Use xml / javaconfig folders for samples
Fixes gh-3752
This commit is contained in:
Joe Grandja
@@ -0,0 +1,14 @@
|
||||
<configuration>
|
||||
<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
|
||||
<encoder>
|
||||
<pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
|
||||
</encoder>
|
||||
</appender>
|
||||
|
||||
<!-- <logger name="org.springframework.security" level="DEBUG"/> -->
|
||||
|
||||
<root level="WARN">
|
||||
<appender-ref ref="STDOUT" />
|
||||
</root>
|
||||
|
||||
</configuration>
|
||||
@@ -0,0 +1,6 @@
|
||||
err.name=Name 3-50 characters is required.
|
||||
err.email=Email 3-50 characters is required.
|
||||
err.permission=Permission is required.
|
||||
err.recipient=Recipient is required.
|
||||
err.permission.invalid=The indicated permission is invalid.
|
||||
err.recipient.length=The recipient is too long (maximum 100 characters).
|
||||
@@ -0,0 +1,27 @@
|
||||
<beans xmlns="http://www.springframework.org/schema/beans"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xmlns:p="http://www.springframework.org/schema/p"
|
||||
xmlns:context="http://www.springframework.org/schema/context"
|
||||
xmlns:mvc="http://www.springframework.org/schema/mvc"
|
||||
xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd
|
||||
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
|
||||
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd">
|
||||
|
||||
<!-- ========================== WEB DEFINITIONS ======================= -->
|
||||
|
||||
<context:component-scan base-package="sample.contact"/>
|
||||
<context:annotation-config />
|
||||
|
||||
<mvc:annotation-driven/>
|
||||
<mvc:view-controller path="/frames.htm" view-name="/frames"/>
|
||||
|
||||
<bean id="messageSource" class="org.springframework.context.support.ResourceBundleMessageSource">
|
||||
<property name="basename" value="messages"/>
|
||||
</bean>
|
||||
|
||||
<bean id="viewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver">
|
||||
<property name="prefix" value="/WEB-INF/jsp/"/>
|
||||
<property name="suffix" value=".jsp"/>
|
||||
</bean>
|
||||
|
||||
</beans>
|
||||
42
samples/xml/contacts/src/main/webapp/WEB-INF/jsp/add.jsp
Normal file
42
samples/xml/contacts/src/main/webapp/WEB-INF/jsp/add.jsp
Normal file
@@ -0,0 +1,42 @@
|
||||
<%@ include file="/WEB-INF/jsp/include.jsp" %>
|
||||
<html>
|
||||
<head><title>Add New Contact</title></head>
|
||||
<body>
|
||||
<h1>Add Contact</h1>
|
||||
<form method="post">
|
||||
<table width="95%" bgcolor="f8f8ff" border="0" cellspacing="0" cellpadding="5">
|
||||
<tr>
|
||||
<td alignment="right" width="20%">Name:</td>
|
||||
<spring:bind path="webContact.name">
|
||||
<td width="20%">
|
||||
<input type="text" name="name" value="<c:out value="${status.value}"/>">
|
||||
</td>
|
||||
<td width="60%">
|
||||
<font color="red"><c:out value="${status.errorMessage}"/></font>
|
||||
</td>
|
||||
</spring:bind>
|
||||
</tr>
|
||||
<tr>
|
||||
<td alignment="right" width="20%">Email:</td>
|
||||
<spring:bind path="webContact.email">
|
||||
<td width="20%">
|
||||
<input type="text" name="email" value="<c:out value="${status.value}"/>">
|
||||
</td>
|
||||
<td width="60%">
|
||||
<font color="red"><c:out value="${status.errorMessage}"/></font>
|
||||
</td>
|
||||
</spring:bind>
|
||||
</tr>
|
||||
</table>
|
||||
<br>
|
||||
<spring:hasBindErrors name="webContact">
|
||||
<b>Please fix all errors!</b>
|
||||
</spring:hasBindErrors>
|
||||
<br><br>
|
||||
|
||||
<input type="hidden" name="<c:out value="${_csrf.parameterName}"/>" value="<c:out value="${_csrf.token}"/>"/>
|
||||
<input name="execute" type="submit" alignment="center" value="Execute">
|
||||
</form>
|
||||
<a href="<c:url value="../hello.htm"/>">Home</a>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,56 @@
|
||||
<%@ include file="/WEB-INF/jsp/include.jsp" %>
|
||||
<html>
|
||||
<head><title>Add Permission</title></head>
