Index: lams_build/build.xml
===================================================================
diff -u -r24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4 -r3cdcc421a982fe488cd3c991e2a9d4f3af0ae778
--- lams_build/build.xml	(.../build.xml)	(revision 24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4)
+++ lams_build/build.xml	(.../build.xml)	(revision 3cdcc421a982fe488cd3c991e2a9d4f3af0ae778)
@@ -418,6 +418,14 @@
 		<copy tofile="${server.home}/modules/system/layers/base/org/apache/batik/main/module.xml"
 			file="lib/batik/batik.module.xml" overwrite="true" verbose="true" />
 		
+		<copy todir="${server.home}/modules/system/layers/base/org/owasp/csrfguard/main" overwrite="true" verbose="true">
+			<fileset dir="lib/csrfguard">
+				<include name="csrfguard-*.jar" />
+			</fileset>
+		</copy>
+		<copy tofile="${server.home}/modules/system/layers/base/org/owasp/csrfguard/main/module.xml"
+			file="lib/csrfguard/csrf.module.xml" overwrite="true" verbose="true" />
+		
 		<copy todir="${server.home}/modules/system/layers/base/org/imsglobal/main" overwrite="true" verbose="true">
 			<fileset dir="lib/basiclti-util">
 				<include name="basiclti-util-*.jar" />
Index: lams_build/build_base.xml
===================================================================
diff -u -r24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4 -r3cdcc421a982fe488cd3c991e2a9d4f3af0ae778
--- lams_build/build_base.xml	(.../build_base.xml)	(revision 24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4)
+++ lams_build/build_base.xml	(.../build_base.xml)	(revision 3cdcc421a982fe488cd3c991e2a9d4f3af0ae778)
@@ -366,6 +366,13 @@
 				<include name="**/*"/>
 			</fileset>
 	 	</copy>
+		
+		<echo>${ant.project.name}: Copying additional property files</echo>
+	 	<copy todir="${basedir}/build/war/WEB-INF" flatten="true" verbose="true">
+			<fileset dir="${basedir}/conf/security" erroronmissingdir="false">
+				<include name="*.properties"/>
+			</fileset>
+	 	</copy>
 	</target>
 	
 	<target name="_copy-deployment-handler">
Index: lams_build/conf/j2ee/jboss-deployment-structure.xml
===================================================================
diff -u -r24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4 -r3cdcc421a982fe488cd3c991e2a9d4f3af0ae778
--- lams_build/conf/j2ee/jboss-deployment-structure.xml	(.../jboss-deployment-structure.xml)	(revision 24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4)
+++ lams_build/conf/j2ee/jboss-deployment-structure.xml	(.../jboss-deployment-structure.xml)	(revision 3cdcc421a982fe488cd3c991e2a9d4f3af0ae778)
@@ -51,6 +51,7 @@
       <module name="com.fasterxml.jackson.core.jackson-databind" export="true" />
       <module name="io.jsonwebtoken" export="true" />
       <module name="org.apache.batik" export="true" />
+      <module name="org.owasp.csrfguard" export="true" />
       
       <!-- Import META-INF/services for ServiceLoader impls as well
       <module name="myservicemodule" services="import"/>
Index: lams_build/lib/csrfguard/csrf.module.xml
===================================================================
diff -u
--- lams_build/lib/csrfguard/csrf.module.xml	(revision 0)
+++ lams_build/lib/csrfguard/csrf.module.xml	(revision 3cdcc421a982fe488cd3c991e2a9d4f3af0ae778)
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+  ~ JBoss, Home of Professional Open Source.
+  ~ Copyright 2010, Red Hat, Inc., and individual contributors
+  ~ as indicated by the @author tags. See the copyright.txt file in the
+  ~ distribution for a full listing of individual contributors.
+  ~
+  ~ This is free software; you can redistribute it and/or modify it
+  ~ under the terms of the GNU Lesser General Public License as
+  ~ published by the Free Software Foundation; either version 2.1 of
+  ~ the License, or (at your option) any later version.
+  ~
+  ~ This software is distributed in the hope that it will be useful,
+  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
+  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  ~ Lesser General Public License for more details.
+  ~
+  ~ You should have received a copy of the GNU Lesser General Public
+  ~ License along with this software; if not, write to the Free
+  ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+  ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+  -->
+
+<module xmlns="urn:jboss:module:1.5" name="org.owasp.csrfguard">
+  <resources>
+    <resource-root path="csrfguard-3.1.0-2019.12.19.jar"/>
+  </resources>
+  
+  <dependencies>
+  	<module name="javax.servlet.api" />
+  	<module name="javax.servlet.jsp.api" />
+  </dependencies>
+</module>
\ No newline at end of file
Index: lams_build/lib/csrfguard/csrfguard-3.1.0-2019.12.19.jar
===================================================================
diff -u
Binary files differ
Index: lams_central/build.xml
===================================================================
diff -u -r24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4 -r3cdcc421a982fe488cd3c991e2a9d4f3af0ae778
--- lams_central/build.xml	(.../build.xml)	(revision 24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4)
+++ lams_central/build.xml	(.../build.xml)	(revision 3cdcc421a982fe488cd3c991e2a9d4f3af0ae778)
@@ -32,6 +32,13 @@
 				<include name="**/*.ico"/>
 			</fileset>
 		</copy>
+		
+		<echo>${ant.project.name}: Copying additional property files</echo>
+	 	<copy todir="${basedir}/build/war/WEB-INF" flatten="true" verbose="true">
+			<fileset dir="${basedir}/conf/security" erroronmissingdir="false">
+				<include name="*.properties"/>
+			</fileset>
+	 	</copy>
 	</target>
 	
