From e79d45485b2f6d222b1a753f242b8a4a6edf7e33 Mon Sep 17 00:00:00 2001
From: Rossen Stoyanchev <rstoyanchev@pivotal.io>
Date: Thu, 4 Jun 2015 16:37:34 -0400
Subject: [PATCH] Upgrade to Spring Security 4 via SWF 2.4.2 snapshots

---
 booking-faces/pom.xml                         |  6 ++---
 booking-mvc/pom.xml                           | 16 ++++++------
 .../booking/config/SecurityConfig.java        |  4 +--
 .../samples/booking/config/WebMvcConfig.java  |  2 +-
 .../src/main/webapp/WEB-INF/login.html        | 11 ++------
 booking-portlet-faces/pom.xml                 |  4 +--
 booking-portlet-mvc/pom.xml                   |  4 +--
 primefaces-showcase/pom.xml                   | 16 +++++++++---
 .../src/main/resources/log4j.xml              | 26 ++++---------------
 .../WEB-INF/spring/appServlet/controllers.xml |  6 ++---
 .../spring/appServlet/servlet-context.xml     |  8 +++---
 .../WEB-INF/spring/appServlet/webflow.xml     |  6 ++---
 .../webapp/WEB-INF/spring/root-context.xml    |  2 +-
 .../webapp/WEB-INF/spring/security-config.xml |  7 ++---
 .../src/main/webapp/WEB-INF/views/login.xhtml | 10 +++----
 webflow-showcase/pom.xml                      |  6 ++---
 16 files changed, 59 insertions(+), 75 deletions(-)

diff --git a/booking-faces/pom.xml b/booking-faces/pom.xml
index 6de1d9d..640d0b1 100644
--- a/booking-faces/pom.xml
+++ b/booking-faces/pom.xml
@@ -9,9 +9,9 @@
 	<version>1.0.0.BUILD-SNAPSHOT</version>
 
 	<properties>
-		<webflow-version>2.4.0.RELEASE</webflow-version>
-		<spring-framework-version>4.0.5.RELEASE</spring-framework-version>
-		<springsecurity-version>3.2.4.RELEASE</springsecurity-version>
+		<webflow-version>2.4.2.BUILD-SNAPSHOT</webflow-version>
+		<spring-framework-version>4.1.6.RELEASE</spring-framework-version>
+		<springsecurity-version>4.0.1.RELEASE</springsecurity-version>
 		<slf4j-version>1.6.1</slf4j-version>
 		<mojarra-version>2.2.5</mojarra-version>
 		<primefaces-version>5.0</primefaces-version>
diff --git a/booking-mvc/pom.xml b/booking-mvc/pom.xml
index 05e4380..c65bae1 100644
--- a/booking-mvc/pom.xml
+++ b/booking-mvc/pom.xml
@@ -9,13 +9,13 @@
   <version>1.0.0.BUILD-SNAPSHOT</version>
 