|
||||
<body>
|
||||
<h1>Add Permission</h1>
|
||||
<form method="post">
|
||||
<table width="95%" bgcolor="f8f8ff" border="0" cellspacing="0" cellpadding="5">
|
||||
<tr>
|
||||
<td alignment="right" width="20%">Contact:</td>
|
||||
<td width="60%"><c:out value="${addPermission.contact}"/></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td alignment="right" width="20%">Recipient:</td>
|
||||
<spring:bind path="addPermission.recipient">
|
||||
<td width="20%">
|
||||
<select name="<c:out value="${status.expression}"/>">
|
||||
<c:forEach var="thisRecipient" items="${recipients}">
|
||||
<option <c:if test="${thisRecipient.key == status.value}">selected</c:if> value="<c:out value="${thisRecipient.key}"/>">
|
||||
<c:out value="${thisRecipient.value}"/></option>
|
||||
</c:forEach>
|
||||
</select>
|
||||
</td>
|
||||
<td width="60%">
|
||||
<font color="red"><c:out value="${status.errorMessage}"/></font>
|
||||
</td>
|
||||
</spring:bind>
|
||||
</tr>
|
||||
<tr>
|
||||
<td alignment="right" width="20%">Permission:</td>
|
||||
<spring:bind path="addPermission.permission">
|
||||
<td width="20%">
|
||||
<select name="<c:out value="${status.expression}"/>">
|
||||
<c:forEach var="thisPermission" items="${permissions}">
|
||||
<option <c:if test="${thisPermission.key == status.value}">selected</c:if> value="<c:out value="${thisPermission.key}"/>">
|
||||
<c:out value="${thisPermission.value}"/></option>
|
||||
</c:forEach>
|
||||
</select>
|
||||
</td>
|
||||
<td width="60%">
|
||||
<font color="red"><c:out value="${status.errorMessage}"/></font>
|
||||
</td>
|
||||
</spring:bind>
|
||||
</tr>
|
||||
</table>
|
||||
<br>
|
||||
<spring:hasBindErrors name="webContact">
|
||||
<b>Please fix all errors!</b>
|
||||
</spring:hasBindErrors>
|
||||
<br><br>
|
||||
<input type="hidden" name="<c:out value="${_csrf.parameterName}"/>" value="<c:out value="${_csrf.token}"/>"/>
|
||||
<input name="execute" type="submit" alignment="center" value="Execute">
|
||||
</form>
|
||||
<p>
|
||||
<A HREF="<c:url value="adminPermission.htm"><c:param name="contactId" value="${addPermission.contact.id}"/></c:url>">Admin Permission</A> <a href="<c:url value="index.htm"/>">Manage</a>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,30 @@
|
||||
<%@ include file="/WEB-INF/jsp/include.jsp" %>
|
||||
|
||||
<html>
|
||||
<head><title>Administer Permissions</title></head>
|
||||
<body>
|
||||
<h1>Administer Permissions</h1>
|
||||
<p>
|
||||
<code>
|
||||
<c:out value="${model.contact}"/>
|
||||
</code>
|
||||
</p>
|
||||
<table cellpadding="3" border="0">
|
||||
<c:forEach var="acl" items="${model.acl.entries}">
|
||||
<tr>
|
||||
<td>
|
||||
<code>
|
||||
<c:out value="${acl}"/>
|
||||
</code>
|
||||
</td>
|
||||
<td>
|
||||
<a href="<c:url value="deletePermission.htm"><c:param name="contactId" value="${model.contact.id}"/><c:param name="sid" value="${acl.sid.principal}"/><c:param name="permission" value="${acl.permission.mask}"/></c:url>">Del</a>
|
||||
</td>
|
||||
</tr>
|
||||
</c:forEach>
|
||||
</table>
|
||||
<p>
|
||||
<a href="<c:url value="addPermission.htm"><c:param name="contactId" value="${model.contact.id}"/></c:url>">Add Permission</a> <a href="<c:url value="index.htm"/>">Manage</a>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,20 @@
|
||||
<%@ include file="/WEB-INF/jsp/include.jsp" %>
|
||||
|
||||
<html>
|
||||
<head><title>Permission Deleted</title></head>
|
||||
<body>
|
||||
<h1>Permission Deleted</h1>
|
||||
<P>
|
||||
<code>
|
||||
<c:out value="${model.contact}"/>
|
||||
</code>
|
||||
<P>
|
||||
<code>
|
||||
<c:out value="${model.sid}"/>
|
||||
</code>
|
||||
<code>
|
||||
<c:out value="${model.permission}"/>
|
||||
</code>
|
||||
<p><a href="<c:url value="index.htm"/>">Manage</a>
|
||||
</body>
|
||||
</html>
|
||||
13
samples/xml/contacts/src/main/webapp/WEB-INF/jsp/deleted.jsp
