<commit_before><?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns="http://www.springframework.org/schema/security"
			xmlns:b="http://www.springframework.org/schema/beans"
			xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
			xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
		 							http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
	<authentication-manager>
		<authentication-provider ref="skyve" />
<!--
		<authentication-provider>
			<user-service>
				<user name="demo/admin" password="{<PASSWORD>" authorities="" />
			</user-service>
		</authentication-provider>
-->
<!--
		<authentication-provider>
			<jdbc-user-service data-source-ref="dataSource" 
								users-by-username-query="select username, password, not inactive and not passwordExpired from ADM_SecurityUser where bizCustomer || '/' || userName = ?"
								authorities-by-username-query="select null from ADM_SecurityUser where ? = null"
								group-authorities-by-username-query="select null from ADM_SecurityUser where ? = null"
								role-prefix="none" />
		</authentication-provider>
-->
	</authentication-manager>

	<!-- Do not secure the H2 database servlet -->
	<http auto-config="true" use-expressions="true" security="none" pattern="/h2/**" />

	<!-- Secure everything else -->
	<http auto-config="true" use-expressions="true">
		<form-login default-target-url="/" login-page="/login"  />
		<logout logout-success-url="/loggedOut" />
		
		<!-- Allow static web resources -->
		<intercept-url pattern="/**/*.css" access="permitAll" />
		<intercept-url pattern="/**/*.js" access="permitAll" />

		<!-- Do not secure the login servlet -->
		<intercept-url pattern="/login*" access="permitAll" />
		<intercept-url pattern="/loggedOut*" access="permitAll" />
		<intercept-url pattern="/smartClientJavascriptLogin*" access="permitAll" />
		
		<!-- Do not secure the home servlet as this ensures the right login page is displayed -->
		<intercept-url pattern="/home.jsp*" access="authenticated" />
		<intercept-url pattern="/home*" access="permitAll" />
		
		<intercept-url pattern="/pages/error.jsp" access="permitAll" />
		<intercept-url pattern="/pages/expired.jsp" access="permitAll" />
		<intercept-url pattern="/pages/requestPasswordReset.jsp" access="permitAll" />
		<intercept-url pattern="/pages/resetPassword.jsp" access="permitAll" />

		<!-- Do not secure faces pages as they are secured by a FacesSecurityFilter -->
		<intercept-url pattern="/**/*.xhtml" access="permitAll" />

		<!-- Secure dynamic image URLs -->
		<intercept-url pattern="/images/dynamic.*" access="authenticated" />
		<!-- Allow static image URLs -->
		<intercept-url pattern="/images/**" access="permitAll" />
		<intercept-url pattern="/**/*.jpg" access="permitAll" />
		<intercept-url pattern="/**/*.jpeg" access="permitAll" />
		<intercept-url pattern="/**/*.png" access="permitAll" />
		<intercept-url pattern="/**/*.gif" access="permitAll" />

		<intercept-url pattern="/**" access="authenticated" method="GET" />
		<intercept-url pattern="/**" access="authenticated" method="POST" />

		<!-- Allow PUT and DELETE for rest -->
		<intercept-url pattern="/rest**" access="authenticated" method="PUT" />
		<intercept-url pattern="/rest**" access="authenticated" method="DELETE" />
		
		<!-- Only allow get and post methods by default -->
		<intercept-url pattern="/**" access="denyAll" method="DELETE" />
		<intercept-url pattern="/**" access="denyAll" method="HEAD" />
		<intercept-url pattern="/**" access="denyAll" method="OPTIONS" />
		<intercept-url pattern="/**" access="denyAll" method="PATCH" />
		<intercept-url pattern="/**" access="denyAll" method="PUT" />
		<intercept-url pattern="/**" access="denyAll" method="TRACE" />
		
		<!-- We don't use Spring's CSRF tokens -->
		<csrf disabled="true" />
	</http>
	
	<b:bean id="skyve" class="org.skyve.impl.security.SkyveLegacyAuthenticationProvider">
		<b:property name="hashedPasswordSql" value="select password from ADM_SecurityUser where bizCustomer || '/' || userName = ? and not inactive" />
	</b:bean>
	
<!--
	<b:bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
		<b:property name="driverClassName" value="org.h2.Driver" />
		<b:property name="url" value="jdbc:h2:file:/Users/mike/dtf/skyve/skyve-ee/content/demo;IFEXISTS=FALSE;IGNORECASE=TRUE;AUTO_SERVER=TRUE" />
		<b:property name="username" value="sa" />
		<b:property name="password" value="sa" />
	</b:bean>

	<b:bean id="dataSource" class="org.springframework.jdbc.datasource.lookup.JndiDataSourceLookup">
		<b:constructor-arg name="dataSourceName" value="java:/H2Demo" />
	</b:bean>
-->
</b:beans><commit_msg>Redo security intercepts so that GET requests default to permitted.<commit_after><?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns="http://www.springframework.org/schema/security"
			xmlns:b="http://www.springframework.org/schema/beans"
			xmlns:jee="http://www.springframework.org/schema/jee"
			xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
			xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
		 							http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
		 							http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee.xsd">
	<authentication-manager>
<!--
		<authentication-provider ref="skyve" />
-->
<!--
		<authentication-provider>
			<user-service>
				<user name="demo/admin" password="{<PASSWORD>" authorities="" />
			</user-service>
		</authentication-provider>
-->