 	<properties>
-		<webflow-version>2.4.0.RELEASE</webflow-version>
-		<spring-framework-version>4.0.5.RELEASE</spring-framework-version>
-		<springsecurity-version>3.2.4.RELEASE</springsecurity-version>
+		<webflow-version>2.4.2.BUILD-SNAPSHOT</webflow-version>
+		<spring-framework-version>4.1.6.RELEASE</spring-framework-version>
+		<springsecurity-version>4.0.1.RELEASE</springsecurity-version>
 		<slf4j-version>1.7.5</slf4j-version>
 		<thymeleaf-version>2.1.3.RELEASE</thymeleaf-version>
 		<thymeleaf-extras-tiles2-version>2.1.1.RELEASE</thymeleaf-extras-tiles2-version>
-		<thymeleaf-extras-springsecurity3-version>2.1.1.RELEASE</thymeleaf-extras-springsecurity3-version>
+		<thymeleaf-extras-springsecurity4-version>2.1.2.RELEASE</thymeleaf-extras-springsecurity4-version>
 		<thymeleaf-extras-conditionalcomments-version>2.1.1.RELEASE</thymeleaf-extras-conditionalcomments-version>
 		<tiles-version>2.2.2</tiles-version>
 	</properties>
@@ -24,7 +24,7 @@
 		<repository>
 			<id>spring</id>
 			<name>Spring Repository</name>
-			<url>http://repo.spring.io/milestone</url>
+			<url>http://repo.spring.io/snapshot</url>
 			<releases><enabled>true</enabled></releases>
 			<snapshots><enabled>true</enabled></snapshots>
 		</repository>
@@ -62,8 +62,8 @@
 		</dependency>
 		<dependency>
 			<groupId>org.thymeleaf.extras</groupId>
-			<artifactId>thymeleaf-extras-springsecurity3</artifactId>
-			<version>${thymeleaf-extras-springsecurity3-version}</version>
+			<artifactId>thymeleaf-extras-springsecurity4</artifactId>
+			<version>${thymeleaf-extras-springsecurity4-version}</version>
 		</dependency>
 		<dependency>
 			<groupId>org.thymeleaf.extras</groupId>
@@ -303,7 +303,7 @@
 			<plugin>
 				<groupId>org.apache.tomcat.maven</groupId>
 				<artifactId>tomcat7-maven-plugin</artifactId>
-				<version>2.1</version>
+				<version>2.2</version>
 			</plugin>
 			<plugin>
 				<groupId>org.eclipse.jetty</groupId>
diff --git a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
index c05e755..a359a85 100644
--- a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
+++ b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
@@ -4,11 +4,11 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.encoding.Md5PasswordEncoder;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
 
 @Configuration
-@EnableWebMvcSecurity
+@EnableWebSecurity
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
 	@Override
diff --git a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
index 9977aed..38cf3e4 100644
--- a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
+++ b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
@@ -16,7 +16,7 @@ import org.springframework.webflow.mvc.servlet.FlowHandlerMapping;
 import org.springframework.webflow.samples.booking.BookingFlowHandler;
 import org.thymeleaf.dialect.IDialect;
 import org.thymeleaf.extras.conditionalcomments.dialect.ConditionalCommentsDialect;
-import org.thymeleaf.extras.springsecurity3.dialect.SpringSecurityDialect;
+import org.thymeleaf.extras.springsecurity4.dialect.SpringSecurityDialect;
 import org.thymeleaf.extras.tiles2.dialect.TilesDialect;
 import org.thymeleaf.extras.tiles2.spring4.web.configurer.ThymeleafTilesConfigurer;
 import org.thymeleaf.extras.tiles2.spring4.web.view.FlowAjaxThymeleafTilesView;
diff --git a/booking-mvc/src/main/webapp/WEB-INF/login.html b/booking-mvc/src/main/webapp/WEB-INF/login.html
index 4d85943..d67df11 100644
--- a/booking-mvc/src/main/webapp/WEB-INF/login.html
+++ b/booking-mvc/src/main/webapp/WEB-INF/login.html
@@ -58,16 +58,10 @@
     </ul>
 </div>
 
-<div class="span-10 append-2 last" 
-     xmlns:th="http://www.thymeleaf.org"
-     th:with="lastUsernameKey=${T(org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter).SPRING_SECURITY_LAST_USERNAME_KEY},
-              lastExceptionKey=${T(org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter).SPRING_SECURITY_LAST_EXCEPTION_KEY}">
+<div class="span-10 append-2 last" xmlns:th="http://www.thymeleaf.org">
 
     <div class="error" th:if="${param.login_error}">
         Your login attempt was not successful, try again.<br /><br />
-        <span th:if="${session} and ${session[__${lastExceptionKey}__]}">
-            Reason: <span th:text="${session[__${lastExceptionKey}__].message}">Invalid password</span>
-        </span> 
     </div>
     
     <form name="f" action="#" th:action="@{/loginProcess}" method="post">
@@ -79,8 +73,7 @@
             <p>
                 <label for="username">User:</label>
                 <br />
-                <input type="text" name="username" id="username"
-                       th:value="(${param.login_error} and ${session}) ? ${session[__${lastUsernameKey}__]} : ''" />
+                <input type="text" name="username" id="username" />
             </p>
             