Normal file
13
samples/xml/contacts/src/main/webapp/WEB-INF/jsp/deleted.jsp
Normal file
@@ -0,0 +1,13 @@
|
||||
<%@ include file="/WEB-INF/jsp/include.jsp" %>
|
||||
|
||||
<html>
|
||||
<head><title>Deletion completed</title></head>
|
||||
<body>
|
||||
<h1>Deleted</h1>
|
||||
<P>
|
||||
<code>
|
||||
<c:out value="${contact}"/>
|
||||
</code>
|
||||
<p><a href="<c:url value="index.htm"/>">Manage</a>
|
||||
</body>
|
||||
</html>
|
||||
10
samples/xml/contacts/src/main/webapp/WEB-INF/jsp/frames.jsp
Normal file
10
samples/xml/contacts/src/main/webapp/WEB-INF/jsp/frames.jsp
Normal file
@@ -0,0 +1,10 @@
|
||||
<html>
|
||||
<head>
|
||||
<title>Frames</title>
|
||||
</head>
|
||||
<body>
|
||||
<p>This contains frames, but the frames will not be loaded due to the <a href="http://tools.ietf.org/html/draft-ietf-websec-x-frame-options">X-Frame-Options</a>
|
||||
being specified as denied. This protects against <a href="http://en.wikipedia.org/wiki/Clickjacking">clickjacking attacks</a></p>
|
||||
<iframe src="./hello.htm" width="500" height="500"></iframe>
|
||||
</body>
|
||||
</html>
|
||||
52
samples/xml/contacts/src/main/webapp/WEB-INF/jsp/hello.jsp
Normal file
52
samples/xml/contacts/src/main/webapp/WEB-INF/jsp/hello.jsp
Normal file
@@ -0,0 +1,52 @@
|
||||
<%@ include file="/WEB-INF/jsp/include.jsp" %>
|
||||
|
||||
<html>
|
||||
<head><title>Contacts Security Demo</title></head>
|
||||
<body>
|
||||
<h1>Contacts Security Demo</h1>
|
||||
<P>Contacts demonstrates the following central Spring Security capabilities:
|
||||
<ul>
|
||||
<li><b>Role-based security</b>. Each principal is a member of certain roles,
|
||||
which are used to restrict access to certain secure objects.</li>
|
||||
<li><b>Domain object instance security</b>. The <code>Contact</code>, the
|
||||
main domain object in the application, has an access control list (ACL)
|
||||
that indicates who is allowed read, administer and delete the object.</li>
|
||||
<li><b>Method invocation security</b>. The <code>ContactManager</code> service
|
||||
layer bean has a number of secured (protected) and public (unprotected)
|
||||
methods.</li>
|
||||
<li><b>Web request security</b>. The <code>/secure</code> URI path is protected
|
||||
by Spring Security from principals not holding the
|
||||
<code>ROLE_USER</code> granted authority.</li>
|
||||
<li><b>Security unaware application objects</b>. None of the objects
|
||||
are aware of the security being implemented by Spring Security. *</li>
|
||||
<li><b>Security taglib usage</b>. All of the JSPs use Spring Security's
|
||||
taglib to evaluate security information. *</li>
|
||||
<li><b>Fully declarative security</b>. Every capability is configured in
|
||||
the application context using standard Spring Security classes. *</li>
|
||||
<li><b>Database-sourced security data</b>. All of the user, role and ACL
|
||||
information is obtained from an in-memory JDBC-compliant database.</li>
|
||||
<li><b>Integrated form-based and BASIC authentication</b>. Any BASIC
|
||||
authentication header is detected and used for authentication. Normal
|
||||
interactive form-based authentication is used by default.</li>
|
||||
<li><b>Remember-me services</b>. Spring Security's pluggable remember-me
|
||||
strategy is demonstrated, with a corresponding checkbox on the login form.</li>
|
||||
</ul>
|
||||
|
||||
* As the application provides an "ACL Administration" use case, those
|
||||
classes are necessarily aware of security. But no business use cases are.
|
||||
|
||||
<p>Please excuse the lack of look 'n' feel polish in this application.
|
||||
It is about security, after all! :-)
|
||||
|
||||
<p>To demonstrate a public method on <code>ContactManager</code>,
|
||||
here's a random <code>Contact</code>:
|
||||
<p>
|
||||
<code>
|
||||
<c:out value="${contact}"/>
|
||||
</code>
|
||||
<p>Get started by clicking "Manage"...
