<commit_before><%@ taglib uri="/WEB-INF/jspwiki.tld" prefix="wiki" %>
<%@ page import="java.security.Principal" %>
<%@ page import="org.apache.log4j.*" %>
<%@ page import="com.ecyrd.jspwiki.*" %>
<%@ page import="com.ecyrd.jspwiki.auth.*" %>
<%@ page errorPage="/Error.jsp" %>
<%! 
  public void jspInit()
  {
    wiki = WikiEngine.getInstance( getServletConfig() );
  }
  Logger log = Logger.getLogger("JSPWiki"); 
  WikiEngine wiki;
  SecurityVerifier verifier;
%>
<%
  WikiContext wikiContext = wiki.createContext( request, WikiContext.NONE );
  if(!wikiContext.hasAccess( response )) return;
  response.setContentType("text/html; charset="+wiki.getContentEncoding() );
  verifier = new SecurityVerifier( wiki, wikiContext.getWikiSession() );
%>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
  <title>JSPWiki Security Configuration Verifier</title>
  <base href="../"/>
  <link rel="stylesheet" media="screen, projection" type="text/css" href="<wiki:Link format="url" templatefile="jspwiki.css"/>"/>
  <wiki:IncludeResources type="stylesheet"/>
</head>
<body class="view">
<div id="wikibody">
<div id="page">
<div id="pagecontent">

<h1>JSPWiki Security Configuration Verifier</h1>

<p>This page examines JSPWiki's security configuration and tries to determine if it is working the way it should. Although JSPWiki comes configured with some reasonable default configuration settings out of the box, it's not always obvious what settings to change if you need to customize the security... and sooner or later, just about everyone does.</p>

<p>This page is dynamically generated by JSPWiki. It examines the authentication, authorization and security policy settings. When we think something looks funny, we'll try to communicate what the issue might be, and will make recommendations on how to fix the problem.</p>

<p><strong>Please delete this JSP when you are finished troubleshooting your system. 
This diagnostic data presented on this page do not represent a security risk
to your system <em>per se</em>, but they do provide a significant amount of
contextual information that could be useful to an attacker. This page is
unconstrained, which means that anyone can view it: nice people, mean people
and everyone in between. You have been warned.</strong></p>

<!-- 
  *********************************************
  **** A U T H E N T I C A T I O N         ****
  *********************************************
-->
<h2>Authentication Configuration</h2>
<!-- 
  *********************************************
  **** Container Authentication Verifier   ****
  *********************************************
-->
<h3>Container-Managed Authentication</h3>
<%
  boolean isContainerAuth = wiki.getAuthenticationManager().isContainerAuthenticated();
  AuthorizationManager authorizationManager = wiki.getAuthorizationManager();
  if ( isContainerAuth )
  {
%><commit_msg>Added CSS to off-warning. Added instructions on how to turn it back off once it's enabled.<commit_after><%@ taglib uri="/WEB-INF/jspwiki.tld" prefix="wiki" %>
<%@ page import="java.security.Principal" %>
<%@ page import="org.apache.log4j.*" %>
<%@ page import="com.ecyrd.jspwiki.*" %>
<%@ page import="com.ecyrd.jspwiki.auth.*" %>
<%@ page errorPage="/Error.jsp" %>
<%! 
  public void jspInit()
  {
    wiki = WikiEngine.getInstance( getServletConfig() );
  }
  Logger log = Logger.getLogger("JSPWiki"); 
  WikiEngine wiki;
  SecurityVerifier verifier;
%>
<%
  WikiContext wikiContext = wiki.createContext( request, WikiContext.NONE );
  if(!wikiContext.hasAccess( response )) return;
  response.setContentType("text/html; charset="+wiki.getContentEncoding() );
  verifier = new SecurityVerifier( wiki, wikiContext.getWikiSession() );

  //
  //  This is a security feature, so we will turn it off unless the
  //  user really wants to.
  //
  if( !TextUtil.isPositive(wiki.getWikiProperties().getProperty("jspwiki-x.securityconfig.enable")) )
  {
      %>
      <html>
      <head>
        <base href="../"/>
        <link rel="stylesheet" media="screen, projection" type="text/css" href="<wiki:Link format="url" templatefile="jspwiki.css"/>"/>
        <wiki:IncludeResources type="stylesheet"/>
      </head>
      <body class="view"><div id="wikibody">
         <h1>Disabled</h1>
         <p>JSPWiki SecurityConfig UI has been disabled.  This page could reveal important security
         details about your configuration to a potential attacker, so it has been turned off by
         default.  However, it is very easy to enable it by setting the following value</p>
         <pre>
             jspwiki-x.securityconfig.enable=true
         </pre>
         <p>in your <tt>jspwiki.properties</tt> file.</p>
         <p>Once you are done with debugging your security configuration, please turn this page
         off again by removing the preceding line, so that your system is safe again.</p>
         <p>Have a nice day.  May the Force be with you.</p>
      </div></body>
      </html>
      <%
      return;
  }

%>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
  <title>JSPWiki Security Configuration Verifier</title>
  <base href="../"/>
  <link rel="stylesheet" media="screen, projection" type="text/css" href="<wiki:Link format="url" templatefile="jspwiki.css"/>"/>
  <wiki:IncludeResources type="stylesheet"/>
</head>
<body class="view">
<div id="wikibody">
<div id="page">
<div id="pagecontent">

<h1>JSPWiki Security Configuration Verifier</h1>

<p>This page examines JSPWiki's security configuration and tries to determine if it is working the way it should. Although JSPWiki comes configured with some reasonable default configuration settings out of the box, it's not always obvious what settings to change if you need to customize the security... and sooner or later, just about everyone does.</p>

<p>This page is dynamically generated by JSPWiki. It examines the authentication, authorization and security policy settings. When we think something looks funny, we'll try to communicate what the issue might be, and will make recommendations on how to fix the problem.</p>

<p><strong>Please delete this JSP when you are finished troubleshooting your system. 
This diagnostic data presented on this page do not represent a security risk
to your system <em>per se</em>, but they do provide a significant amount of
contextual information that could be useful to an attacker. This page is
currently unconstrained, which means that anyone can view it: nice people, mean people
and everyone in between. You have been warned.  You can turn it off by setting
<pre>
 jspwiki-x.securityconfig.enable=false
</pre>
in your jspwiki.properties.
</strong></p>

<!-- 
  *********************************************
  **** A U T H E N T I C A T I O N         ****
  *********************************************
-->
<h2>Authentication Configuration</h2>
<!-- 
  *********************************************
  **** Container Authentication Verifier   ****
  *********************************************
-->
<h3>Container-Managed Authentication</h3>
<%
  boolean isContainerAuth = wiki.getAuthenticationManager().isContainerAuthenticated();
  AuthorizationManager authorizationManager = wiki.getAuthorizationManager();
  if ( isContainerAuth )
  {
%>
{'fraction_non_alphanumeric': 0.16853782411120022, 'fraction_numerical': 0.005078855920876771, 'mean_word_length': 4.32977207977208, 'pattern_counts': {'":': 0, '<': 114, '<?xml version=': 0, '>': 114, 'https://': 0, 'lorem ipsum': 0, 'www.': 4, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5509134', 'n_tokens_mistral': 2194, 'n_tokens_neox': 2058, 'n_words': 708}