Update to latest Asciidoctor version

We will temporarily remove PDF support until the plugin supports it.

docs/docs.gradle

@@ -12,7 +12,6 @@ project('manual') {
     ext.expandPlaceholders = ""
 
     asciidoctor {
-        backends = ["html5", "pdf"]
         options = [
           eruby: 'erubis',
           attributes: [
@@ -34,10 +33,8 @@ project('manual') {
 
     ext.spec = copySpec {
         into ('reference/htmlsingle') {
-            from("${asciidoctor.outputDir}/dist/html5")
-        }
-        into ('reference/pdf') {
-            from("${asciidoctor.outputDir}/dist/pdf")
+            from(asciidoctor.outputDir)
+            exclude 'build', 'Guardfile'
         }
     }
 }

docs/guides/build.gradle

@@ -3,7 +3,7 @@ import org.asciidoctor.gradle.*
 
 file("src/asciidoc").eachFileMatch(~/.*\.asc/) { file->
     task "asciidoctor-${file.name}"(type: AsciidoctorTask) {
-        sourceDocument = file
+        sourceDocumentName = file
         options = [
           eruby: 'erubis',
           eruby: 'erubis',

docs/guides/src/asciidoc/form.asc

@@ -2,11 +2,12 @@
 :author: Rob Winch
 :starter-appname: hellomvc-jc
 :completed-appname: form-jc
-:verify-starter-app-include: form-includes/verify-app.asc
+:include-dir: src/asciidoc/_hello-includes
+:verify-starter-app-include: ../_form-includes/verify-app.asc
 
 This guide builds off of link:hellomvc.html[Hello Spring MVC Security Java Config] to explain how to configure and use a custom login form with Spring Security Java Configuration.
 
-include::hello-includes/setting-up-the-sample.asc[]
+include::{include-dir}/setting-up-the-sample.asc[]
 
 = Overriding the default configure(HttpSecurity) method
 
@@ -201,13 +202,12 @@ Our existing configuration means that all we need to do is create a *login.jspx*
 
 <1> The URL we submit our username and password to is the same URL as our login form (i.e. */login*), but a *POST* instead of a *GET*.
 <2> When authentication fails, the browser is redirected to */login?error* so we can display an error message by detecting if the parameter *error* is non-null.
-
-IMPORTANT: Do not display details about why authentication failed. For example, we do not want to display that the user does not exist as this will tell an attacker that they should try a different username.
-
 <3> When we are successfully loged out, the browser is redirected to */login?logout* so we can display an logout success message by detecting if the parameter *logout* is non-null.
 <4> The username should be present on the HTTP parameter username
 <5> The password should be present on the HTTP parameter password
 
+IMPORTANT: Do not display details about why authentication failed. For example, we do not want to display that the user does not exist as this will tell an attacker that they should try a different username.
+
 TIP: We use Spring Web MVC's <form:form> tag to automatically add the CSRF token to our form. We could also manually add the CSRF token using `<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>`.
 
 Start up the server and try visiting http://localhost:8080/sample/ to see the updates to our configuration. We now see our login page, but it does not look very pretty. The issue is that we have not granted access to the css files.
@@ -245,7 +245,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
 ----
 
 <1> This allows anyone to access a URL that begins with */resources/*. Since this is where our css, javascript, and images are stored all our static resources are viewable by anyone.
-<2> As you might expect, `logout().permitAll()` allows any user to request logout and view logout success URL. 
+<2> As you might expect, `logout().permitAll()` allows any user to request logout and view logout success URL.
 
 
 Start up the server and try visiting http://localhost:8080/sample/ to see the updates to our configuration. We now see a custom login page that looks like the rest of our application.

docs/guides/src/asciidoc/hellomvc.asc

@@ -2,13 +2,14 @@
 :author: Rob Winch
 :starter-appname: insecuremvc
 :completed-appname: hellomvc-jc
-:verify-starter-app-include: hello-includes/verify-insecuremvc-app.asc
+:include-dir: src/asciidoc/_hello-includes
+:verify-starter-app-include: verify-insecuremvc-app.asc
 
 This guide provides instructions on how to add Spring Security to an existing Spring MVC application without the use of XML.
 
-include::hello-includes/setting-up-the-sample.asc[]
+include::{include-dir}/setting-up-the-sample.asc[]
 
-include::hello-includes/secure-the-application.asc[]
+include::{include-dir}/secure-the-application.asc[]
 
 === Registering Spring Security with the war
 
@@ -76,7 +77,7 @@ The `@ComponentScan` is loading all configuration in the org.springframework.sec
 
 NOTE: Had <<security-config-java,`SecurityConfig`>> not been loaded, we could have used an `@Import(SecurityConfig)` above the class definition of <<root-configuration-java,`RootConfiguration`>> or added <<security-config-java,`SecurityConfig`>> as one of the results for `getRootConfigClasses()`.
 
-include::hello-includes/exploring-the-secured-application.asc[]
+include::{include-dir}/exploring-the-secured-application.asc[]
 
 ==== Displaying the user name
 
@@ -138,7 +139,7 @@ In order to help protect against http://en.wikipedia.org/wiki/Cross-site_request
 
 Refresh the page at http://localhost:8080/sample/ and you will see the log out button. Click the button and see that the application logs you out successfully.
 
-include::hello-includes/basic-authentication.asc[]
+include::{include-dir}/basic-authentication.asc[]
 
 == Conclusion
 

docs/guides/src/asciidoc/helloworld.asc

@@ -2,13 +2,14 @@
 :author: Rob Winch
 :starter-appname: insecure
 :completed-appname: helloworld-jc
-:verify-starter-app-include: hello-includes/verify-insecure-app.asc
+:include-dir: src/asciidoc/_hello-includes
+:verify-starter-app-include: verify-insecure-app.asc
 
 This guide provides instructions on how to add Spring Security to an existing application without the use of XML.
 
-include::hello-includes/setting-up-the-sample.asc[]
+include::{include-dir}/setting-up-the-sample.asc[]
 
-include::hello-includes/secure-the-application.asc[]
+include::{include-dir}/secure-the-application.asc[]
 
 === Registering Spring Security with the war
 
@@ -44,7 +45,7 @@ The `SecurityWebApplicationInitializer` will do the following things:
 
 NOTE: Since we were not already using Spring, this is a simple way to add our <<security-config-java,`SecurityConfig`>>. If we were already using Spring, then we should add our <<security-config-java,`SecurityConfig`>> with the reset of our Spring configuration (i.e. a subclass of AbstractContextLoaderInitializer or AbstractDispatcherServletInitializer) and use the default constructor instead.
 
-include::hello-includes/exploring-the-secured-application.asc[]
+include::{include-dir}/exploring-the-secured-application.asc[]
 
 ==== Displaying the user name
 
@@ -96,7 +97,7 @@ In order to help protect against http://en.wikipedia.org/wiki/Cross-site_request
 
 Refresh the page at http://localhost:8080/sample/ and you will see the log out button. Click the logout button and see that the application logs you out successfully.
 
-include::hello-includes/basic-authentication.asc[]
+include::{include-dir}/basic-authentication.asc[]
 
 == Conclusion