|
||||
<p><A HREF="<c:url value="secure/index.htm"/>">Manage</a>
|
||||
<a href="<c:url value="secure/debug.jsp"/>">Debug</a>
|
||||
<a href="<c:url value="./frames.htm"/>">Frames</a>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,6 @@
|
||||
<%@ taglib prefix="spring" uri="http://www.springframework.org/tags" %>
|
||||
<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>
|
||||
|
||||
<%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
|
||||
<%@taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt" %>
|
||||
<%@ page pageEncoding="UTF-8" %>
|
||||
37
samples/xml/contacts/src/main/webapp/WEB-INF/jsp/index.jsp
Normal file
37
samples/xml/contacts/src/main/webapp/WEB-INF/jsp/index.jsp
Normal file
@@ -0,0 +1,37 @@
|
||||
<%@ include file="/WEB-INF/jsp/include.jsp" %>
|
||||
|
||||
<html>
|
||||
<head><title>Your Contacts</title></head>
|
||||
<body>
|
||||
<h1><security:authentication property="principal.username"/>'s Contacts</h1>
|
||||
<P>
|
||||
<table cellpadding=3 border=0>
|
||||
<tr><td><b>id</b></td><td><b>Name</b></td><td><b>Email</b></td></tr>
|
||||
<c:forEach var="contact" items="${model.contacts}" >
|
||||
<tr>
|
||||
<td>
|
||||
<c:out value="${contact.id}"/>
|
||||
</td>
|
||||
<td>
|
||||
<c:out value="${contact.name}"/>
|
||||
</td>
|
||||
<td>
|
||||
<c:out value="${contact.email}"/>
|
||||
</td>
|
||||
<c:if test="${model.hasDeletePermission[contact]}">
|
||||
<td><a href="<c:url value="del.htm"><c:param name="contactId" value="${contact.id}"/></c:url>">Del</a></td>
|
||||
</c:if>
|
||||
<c:if test="${model.hasAdminPermission[contact]}">
|
||||
<td><a href="<c:url value="adminPermission.htm"><c:param name="contactId" value="${contact.id}"/></c:url>">Admin Permission</a></td>
|
||||
</c:if>
|
||||
</tr>
|
||||
</c:forEach>
|
||||
</table>
|
||||
<p><a href="<c:url value="add.htm"/>">Add</a> </p>
|
||||
|
||||
<form action="<c:url value="/logout"/>" method="post">
|
||||
<input type="submit" value="Logoff"/> (also clears any remember-me cookie)
|
||||
<security:csrfInput/>
|
||||
</form>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,49 @@
|
||||
<?xml version="1.0" encoding="UTF-8" ?>
|
||||
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
|
||||
|
||||
<!--
|
||||
- Contacts web application
|
||||
-->
|
||||
<beans>
|
||||
|
||||
<!-- RMI exporter for the ContactManager -->
|
||||
<!-- This could just as easily have been in
|
||||
applicationContext-common-business.xml, because it doesn't rely on
|
||||
DispatcherServlet or indeed any other HTTP services. It's in this
|
||||
application context simply for logical placement with other
|
||||
remoting exporters. -->
|
||||
<!-- COMMENTED OUT BY DEFAULT TO AVOID CONFLICTS WITH APPLICATION SERVERS
|
||||
<bean id="contactManager-rmi" class="org.springframework.remoting.rmi.RmiServiceExporter">
|
||||
<property name="service"><ref bean="contactManager"/></property>
|
||||
<property name="serviceInterface">
|
||||
<value>sample.contact.ContactManager</value>
|
||||
</property>
|
||||
<property name="serviceName"><value>contactManager</value></property>
|
||||
<property name="registryPort"><value>1099</value></property>
|
||||
</bean>
|
||||
-->
|
||||
|
||||
<!-- HTTP invoker exporter for the ContactManager -->
|
||||
<!-- Spring's HTTP invoker uses Java serialization via HTTP -->
|
||||
<bean name="/ContactManager-httpinvoker" class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
|
||||
<property name="service" ref="contactManager"/>
|
||||
<property name="serviceInterface" value="sample.contact.ContactManager"/>
|
||||
</bean>
|
||||
|
||||
<!-- Hessian exporter for the ContactManager -->
|
||||
<!-- Hessian is a slim binary HTTP remoting protocol -->
|
||||
<!--
|
||||
<bean name="/ContactManager-hessian" class="org.springframework.remoting.caucho.HessianServiceExporter">
|
||||
<property name="service" ref="contactManager"/>
|
||||
<property name="serviceInterface" value="sample.contact.ContactManager"/>
|
||||
</bean>
|
||||
-->
|
||||
<!-- Burlap exporter for the ContactManager -->
|
||||
<!-- Burlap is a slim XML-based HTTP remoting protocol -->
|
||||
<!--
|
||||
<bean name="/ContactManager-burlap" class="org.springframework.remoting.caucho.BurlapServiceExporter">
|
||||
<property name="service" ref="contactManager"/>
|
||||
<property name="serviceInterface" value="sample.contact.ContactManager"/>
|
||||
</bean>
|
||||
-->
|
||||
</beans>
|
||||
311
samples/xml/contacts/src/main/webapp/WEB-INF/spring.tld
Normal file
311
samples/xml/contacts/src/main/webapp/WEB-INF/spring.tld
Normal file
@@ -0,0 +1,311 @@
|
||||
<?xml version="1.0" encoding="ISO-8859-1" ?>
|
||||
<!DOCTYPE taglib PUBLIC "-//Sun Microsystems, Inc.//DTD JSP Tag Library 1.2//EN" "http://java.sun.com/dtd/web-jsptaglibrary_1_2.dtd">
|
||||
|
||||
<taglib>
|
||||
|
||||
<tlib-version>1.1.1</tlib-version>
|
||||
|
||||
<jsp-version>1.2</jsp-version>
|
||||
|
||||
<short-name>Spring</short-name>
|
||||
|
||||
<uri>http://www.springframework.org/tags</uri>
|
||||
|
||||
<description>Spring Framework JSP Tag Library. Authors: Rod Johnson, Juergen Hoeller</description>
|
||||
|
||||
|
||||
<tag>
|
||||
|
||||
<name>htmlEscape</name>
|
||||
<tag-class>org.springframework.web.servlet.tags.HtmlEscapeTag</tag-class>
|
||||
<body-content>JSP</body-content>
|
||||
|
||||
<description>
|
||||
Sets default HTML escape value for the current page.
