From 990c14a98183fa735a70ba46c94def897655bfe4 Mon Sep 17 00:00:00 2001
From: Keith Donald <kdonald@vmware.com>
Date: Thu, 5 Jun 2008 21:11:24 +0000
Subject: [PATCH] security update

---
 .../main/webapp/WEB-INF/config/security-config.xml    | 11 ++---------
 spring-webflow-samples/booking-mvc/ivy.xml            |  2 +-
 .../main/webapp/WEB-INF/config/security-config.xml    |  6 ------
 3 files changed, 3 insertions(+), 16 deletions(-)

diff --git a/spring-webflow-samples/booking-faces/src/main/webapp/WEB-INF/config/security-config.xml b/spring-webflow-samples/booking-faces/src/main/webapp/WEB-INF/config/security-config.xml
index 58b563da..b6680f84 100644
--- a/spring-webflow-samples/booking-faces/src/main/webapp/WEB-INF/config/security-config.xml
+++ b/spring-webflow-samples/booking-faces/src/main/webapp/WEB-INF/config/security-config.xml
@@ -9,15 +9,8 @@
            http://www.springframework.org/schema/security/spring-security-2.0.2.xsd">
 
 	<!-- Configure Spring Security -->
-	<security:http auto-config="true" >
-
-		<!-- Restrict URLs based on role -->
-		<security:intercept-url pattern="/spring/login*" access="ROLE_ANONYMOUS" />
-		<security:intercept-url pattern="/spring/logoutSuccess*" access="ROLE_ANONYMOUS" />
-		<security:intercept-url pattern="/spring/logout*" access="ROLE_USER" />
-		
-		<!-- Override default login and logout pages -->
-		<security:form-login login-page="/spring/login" login-processing-url="/spring/loginProcess" default-target-url="/spring/main" />        
+	<security:http auto-config="true">
+		<security:form-login login-page="/spring/login" login-processing-url="/spring/loginProcess" default-target-url="/spring/main" authentication-failure-url="/spring/login?login_error=1" />
 		<security:logout logout-url="/spring/logout" logout-success-url="/spring/logoutSuccess" />
 	</security:http>
     
diff --git a/spring-webflow-samples/booking-mvc/ivy.xml b/spring-webflow-samples/booking-mvc/ivy.xml
index a8cd37f5..5bf67b61 100755
--- a/spring-webflow-samples/booking-mvc/ivy.xml
+++ b/spring-webflow-samples/booking-mvc/ivy.xml
@@ -47,7 +47,7 @@
 		<dependency org="org.springframework" name="org.springframework.web" rev="2.5.4.A" conf="compile->compile"/>
 		<dependency org="org.springframework" name="org.springframework.web.servlet" rev="2.5.4.A" conf="compile->compile"/>
 		<dependency org="org.springframework.security" name="org.springframework.security" rev="2.0.2.A" conf="compile->compile"/>
-		<dependency org="org.springframework.security" name="org.springframework.security.taglibs" rev="2.0.0.A" conf="compile->compile"/>
+		<dependency org="org.springframework.security" name="org.springframework.security.taglibs" rev="2.0.2.A" conf="compile->compile"/>
  		<dependency org="org.springframework.webflow" name="org.springframework.js" rev="latest.integration" conf="compile->compile"/>
   		<dependency org="org.springframework.webflow" name="org.springframework.webflow" rev="latest.integration" conf="compile->compile"/>
 
diff --git a/spring-webflow-samples/booking-mvc/src/main/webapp/WEB-INF/config/security-config.xml b/spring-webflow-samples/booking-mvc/src/main/webapp/WEB-INF/config/security-config.xml
index bfb14e2d..e6b8c4f0 100644
--- a/spring-webflow-samples/booking-mvc/src/main/webapp/WEB-INF/config/security-config.xml
+++ b/spring-webflow-samples/booking-mvc/src/main/webapp/WEB-INF/config/security-config.xml
@@ -10,12 +10,6 @@
 
 	<!-- Configure Spring Security -->
 	<security:http auto-config="true">
-		<!-- Restrict URLs based on role -->
-		<security:intercept-url pattern="/spring/login*" access="ROLE_ANONYMOUS" />
-		<security:intercept-url pattern="/spring/logoutSuccess*" access="ROLE_ANONYMOUS" />
-		<security:intercept-url pattern="/spring/logout*" access="ROLE_USER" />
-		
-		<!-- Override default login and logout pages -->
 		<security:form-login login-page="/spring/login" login-processing-url="/spring/loginProcess" default-target-url="/spring/hotels/index" authentication-failure-url="/spring/login?login_error=1" />
 		<security:logout logout-url="/spring/logout" logout-success-url="/spring/logoutSuccess" />
 	</security:http>