From 13ec6048428cc64664df73317c96095a8c7f99d5 Mon Sep 17 00:00:00 2001
From: Rossen Stoyanchev <rstoyanchev@pivotal.io>
Date: Thu, 8 Feb 2018 12:49:04 -0500
Subject: [PATCH] Re-enable csrf in booking-faces

---
 .../webflow/samples/booking/config/SecurityConfig.java      | 5 -----
 .../webapp/WEB-INF/flows/booking/enterBookingDetails.xhtml  | 3 +++
 .../main/webapp/WEB-INF/flows/booking/reviewBooking.xhtml   | 3 +++
 .../webapp/WEB-INF/flows/main/enterSearchCriteria.xhtml     | 4 +++-
 .../src/main/webapp/WEB-INF/flows/main/reviewHotel.xhtml    | 3 +++
 .../src/main/webapp/WEB-INF/flows/main/reviewHotels.xhtml   | 1 +
 .../src/main/webapp/WEB-INF/layouts/standard.xhtml          | 6 +++++-
 booking-faces/src/main/webapp/WEB-INF/login.xhtml           | 3 +++
 8 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
index 8898767..dcd8d3c 100644
--- a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
@@ -26,11 +26,6 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
 				.logoutUrl("/spring/logout")
 				.logoutSuccessUrl("/spring/logoutSuccess")
 				.and()
-
-			// Disable CSRF (won't work with JSF) but ensure last HTTP POST request is saved
-			// See https://jira.springsource.org/browse/SEC-2498
-
-			.csrf().disable()
 			.requestCache()
 				.requestCache(new HttpSessionRequestCache());
 
diff --git a/booking-faces/src/main/webapp/WEB-INF/flows/booking/enterBookingDetails.xhtml b/booking-faces/src/main/webapp/WEB-INF/flows/booking/enterBookingDetails.xhtml
index 33fe411..7959f66 100644
--- a/booking-faces/src/main/webapp/WEB-INF/flows/booking/enterBookingDetails.xhtml
+++ b/booking-faces/src/main/webapp/WEB-INF/flows/booking/enterBookingDetails.xhtml
@@ -129,6 +129,9 @@
 					</p>
 				</div>
 			</div>
+			<div>
+				<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
+			</div>
 			<div>
 				<p:commandButton id="proceed" action="proceed" value="Proceed" update="@form" />
 				<p:commandButton id="cancel" value="Cancel" action="cancel" immediate="true" />
diff --git a/booking-faces/src/main/webapp/WEB-INF/flows/booking/reviewBooking.xhtml b/booking-faces/src/main/webapp/WEB-INF/flows/booking/reviewBooking.xhtml
index 1f15098..320fd55 100755
--- a/booking-faces/src/main/webapp/WEB-INF/flows/booking/reviewBooking.xhtml
+++ b/booking-faces/src/main/webapp/WEB-INF/flows/booking/reviewBooking.xhtml
@@ -71,6 +71,9 @@
 						</p>
 					</div>
 				</div>
+				<div>
+					<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
+				</div>
 				<div>
 					<p:commandButton id="confirm" value="Confirm" action="confirm"/>&#160;
 		    		<p:commandButton id="revise" value="Revise" action="revise"/>&#160;
diff --git a/booking-faces/src/main/webapp/WEB-INF/flows/main/enterSearchCriteria.xhtml b/booking-faces/src/main/webapp/WEB-INF/flows/main/enterSearchCriteria.xhtml
index 1d8e38b..2420282 100644
--- a/booking-faces/src/main/webapp/WEB-INF/flows/main/enterSearchCriteria.xhtml
+++ b/booking-faces/src/main/webapp/WEB-INF/flows/main/enterSearchCriteria.xhtml
@@ -31,7 +31,8 @@
 			</h:panelGrid>
 			<p:tooltip for="searchString" targetPosition="topRight" position="bottomLeft"
 				value="Search hotels by name, address, city, or zip." style="cream" />
-		</h:form>			  
+			<div><input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/></div>
+		</h:form>
 	</p:panel>
 
 	<p:panel id="bookings" header="Your Hotel Bookings" rendered="#{currentUser!=null}" toggleable="true" toggleSpeed="100" style="margin-top: 10px">
@@ -67,6 +68,7 @@
 					</p:column>
 				</p:dataTable>
 			</p:outputPanel>
+			<div><input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/></div>
 		</h:form>			  
 	</p:panel>				  
 
diff --git a/booking-faces/src/main/webapp/WEB-INF/flows/main/reviewHotel.xhtml b/booking-faces/src/main/webapp/WEB-INF/flows/main/reviewHotel.xhtml
index cbe13aa..3ac9936 100644
--- a/booking-faces/src/main/webapp/WEB-INF/flows/main/reviewHotel.xhtml
+++ b/booking-faces/src/main/webapp/WEB-INF/flows/main/reviewHotel.xhtml
@@ -34,6 +34,9 @@
                 <f:convertNumber type="currency" currencySymbol="$"/>
             </h:outputText>
 	    </div>
+		<div>
+			<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
+		</div>
 		<div>
 			<p:commandButton id="book" action="book" value="Book Hotel" ajax="false" />
 			<p:commandButton id="cancel" action="cancel" value="Back to Search"/>
diff --git a/booking-faces/src/main/webapp/WEB-INF/flows/main/reviewHotels.xhtml b/booking-faces/src/main/webapp/WEB-INF/flows/main/reviewHotels.xhtml
index 46dc743..b2290b4 100644
--- a/booking-faces/src/main/webapp/WEB-INF/flows/main/reviewHotels.xhtml
+++ b/booking-faces/src/main/webapp/WEB-INF/flows/main/reviewHotels.xhtml
@@ -47,6 +47,7 @@
 			</p:commandButton>
 		</p:column>
 	</p:dataTable>
+	<div><input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/></div>
 </h:form>
 </ui:define>
 </ui:composition>
\ No newline at end of file
diff --git a/booking-faces/src/main/webapp/WEB-INF/layouts/standard.xhtml b/booking-faces/src/main/webapp/WEB-INF/layouts/standard.xhtml
index bb14d6b..a54ca0d 100644
--- a/booking-faces/src/main/webapp/WEB-INF/layouts/standard.xhtml
+++ b/booking-faces/src/main/webapp/WEB-INF/layouts/standard.xhtml
@@ -31,7 +31,11 @@
 	<div>
 		<h4 class="alt bottom">
 			<c:if test="${not empty currentUser.name}">
-		    	Welcome, ${currentUser.name} | <a href="${request.contextPath}/spring/logout">Logout</a>
+				<form name="f" action="${request.contextPath}/spring/logout" method="post">
+					<div><input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/></div>
+					Welcome, ${currentUser.name}
+					<input name="submit" type="submit" value="Logout" />
+				</form>
 			</c:if>
 			<c:if test="${empty currentUser.name}">
 				<a href="${request.contextPath}/spring/login">Login</a>
diff --git a/booking-faces/src/main/webapp/WEB-INF/login.xhtml b/booking-faces/src/main/webapp/WEB-INF/login.xhtml
index e48cc16..8c2619c 100755
--- a/booking-faces/src/main/webapp/WEB-INF/login.xhtml
+++ b/booking-faces/src/main/webapp/WEB-INF/login.xhtml
@@ -48,6 +48,9 @@
 					<input type="checkbox" name="_spring_security_remember_me"/> 
 					Don't ask for my password for two weeks:
 				</p>
+				<div>
+					<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
+				</div>
 				<p>
 					<input name="submit" type="submit" value="Login" />
 				</p>