|
||||
Overrides a "defaultHtmlEscape" context-param in web.xml, if any.
|
||||
</description>
|
||||
|
||||
<attribute>
|
||||
<name>defaultHtmlEscape</name>
|
||||
<required>true</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
</tag>
|
||||
|
||||
|
||||
<tag>
|
||||
|
||||
<name>escapeBody</name>
|
||||
<tag-class>org.springframework.web.servlet.tags.EscapeBodyTag</tag-class>
|
||||
<body-content>JSP</body-content>
|
||||
|
||||
<description>
|
||||
Escapes its enclosed body content, applying HTML escaping and/or JavaScript escaping.
|
||||
The HTML escaping flag participates in a page-wide or application-wide setting
|
||||
(i.e. by HtmlEscapeTag or a "defaultHtmlEscape" context-param in web.xml).
|
||||
</description>
|
||||
|
||||
<attribute>
|
||||
<name>htmlEscape</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>javaScriptEscape</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
</tag>
|
||||
|
||||
|
||||
<tag>
|
||||
|
||||
<name>message</name>
|
||||
<tag-class>org.springframework.web.servlet.tags.MessageTag</tag-class>
|
||||
<body-content>JSP</body-content>
|
||||
|
||||
<description>
|
||||
Retrieves the message with the given code, or text if code isn't resolvable.
|
||||
The HTML escaping flag participates in a page-wide or application-wide setting
|
||||
(i.e. by HtmlEscapeTag or a "defaultHtmlEscape" context-param in web.xml).
|
||||
</description>
|
||||
|
||||
<attribute>
|
||||
<name>code</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>arguments</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>text</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>var</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>scope</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>htmlEscape</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>javaScriptEscape</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
</tag>
|
||||
|
||||
|
||||
<tag>
|
||||
|
||||
<name>theme</name>
|
||||
<tag-class>org.springframework.web.servlet.tags.ThemeTag</tag-class>
|
||||
<body-content>JSP</body-content>
|
||||
|
||||
<description>
|
||||
Retrieves the theme message with the given code, or text if code isn't resolvable.
|
||||
The HTML escaping flag participates in a page-wide or application-wide setting
|
||||
(i.e. by HtmlEscapeTag or a "defaultHtmlEscape" context-param in web.xml).
|
||||
</description>
|
||||
|
||||
<attribute>
|
||||
<name>code</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>arguments</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>text</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>var</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>scope</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>htmlEscape</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>javaScriptEscape</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
</tag>
|
||||
|
||||
|
||||
<tag>
|
||||
|
||||
<name>hasBindErrors</name>
|
||||
<tag-class>org.springframework.web.servlet.tags.BindErrorsTag</tag-class>
|
||||
<body-content>JSP</body-content>
|
||||
|
||||
<description>
|
||||
Provides Errors instance in case of bind errors.
|
||||
The HTML escaping flag participates in a page-wide or application-wide setting
|
||||
(i.e. by HtmlEscapeTag or a "defaultHtmlEscape" context-param in web.xml).
|
||||
</description>
|
||||
|
||||
<variable>
|
||||
<name-given>errors</name-given>
|
||||
<variable-class>org.springframework.validation.Errors</variable-class>
|
||||
</variable>
|
||||
|
||||
<attribute>
|
||||
<name>name</name>
|
||||
<required>true</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>htmlEscape</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
</tag>
|
||||
|
||||
|
||||
<tag>
|
||||
|
||||
<name>nestedPath</name>
|
||||
<tag-class>org.springframework.web.servlet.tags.NestedPathTag</tag-class>
|
||||
<body-content>JSP</body-content>
|
||||
|
||||
<description>
|
||||
Sets a nested path to be used by the bind tag's path.
|
||||
</description>
|
||||
|
||||
<variable>
|
||||
<name-given>nestedPath</name-given>
|
||||
<variable-class>java.lang.String</variable-class>
|
||||
</variable>
|
||||
|
||||
<attribute>
|
||||
<name>path</name>
|
||||
<required>true</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
</tag>
|
||||
|
||||
|
||||
<tag>
|
||||
|
||||
<name>bind</name>
|
||||
<tag-class>org.springframework.web.servlet.tags.BindTag</tag-class>
|
||||
<body-content>JSP</body-content>
|
||||
|
||||
<description>
|
||||
Provides BindStatus object for the given bind path.
|
||||
The HTML escaping flag participates in a page-wide or application-wide setting
|
||||
(i.e. by HtmlEscapeTag or a "defaultHtmlEscape" context-param in web.xml).
