Index: 3rdParty_sources/csrfguard/org/owasp/csrfguard/CsrfGuard.java =================================================================== diff -u -r0c1d8c6e66d5b95ff3487b8362c86f629c42d88b -r2ab1076d8852ca61f6e633ea31de878497c3023a --- 3rdParty_sources/csrfguard/org/owasp/csrfguard/CsrfGuard.java (.../CsrfGuard.java) (revision 0c1d8c6e66d5b95ff3487b8362c86f629c42d88b) +++ 3rdParty_sources/csrfguard/org/owasp/csrfguard/CsrfGuard.java (.../CsrfGuard.java) (revision 2ab1076d8852ca61f6e633ea31de878497c3023a) @@ -662,6 +662,9 @@ return false; } + // LAMS LDEV-4932 Replace multiple slashes with a single one, so it works the same as Spring MVC + uri = uri.replaceAll("/{2,}", "/"); + boolean retval = !isProtectEnabled(); for (String protectedPage : getProtectedPages()) { Index: 3rdParty_sources/versions.txt =================================================================== diff -u -r0c1d8c6e66d5b95ff3487b8362c86f629c42d88b -r2ab1076d8852ca61f6e633ea31de878497c3023a --- 3rdParty_sources/versions.txt (.../versions.txt) (revision 0c1d8c6e66d5b95ff3487b8362c86f629c42d88b) +++ 3rdParty_sources/versions.txt (.../versions.txt) (revision 2ab1076d8852ca61f6e633ea31de878497c3023a) @@ -25,7 +25,7 @@ Commons Validator 1.6 -CSRF Guard 3.1.0 manual build from master made on 2019-12-19 +CSRF Guard master from 2020.01.07 with a custom modification in CsrfGuard.java Hibernate Core 5.3.6 Index: lams_build/liblist.txt =================================================================== diff -u -rf2cb5a5f881181268a606f1d01eae343e18723d2 -r2ab1076d8852ca61f6e633ea31de878497c3023a --- lams_build/liblist.txt (.../liblist.txt) (revision f2cb5a5f881181268a606f1d01eae343e18723d2) +++ lams_build/liblist.txt (.../liblist.txt) (revision 2ab1076d8852ca61f6e633ea31de878497c3023a) @@ -18,6 +18,9 @@ batik batik-1.7.jar 1.7 Apache License 2.0 Apache toolkit for manipulating images in SVG format +csrfguard csrfguard-3.1.0-custom-2020.01.07.jar custom build BSD License OWASP prevents CSRF attacks + based on 3.1.0 master from 2020.01.07 with a custom modification in CsrfGuard.java + fckeditor fckeditor-java-core-2.6.jar 2.6 GPL, LGPL, MPL Frederico Caldeira Knabben Java connector for CKEditor googleauth googleauth-1.1.1.jar 1.1.1 Public Domain Enrico M. Crisostomo Java server library that implements the Time-based One-time Password (TOTP) algorithm