             <script type="text/javascript">
diff --git a/booking-portlet-faces/pom.xml b/booking-portlet-faces/pom.xml
index 464186b..306f4ba 100644
--- a/booking-portlet-faces/pom.xml
+++ b/booking-portlet-faces/pom.xml
@@ -9,8 +9,8 @@
 	<version>1.0.0.BUILD-SNAPSHOT</version>
 
 	<properties>
-		<springwebflow-version>2.4.0.RELEASE</springwebflow-version>
-		<spring-framework-version>4.0.5.RELEASE</spring-framework-version>
+		<springwebflow-version>2.4.2.BUILD-SNAPSHOT</springwebflow-version>
+		<spring-framework-version>4.1.6.RELEASE</spring-framework-version>
 		<slf4j-version>1.7.5</slf4j-version>
 		<mojarra-version>2.2.6</mojarra-version>
 	</properties>
diff --git a/booking-portlet-mvc/pom.xml b/booking-portlet-mvc/pom.xml
index 41abe7e..10d1199 100644
--- a/booking-portlet-mvc/pom.xml
+++ b/booking-portlet-mvc/pom.xml
@@ -9,8 +9,8 @@
 	<version>1.0.0.BUILD-SNAPSHOT</version>
 
 	<properties>
-		<springwebflow-version>2.4.0.RELEASE</springwebflow-version>
-		<spring-framework-version>4.0.5.RELEASE</spring-framework-version>
+		<springwebflow-version>2.4.2.BUILD-SNAPSHOT</springwebflow-version>
+		<spring-framework-version>4.1.6.RELEASE</spring-framework-version>
 		<slf4j-version>1.7.5</slf4j-version>
 	</properties>
 
diff --git a/primefaces-showcase/pom.xml b/primefaces-showcase/pom.xml
index ef0acdf..b56cb7d 100644
--- a/primefaces-showcase/pom.xml
+++ b/primefaces-showcase/pom.xml
@@ -10,8 +10,8 @@
 
 	<properties>
 		<java-version>1.6</java-version>
-		<springwebflow-version>2.4.0.RELEASE</springwebflow-version>
-		<springsecurity-version>3.2.4.RELEASE</springsecurity-version>
+		<springwebflow-version>2.4.2.BUILD-SNAPSHOT</springwebflow-version>
+		<springsecurity-version>4.0.1.RELEASE</springsecurity-version>
 		<primefaces-version>4.0</primefaces-version>
 		<org.slf4j-version>1.7.5</org.slf4j-version>
 	</properties>
@@ -21,7 +21,7 @@
 			<dependency>
 				<groupId>org.springframework</groupId>
 				<artifactId>spring-framework-bom</artifactId>
-				<version>4.0.5.RELEASE</version>
+				<version>4.1.6.RELEASE</version>
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
@@ -220,6 +220,16 @@
 					<target>${java-version}</target>
 				</configuration>
 			</plugin>
+			<plugin>
+				<groupId>org.apache.tomcat.maven</groupId>
+				<artifactId>tomcat7-maven-plugin</artifactId>
+				<version>2.2</version>
+			</plugin>
+			<plugin>
+				<groupId>org.eclipse.jetty</groupId>
+				<artifactId>jetty-maven-plugin</artifactId>
+				<version>9.0.0.v20130308</version>
+			</plugin>
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-eclipse-plugin</artifactId>
diff --git a/primefaces-showcase/src/main/resources/log4j.xml b/primefaces-showcase/src/main/resources/log4j.xml
index 7c0fb13..ae5b806 100644
--- a/primefaces-showcase/src/main/resources/log4j.xml
+++ b/primefaces-showcase/src/main/resources/log4j.xml
@@ -2,7 +2,6 @@
 <!DOCTYPE log4j:configuration PUBLIC "-//APACHE//DTD LOG4J 1.2//EN" "log4j.dtd">
 <log4j:configuration xmlns:log4j="http://jakarta.apache.org/log4j/">
 
-	<!-- Appenders -->
 	<appender name="console" class="org.apache.log4j.ConsoleAppender">
 		<param name="Target" value="System.out" />
 		<layout class="org.apache.log4j.PatternLayout">
@@ -10,30 +9,12 @@
 		</layout>
 	</appender>
 	