|
||||
</description>
|
||||
|
||||
<variable>
|
||||
<name-given>status</name-given>
|
||||
<variable-class>org.springframework.web.servlet.support.BindStatus</variable-class>
|
||||
</variable>
|
||||
|
||||
<attribute>
|
||||
<name>path</name>
|
||||
<required>true</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>ignoreNestedPath</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>htmlEscape</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
</tag>
|
||||
|
||||
|
||||
<tag>
|
||||
|
||||
<name>transform</name>
|
||||
<tag-class>org.springframework.web.servlet.tags.TransformTag</tag-class>
|
||||
<body-content>JSP</body-content>
|
||||
|
||||
<description>
|
||||
Provides transformation of variables to Strings, using an appropriate
|
||||
custom PropertyEditor from BindTag (can only be used inside BindTag).
|
||||
The HTML escaping flag participates in a page-wide or application-wide setting
|
||||
(i.e. by HtmlEscapeTag or a "defaultHtmlEscape" context-param in web.xml).
|
||||
</description>
|
||||
|
||||
<attribute>
|
||||
<name>value</name>
|
||||
<required>true</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>var</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>scope</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
<attribute>
|
||||
<name>htmlEscape</name>
|
||||
<required>false</required>
|
||||
<rtexprvalue>true</rtexprvalue>
|
||||
</attribute>
|
||||
|
||||
</tag>
|
||||
|
||||
</taglib>
|
||||
99
samples/xml/contacts/src/main/webapp/WEB-INF/web.xml
Normal file
99
samples/xml/contacts/src/main/webapp/WEB-INF/web.xml
Normal file
@@ -0,0 +1,99 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
|
||||
<!--
|
||||
- Contacts web application
|
||||
-
|
||||
-->
|
||||
|
||||
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
|
||||
<display-name>Contacts Sample Application</display-name>
|
||||
|
||||
<!--
|
||||
- Location of the XML file that defines the root application context
|
||||
- Applied by ContextLoaderListener.
|
||||
-->
|
||||
<context-param>
|
||||
<param-name>contextConfigLocation</param-name>
|
||||
<param-value>
|
||||
classpath:applicationContext-common-business.xml
|
||||
classpath:applicationContext-common-authorization.xml
|
||||
classpath:applicationContext-security.xml
|
||||
</param-value>
|
||||
</context-param>
|
||||
|
||||
<!-- Nothing below here needs to be modified -->
|
||||
|
||||
<context-param>
|
||||
<param-name>webAppRootKey</param-name>
|
||||
<param-value>contacts.root</param-value>
|
||||
</context-param>
|
||||
|
||||
<filter>
|
||||
<filter-name>localizationFilter</filter-name>
|
||||
<filter-class>org.springframework.web.filter.RequestContextFilter</filter-class>
|
||||
</filter>
|
||||
|
||||
<filter>
|
||||
<filter-name>springSecurityFilterChain</filter-name>
|
||||
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
|
||||
</filter>
|
||||
|
||||
<filter-mapping>
|
||||
<filter-name>localizationFilter</filter-name>
|
||||
<url-pattern>/*</url-pattern>
|
||||
</filter-mapping>
|
||||
|
||||
<filter-mapping>
|
||||
<filter-name>springSecurityFilterChain</filter-name>
|
||||
<url-pattern>/*</url-pattern>
|
||||
</filter-mapping>
|
||||
|
||||
<!--
|
||||
- Loads the root application context of this web app at startup.
|
||||
- The application context is then available via
|
||||
- WebApplicationContextUtils.getWebApplicationContext(servletContext).
|
||||
-->
|
||||
<listener>
|
||||
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
|
||||
</listener>
|
||||
|
||||
<!--
|
||||
- Provides core MVC application controller. See contacts-servlet.xml.
|
||||
-->
|
||||
<servlet>
|
||||
<servlet-name>contacts</servlet-name>
|
||||
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
|
||||
<load-on-startup>1</load-on-startup>
|
||||
</servlet>
|
||||
|
||||
<!--
|
||||
- Provides web services endpoint. See remoting-servlet.xml.