 	<target name="_copy-jsp" depends="sass.compile, _js-minify">
Index: lams_central/conf/security/Owasp.CsrfGuard.properties
===================================================================
diff -u
--- lams_central/conf/security/Owasp.CsrfGuard.properties	(revision 0)
+++ lams_central/conf/security/Owasp.CsrfGuard.properties	(revision 3cdcc421a982fe488cd3c991e2a9d4f3af0ae778)
@@ -0,0 +1,3 @@
+org.owasp.csrfguard.ProtectedMethods=POST
+org.owasp.csrfguard.action.Log=org.owasp.csrfguard.action.Log
+org.owasp.csrfguard.action.Log.Message=CSRF attack (user: %user%, ip: %remote_ip%, uri: %request_uri%, error: %exception_message%)
\ No newline at end of file
Index: lams_central/web/WEB-INF/tlds/security/csrfguard.tld
===================================================================
diff -u
--- lams_central/web/WEB-INF/tlds/security/csrfguard.tld	(revision 0)
+++ lams_central/web/WEB-INF/tlds/security/csrfguard.tld	(revision 3cdcc421a982fe488cd3c991e2a9d4f3af0ae778)
@@ -0,0 +1,70 @@
+<?xml version="1.0"?>
+<!--
+The OWASP CSRFGuard Project, BSD License
+Eric Sheridan (eric@infraredsecurity.com), Copyright (c) 2011 
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of OWASP nor the names of its contributors may be used
+   to endorse or promote products derived from this software without specific
+   prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ -->
+<taglib xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee/web-jsptaglibrary_2_0.xsd" version="2.0">
+	<tlib-version>1.2</tlib-version>
+	<jsp-version>2.0</jsp-version>
+	<short-name>Owasp CsrfGuard Tag Library</short-name>
+	<uri>http://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project/Owasp.CsrfGuard.tld</uri>
+	<tag>
+		<name>token</name>
+		<tag-class>org.owasp.csrfguard.tag.TokenTag</tag-class>
+		<body-content>empty</body-content>
+		<attribute>
+			<name>uri</name>
+			<required>false</required>
+			<rtexprvalue>true</rtexprvalue>
+		</attribute>
+	</tag>
+	<tag>
+		<name>tokenname</name>
+		<tag-class>org.owasp.csrfguard.tag.TokenNameTag</tag-class>
+		<body-content>empty</body-content>
+	</tag>
+	<tag>
+		<name>tokenvalue</name>
+		<tag-class>org.owasp.csrfguard.tag.TokenValueTag</tag-class>
+		<body-content>empty</body-content>
+		<attribute>
+			<name>uri</name>
+			<required>false</required>
+			<rtexprvalue>true</rtexprvalue>
+		</attribute>
+	</tag>
+	<tag>
+		<name>a</name>
+		<tag-class>org.owasp.csrfguard.tag.ATag</tag-class>
+		<dynamic-attributes>true</dynamic-attributes>
+	</tag>
+	<tag>
+		<name>form</name>
+		<tag-class>org.owasp.csrfguard.tag.FormTag</tag-class>
+		<dynamic-attributes>true</dynamic-attributes>
+	</tag>
+</taglib>
Index: lams_central/web/WEB-INF/web.xml
===================================================================
diff -u -r24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4 -r3cdcc421a982fe488cd3c991e2a9d4f3af0ae778
--- lams_central/web/WEB-INF/web.xml	(.../web.xml)	(revision 24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4)
+++ lams_central/web/WEB-INF/web.xml	(.../web.xml)	(revision 3cdcc421a982fe488cd3c991e2a9d4f3af0ae778)
@@ -41,6 +41,14 @@
 		<param-name>parentContextKey</param-name>
 		<param-value>context.central</param-value>
 	</context-param>
+	<context-param>
+        <param-name>Owasp.CsrfGuard.Config</param-name>
+        <param-value>WEB-INF/Owasp.CsrfGuard.properties</param-value>
+    </context-param>
+    <context-param>
+        <param-name>Owasp.CsrfGuard.Config.Print</param-name>
+        <param-value>true</param-value>
+    </context-param>
 