-	<!-- Application Loggers -->
 	<logger name="org.springframework.samples.webflow">
 		<level value="debug" />
 	</logger>
 	
-	<!-- 3rdparty Loggers -->
-	<logger name="org.springframework.core">
-		<level value="info" />
-	</logger>	
-	
-	<logger name="org.springframework.beans">
-		<level value="info" />
-	</logger>
-	
-	<logger name="org.springframework.context">
-		<level value="info" />
-	</logger>
-
-	<logger name="org.springframework.http">
-		<level value="info" />
-	</logger>
-
 	<logger name="org.springframework.web">
-		<level value="debug" />
+		<level value="info" />
 	</logger>
 
 	<logger name="org.springframework.binding">
@@ -44,11 +25,14 @@
 		<level value="debug" />
 	</logger>
 
+	<logger name="org.springframework.security">
+		<level value="debug" />
+	</logger>
+
 	<logger name="org.primefaces">
 		<level value="debug" />
 	</logger>
 
-	<!-- Root Logger -->
 	<root>
 		<priority value="info" />
 		<appender-ref ref="console" />
diff --git a/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/controllers.xml b/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/controllers.xml
index e43d8fe..9af5142 100644
--- a/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/controllers.xml
+++ b/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/controllers.xml
@@ -3,9 +3,9 @@
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 	xmlns:mvc="http://www.springframework.org/schema/mvc"
 	xmlns:context="http://www.springframework.org/schema/context"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
-		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
-		http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd">
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+		http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd">
 
 	<!-- 
 		URL mappings for views without controller logic.
diff --git a/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/servlet-context.xml b/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/servlet-context.xml
index 74a9275..a169b78 100644
--- a/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/servlet-context.xml
+++ b/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/servlet-context.xml
@@ -4,10 +4,10 @@
 	xmlns:mvc="http://www.springframework.org/schema/mvc"
 	xmlns:faces="http://www.springframework.org/schema/faces"
 	xmlns:context="http://www.springframework.org/schema/context"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
-		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
-		http://www.springframework.org/schema/faces http://www.springframework.org/schema/faces/spring-faces-2.4.xsd
-		http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd">
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+		http://www.springframework.org/schema/faces http://www.springframework.org/schema/faces/spring-faces.xsd
+		http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd">
 
 	<!--
 		DispatcherServlet Context: defines this servlet's request-processing infrastructure
diff --git a/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/webflow.xml b/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/webflow.xml
index e68958e..6d71268 100644
--- a/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/webflow.xml
+++ b/primefaces-showcase/src/main/webapp/WEB-INF/spring/appServlet/webflow.xml
@@ -3,9 +3,9 @@
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 	xmlns:beans="http://www.springframework.org/schema/beans"
 	xmlns:faces="http://www.springframework.org/schema/faces"
-	xsi:schemaLocation="http://www.springframework.org/schema/webflow-config http://www.springframework.org/schema/webflow-config/spring-webflow-config-2.4.xsd
-		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
-		http://www.springframework.org/schema/faces http://www.springframework.org/schema/faces/spring-faces-2.4.xsd">
+	xsi:schemaLocation="http://www.springframework.org/schema/webflow-config http://www.springframework.org/schema/webflow-config/spring-webflow-config.xsd
+		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+		http://www.springframework.org/schema/faces http://www.springframework.org/schema/faces/spring-faces.xsd">
 
 	<!-- Executes flows: the central entry point into the Spring Web Flow system -->
 	<flow-executor id="flowExecutor">
diff --git a/primefaces-showcase/src/main/webapp/WEB-INF/spring/root-context.xml b/primefaces-showcase/src/main/webapp/WEB-INF/spring/root-context.xml
index e33465c..486e22d 100644
--- a/primefaces-showcase/src/main/webapp/WEB-INF/spring/root-context.xml
+++ b/primefaces-showcase/src/main/webapp/WEB-INF/spring/root-context.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd">
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
 	