|
||||
-->
|
||||
<servlet>
|
||||
<servlet-name>remoting</servlet-name>
|
||||
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
|
||||
<load-on-startup>2</load-on-startup>
|
||||
</servlet>
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>contacts</servlet-name>
|
||||
<url-pattern>*.htm</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
<servlet-mapping>
|
||||
<servlet-name>remoting</servlet-name>
|
||||
<url-pattern>/remoting/*</url-pattern>
|
||||
</servlet-mapping>
|
||||
|
||||
<welcome-file-list>
|
||||
<welcome-file>index.jsp</welcome-file>
|
||||
</welcome-file-list>
|
||||
|
||||
<error-page>
|
||||
<error-code>403</error-code>
|
||||
<location>/error.html</location>
|
||||
</error-page>
|
||||
|
||||
</web-app>
|
||||
22
samples/xml/contacts/src/main/webapp/accessDenied.jsp
Normal file
22
samples/xml/contacts/src/main/webapp/accessDenied.jsp
Normal file
@@ -0,0 +1,22 @@
|
||||
<%@ page import="org.springframework.security.core.context.SecurityContextHolder" %>
|
||||
<%@ page import="org.springframework.security.core.Authentication" %>
|
||||
|
||||
<html>
|
||||
<head>
|
||||
<title>Access Denied</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<h1>Sorry, access is denied</h1>
|
||||
|
||||
<p>
|
||||
<%= request.getAttribute("SPRING_SECURITY_403_EXCEPTION")%>
|
||||
</p>
|
||||
<p>
|
||||
<% Authentication auth = SecurityContextHolder.getContext().getAuthentication();
|
||||
if (auth != null) { %>
|
||||
Authentication object as a String: <%= auth.toString() %><br /><br />
|
||||
<% } %>
|
||||
</p>
|
||||
</body>
|
||||
</html>
|
||||
5
samples/xml/contacts/src/main/webapp/error.html
Normal file
5
samples/xml/contacts/src/main/webapp/error.html
Normal file
@@ -0,0 +1,5 @@
|
||||
<html>
|
||||
<title>Access denied!</title>
|
||||
<h1>Access Denied</h1>
|
||||
<p>We're sorry, but you are not authorized to perform the requested operation.</p>
|
||||
</html>
|
||||
39
samples/xml/contacts/src/main/webapp/exitUser.jsp
Normal file
39
samples/xml/contacts/src/main/webapp/exitUser.jsp
Normal file
@@ -0,0 +1,39 @@
|
||||
<%@ taglib prefix='c' uri='http://java.sun.com/jsp/jstl/core' %>
|
||||
|
||||
<%@ page import="org.springframework.security.core.Authentication" %>
|
||||
<%@ page import="org.springframework.security.core.context.SecurityContextHolder" %>
|
||||
<%@ page pageEncoding="UTF-8" %>
|
||||
|
||||
<html>
|
||||
<head>
|
||||
<title>Exit User</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<h1>Exit User</h1>
|
||||
|
||||
<c:if test="${not empty param.login_error}">
|
||||
<font color="red">
|
||||
Your 'Exit User' attempt was not successful, try again.<br/><br/>
|
||||
Reason: <c:out value="${SPRING_SECURITY_LAST_EXCEPTION.message}"/>
|
||||
</font>
|
||||
</c:if>
|
||||
|
||||
<form action="<c:url value='logout/impersonate'/>" method="POST">
|
||||
<table>
|
||||
<tr><td>Current User:</td><td>
|
||||
|
||||
<%
|
||||
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
|
||||
if (auth != null) { %>
|
||||
|
||||
<%= auth.getPrincipal().toString() %>
|
||||
|
||||
<% } %>
|
||||
</td></tr>
|
||||
<tr><td colspan='2'><input name="exit" type="submit" value="Exit"></td></tr>
|
||||
</table>
|
||||
<input type="hidden" name="<c:out value="${_csrf.parameterName}"/>" value="<c:out value="${_csrf.token}"/>"/>
|
||||
</form>
|
||||
</body>
|
||||
</html>
|
||||
4
samples/xml/contacts/src/main/webapp/index.jsp
Normal file
4
samples/xml/contacts/src/main/webapp/index.jsp
Normal file
@@ -0,0 +1,4 @@
|
||||
<%@ include file="/WEB-INF/jsp/include.jsp" %>
|
||||
|
||||
<%-- Redirected because we can't set the welcome page to a virtual URL. --%>
|
||||
<c:redirect url="/hello.htm"/>
|
||||
47
samples/xml/contacts/src/main/webapp/login.jsp
Normal file
47
samples/xml/contacts/src/main/webapp/login.jsp
Normal file
@@ -0,0 +1,47 @@
|
||||
<%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
|
||||
<%@ page pageEncoding="UTF-8" %>
|
||||
|
||||
<html>
|
||||
<head>
|
||||
<title>Login</title>
|
||||
</head>
|
||||
|
||||
<body onload="document.f.username.focus();">
|
||||
<h1>Login</h1>
|
||||
|
||||
<p>Valid users:
|
||||
<p>
|
||||
<p>username <b>rod</b>, password <b>koala</b>
|
||||
<p>username <b>dianne</b>, password <b>emu</b>
|
||||
<p>username <b>scott</b>, password <b>wombat</b>
|
||||
<p>username <b>peter</b>, password <b>opal</b> (user disabled)
|
||||
<p>username <b>bill</b>, password <b>wombat</b>
|
||||
<p>username <b>bob</b>, password <b>wombat</b>
|
||||
<p>username <b>jane</b>, password <b>wombat</b>
|
||||
<p>
|
||||
|
||||
<p>Locale is: <%= request.getLocale() %></p>
|
||||
<%-- this form-login-page form is also used as the
|
||||
form-error-page to ask for a login again.