 	<filter>
 		<filter-name>UrlRewriteFilter</filter-name>
@@ -69,6 +77,10 @@
 			org.lamsfoundation.lams.web.filter.LocaleFilter
 		</filter-class>
 	</filter>
+	<filter>
+		<filter-name>CSRFGuard</filter-name>
+		<filter-class>org.owasp.csrfguard.CsrfGuardFilter</filter-class>
+	</filter>
 
 	<filter-mapping>
 		<filter-name>UrlRewriteFilter</filter-name>
@@ -147,7 +159,12 @@
 		<filter-name>LocaleFilter</filter-name>
 		<url-pattern>/ckeditor/*</url-pattern>
 	</filter-mapping>
-	
+	<filter-mapping>
+		<filter-name>CSRFGuard</filter-name> 
+		<url-pattern>/*</url-pattern>
+	</filter-mapping>
+
+
 	<listener>
 		<listener-class>
 			org.springframework.web.context.ContextLoaderListener
@@ -160,6 +177,13 @@
 		</listener-class>
 	</listener>
 
+	<listener>
+        <listener-class>org.owasp.csrfguard.CsrfGuardServletContextListener</listener-class>
+    </listener>
+     <listener>
+        <listener-class>org.owasp.csrfguard.CsrfGuardHttpSessionListener</listener-class>
+    </listener>
+
 	<servlet>
 		<servlet-name>GetRecordingServlet</servlet-name>
 		<servlet-class>org.lamsfoundation.lams.webservice.GetRecordingServlet
@@ -497,6 +521,9 @@
 		<url-pattern>/services/SPEnrolment</url-pattern>
 	</servlet-mapping>
 	
+
+	
+	
 	<mime-mapping>
 		<extension>csv</extension>
 		<mime-type>text/plain</mime-type>
@@ -560,6 +587,11 @@
 			<taglib-uri>tags-lams</taglib-uri>
 			<taglib-location>/WEB-INF/tlds/lams/lams.tld</taglib-location>
 		</taglib>
+		
+		<taglib>
+			<taglib-uri>csrfguard</taglib-uri>
+			<taglib-location>/WEB-INF/tlds/security/csrfguard.tld</taglib-location>
+		</taglib>
 
 	</jsp-config>
 
Index: lams_central/web/profile/editprofile.jsp
===================================================================
diff -u -r24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4 -r3cdcc421a982fe488cd3c991e2a9d4f3af0ae778
--- lams_central/web/profile/editprofile.jsp	(.../editprofile.jsp)	(revision 24f0886e73317ee6aa7b49eb70e3c2ad8c8f35f4)
+++ lams_central/web/profile/editprofile.jsp	(.../editprofile.jsp)	(revision 3cdcc421a982fe488cd3c991e2a9d4f3af0ae778)
@@ -1,7 +1,8 @@
 <!DOCTYPE html>
 
 <%@ page contentType="text/html; charset=utf-8" language="java"%>
-<%@ taglib uri="http://www.springframework.org/tags/form" prefix="form" %> 
+<%@ taglib uri="http://www.springframework.org/tags/form" prefix="form" %>
+<%@ taglib uri="csrfguard" prefix="csrf" %> 
 <%@ taglib uri="tags-core" prefix="c"%>
 <%@ taglib uri="tags-fmt" prefix="fmt"%>
 <%@ taglib uri="tags-lams" prefix="lams"%>
@@ -45,6 +46,7 @@
 
 <body>
 	<form:form action="/lams/saveprofile.do" modelAttribute='newForm' method="post" id='newForm'>
+	  	<input type="hidden" name="<csrf:tokenname/>" value="<csrf:tokenvalue/>"/>
 		<input type="hidden" name="editNameOnly" value="${editOnlyName}" />
 
 		<lams:errors path="*"/>