 	<!-- Root Context: defines shared resources visible to all other web components -->
 	<import resource="security-config.xml"/>
diff --git a/primefaces-showcase/src/main/webapp/WEB-INF/spring/security-config.xml b/primefaces-showcase/src/main/webapp/WEB-INF/spring/security-config.xml
index dad988f..3048456 100644
--- a/primefaces-showcase/src/main/webapp/WEB-INF/spring/security-config.xml
+++ b/primefaces-showcase/src/main/webapp/WEB-INF/spring/security-config.xml
@@ -4,19 +4,20 @@
        xmlns:security="http://www.springframework.org/schema/security"
        xsi:schemaLocation="
            http://www.springframework.org/schema/beans
-           http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
+           http://www.springframework.org/schema/beans/spring-beans.xsd
            http://www.springframework.org/schema/security
-           http://www.springframework.org/schema/security/spring-security-3.2.xsd">
+           http://www.springframework.org/schema/security/spring-security.xsd">
 
 	<!-- 
 		Configure Spring Security 
 	-->
 	<security:http auto-config="true" use-expressions="true">
-		<security:form-login login-page="/app/login" login-processing-url="/app/j_spring_security_check" 
+		<security:form-login login-page="/app/login" login-processing-url="/app/loginProcess"
 			default-target-url="/app/home" authentication-failure-url="/app/login?login_error=1" />
 		<security:logout logout-url="/app/logout" logout-success-url="/app/home" />
 		<security:intercept-url pattern="/secured/appleUser" method="POST" access="hasRole('ROLE_APPLE_USER')" />
 		<security:intercept-url pattern="/secured/androidUser" method="POST" access="hasRole('ROLE_ANDROID_USER')" />
+		<security:csrf disabled="true" />
 	</security:http>
 
 	<!--
diff --git a/primefaces-showcase/src/main/webapp/WEB-INF/views/login.xhtml b/primefaces-showcase/src/main/webapp/WEB-INF/views/login.xhtml
index 8657782..bbf2e6a 100755
--- a/primefaces-showcase/src/main/webapp/WEB-INF/views/login.xhtml
+++ b/primefaces-showcase/src/main/webapp/WEB-INF/views/login.xhtml
@@ -22,23 +22,19 @@
 	<c:if test="${not empty param.login_error}">
 		<div class="error">
 			Your login attempt was not successful, try again.<br />
-			Reason: #{sessionScope.SPRING_SECURITY_LAST_EXCEPTION.message}
 		</div>
 	</c:if>
 	<p:panel header="Login Information">
-		<form name="f" action="${request.contextPath}/app/j_spring_security_check" method="post">
+		<form name="f" action="${request.contextPath}/app/loginProcess" method="post">
 			<p>
 				User:
 				<br />
-				<c:if test="${not empty param.login_error}">
-					<c:set var="username" value="${sessionScope.SPRING_SECURITY_LAST_USERNAME}"/>
-				</c:if>
-				<input type="text" name="j_username" value="#{username}"/>
+				<input type="text" name="username" />
 			</p>
 			<p>
 				Password:
 				<br />
-				<input type="password" name="j_password" />				
+				<input type="password" name="password" />
 			</p>
 			<p>
 				<input type="checkbox" name="_spring_security_remember_me"/> 
diff --git a/webflow-showcase/pom.xml b/webflow-showcase/pom.xml
index cc15eaf..4f6b607 100644
--- a/webflow-showcase/pom.xml
+++ b/webflow-showcase/pom.xml
@@ -10,8 +10,8 @@
 
 	<properties>
 		<java-version>1.6</java-version>
-		<springwebflow-version>2.4.0.RELEASE</springwebflow-version>
-		<springsecurity-version>3.2.4.RELEASE</springsecurity-version>
+		<springwebflow-version>2.4.2.BUILD-SNAPSHOT</springwebflow-version>
+		<springsecurity-version>4.0.1.RELEASE</springsecurity-version>
 		<org.slf4j-version>1.7.5</org.slf4j-version>
 	</properties>
 
@@ -20,7 +20,7 @@
 			<dependency>
 				<groupId>org.springframework</groupId>
 				<artifactId>spring-framework-bom</artifactId>
-				<version>4.0.5.RELEASE</version>
+				<version>4.1.6.RELEASE</version>
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>