|
||||
--%>
|
||||
<c:if test="${not empty param.login_error}">
|
||||
<font color="red">
|
||||
Your login attempt was not successful, try again.<br/><br/>
|
||||
Reason: <c:out value="${SPRING_SECURITY_LAST_EXCEPTION.message}"/>.
|
||||
</font>
|
||||
</c:if>
|
||||
|
||||
<form name="f" action="<c:url value='login'/>" method="POST">
|
||||
<table>
|
||||
<tr><td>User:</td><td><input type='text' name='username' value='<c:if test="${not empty param.login_error}"><c:out value="${SPRING_SECURITY_LAST_USERNAME}"/></c:if>'/></td></tr>
|
||||
<tr><td>Password:</td><td><input type='password' name='password'></td></tr>
|
||||
<tr><td><input type="checkbox" name="remember-me"></td><td>Don't ask for my password for two weeks</td></tr>
|
||||
|
||||
<tr><td colspan='2'><input name="submit" type="submit"></td></tr>
|
||||
<tr><td colspan='2'><input name="reset" type="reset"></td></tr>
|
||||
</table>
|
||||
<input type="hidden" name="<c:out value="${_csrf.parameterName}"/>" value="<c:out value="${_csrf.token}"/>"/>
|
||||
</form>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
40
samples/xml/contacts/src/main/webapp/secure/debug.jsp
Normal file
40
samples/xml/contacts/src/main/webapp/secure/debug.jsp
Normal file
@@ -0,0 +1,40 @@
|
||||
<%@ page import="org.springframework.security.core.context.SecurityContextHolder" %>
|
||||
<%@ page import="org.springframework.security.core.Authentication" %>
|
||||
<%@ page import="org.springframework.security.core.GrantedAuthority" %>
|
||||
|
||||
<html>
|
||||
<head>
|
||||
<title>Security Debug Information</title>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
<h3>Security Debug Information</h3>
|
||||
|
||||
<%
|
||||
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
|
||||
if (auth != null) { %>
|
||||
<p>
|
||||
Authentication object is of type: <em><%= auth.getClass().getName() %></em>
|
||||
</p>
|
||||
<p>
|
||||
Authentication object as a String: <br/><br/><%= auth.toString() %>
|
||||
</p>
|
||||
|
||||
Authentication object holds the following granted authorities:<br /><br />
|
||||
<%
|
||||
for (GrantedAuthority authority : auth.getAuthorities()) { %>
|
||||
<%= authority %> (<em>getAuthority()</em>: <%= authority.getAuthority() %>)<br />
|
||||
<% }
|
||||
%>
|
||||
|
||||
<p><b>Success! Your web filters appear to be properly configured!</b></p>
|
||||
<%
|
||||
} else {
|
||||
%>
|
||||
Authentication object is null.<br />
|
||||
This is an error and your Spring Security application will not operate properly until corrected.<br /><br />
|
||||
<% }
|
||||
%>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
42
samples/xml/contacts/src/main/webapp/switchUser.jsp
Normal file
42
samples/xml/contacts/src/main/webapp/switchUser.jsp
Normal file
@@ -0,0 +1,42 @@
|
||||
<%@ taglib prefix='c' uri='http://java.sun.com/jstl/core' %>
|
||||
<%@ page import="org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter" %>
|
||||
<%@ page import="org.springframework.security.core.AuthenticationException" %>
|
||||
<%@ page pageEncoding="UTF-8" %>
|
||||
|
||||
<html>
|
||||
<head>
|
||||
<title>Switch User</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<h1>Switch to User</h1>
|
||||
|
||||
<h3>Valid users:</h3>
|
||||
|
||||
<p>username <b>rod</b>, password <b>koala</b></p>
|
||||
<p>username <b>dianne</b>, password <b>emu</b></p>
|
||||
<p>username <b>scott</b>, password <b>wombat</b></p>
|
||||
<p>username <b>bill</b>, password <b>wombat</b></p>
|
||||
<p>username <b>bob</b>, password <b>wombat</b></p>
|
||||
<p>username <b>jane</b>, password <b>wombat</b></p>
|
||||
<%-- this form-login-page form is also used as the
|
||||
form-error-page to ask for a login again.
|
||||
--%>
|
||||
<c:if test="${not empty param.login_error}">
|
||||
<p>
|
||||
<font color="red">
|
||||
Your 'su' attempt was not successful, try again.<br/>
|
||||
</font>
|
||||
</p>
|
||||
</c:if>
|
||||
|
||||
<form action="<c:url value='login/impersonate'/>" method="POST">
|
||||
<table>
|
||||
<tr><td>User:</td><td><input type='text' name='username'></td></tr>
|
||||
<tr><td colspan='2'><input name="switch" type="submit" value="Switch to User"></td></tr>
|
||||
</table>
|
||||
<input type="hidden" name="<c:out value="${_csrf.parameterName}"/>" value="<c:out value="${_csrf.token}"/>"/>
|
||||
</form>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user