoader thisClassLoader;
+    // TBD - might be useful
+    public static ClassLoader thisClassLoader;
     
     // ----------------------------------------------------------- Constructors
 
@@ -811,8 +813,6 @@
      * cannot be identified.
      * 
      * @exception SecurityException if the java security policy forbids
-     * access to the context classloader from one of the classes in the
-     * current call stack. 
      * @since 1.1
      */
     protected static ClassLoader directGetContextClassLoader()
@@ -820,6 +820,11 @@
     {
         ClassLoader classLoader = null;
 
+         if(!useTCCL)
+         {
+            return thisClassLoader;
+         }
+
         try {
             // Are we running on a JDK 1.2 or later system?
             Method method = Thread.class.getMethod("getContextClassLoader", 