		<authentication-provider>
			<jdbc-user-service data-source-ref="dataSource" 
								users-by-username-query="select bizCustomer || '/' || userName, password, not inactive from ADM_SecurityUser where bizCustomer || '/' || userName = ?"
								authorities-by-username-query="select bizCustomer || '/' || userName, 'NoAuth' from ADM_SecurityUser where bizCustomer || '/' || userName = ?"
								group-authorities-by-username-query="select bizCustomer || '/' || userName, bizCustomer || '/' || userName, 'NoAuth' from ADM_SecurityUser where bizCustomer || '/' || userName = ?"
								role-prefix="none" />
		</authentication-provider>
	</authentication-manager>

	<!-- Do not secure the H2 database servlet -->
	<http auto-config="true" use-expressions="true" security="none" pattern="/h2/**" />

	<!-- Secure everything else -->
	<http auto-config="true" use-expressions="true">
		<form-login default-target-url="/" login-page="/login" />
		<logout logout-success-url="/loggedOut" />
<!--
		<remember-me key="skyve" />
-->

		<!-- Secure the system JSPs and HTMLs -->
		<intercept-url pattern="/home.jsp" access="authenticated" />
		<intercept-url pattern="/pages/changePassword.jsp" access="authenticated" />
		<intercept-url pattern="/pages/htmlEdit/browseImages.jsp" access="authenticated" />
		<intercept-url pattern="/pages/map/geolocate.jsp" access="authenticated" />

		<!-- Do not secure the home servlet as this ensures the right login page is displayed -->
		<intercept-url pattern="/home" access="permitAll" />

		<!-- Do not secure faces pages as they are secured by a FacesSecurityFilter -->
		<intercept-url pattern="/**/*.xhtml" access="permitAll" />

		<!-- Secure dynamic image URLs -->
		<intercept-url pattern="/images/dynamic.*" access="authenticated" />

		<!-- Secure all report URLs -->
		<intercept-url pattern="/report" access="authenticated" />
		<intercept-url pattern="/export" access="authenticated" />
		
		<!-- Secure Image Servlet for HTML reporting through Jasper -->
		<intercept-url pattern="/image" access="authenticated" />

		<!-- Secure customer resource servlet -->
		<intercept-url pattern="/resource" access="authenticated" />
		<intercept-url pattern="/content" access="authenticated" />

		<!-- Secure SC edit view servlet -->
		<intercept-url pattern="/smartedit" access="authenticated" />
		<!-- Secure SC list view servlet -->
		<intercept-url pattern="/smartlist" access="authenticated" />
		<!-- Secure SC view generation servlet -->
		<intercept-url pattern="/smartgen" access="authenticated" />
		<!-- Secure SC snap servlet -->
		<intercept-url pattern="/smartsnap" access="authenticated" />
		<!-- Secure SC tag servlet -->
		<intercept-url pattern="/smarttag" access="authenticated" />
		<!-- Secure SC previous values servlet -->
		<intercept-url pattern="/smartprev" access="authenticated" />
		<!-- Secure SC text search servlet -->
		<intercept-url pattern="/smartsearch" access="authenticated" />
		
		<!-- Secure map servlet -->
		<intercept-url pattern="/map" access="authenticated" />
		
		<!-- Secure the Bizport Export Servlet -->
		<intercept-url pattern="/bizexport.*" access="authenticated" />
		
		<!-- Secure the Download Servlet -->
		<intercept-url pattern="/download" access="authenticated" />
		
		<!-- Do not Secure trackmate servlet - it handles authentication itself -->
		<intercept-url pattern="/tracks" access="permitAll" />

		<!-- Allow GET, PUT, POST and DELETE for rest -->
		<intercept-url pattern="/rest**" access="authenticated" method="GET" />
		<intercept-url pattern="/rest**" access="authenticated" method="PUT" />
		<intercept-url pattern="/rest**" access="authenticated" method="POST" />
		<intercept-url pattern="/rest**" access="authenticated" method="DELETE" />
		
		<!-- Permit all GET requests by default -->
		<intercept-url pattern="/**" access="permitAll" method="GET" />
		<!--  Secure all POST requests by default -->
		<intercept-url pattern="/**" access="authenticated" method="POST" />

		<!-- Only allow get and post methods by default -->
		<intercept-url pattern="/**" access="denyAll" method="DELETE" />
		<intercept-url pattern="/**" access="denyAll" method="HEAD" />
		<intercept-url pattern="/**" access="denyAll" method="OPTIONS" />
		<intercept-url pattern="/**" access="denyAll" method="PATCH" />
		<intercept-url pattern="/**" access="denyAll" method="PUT" />
		<intercept-url pattern="/**" access="denyAll" method="TRACE" />
		
		<!-- We don't use Spring's CSRF tokens -->
		<csrf disabled="true" />
	</http>
	
	<b:bean id="skyve" class="org.skyve.impl.security.SkyveLegacyAuthenticationProvider">
		<b:property name="hashedPasswordSql" value="select password from ADM_SecurityUser where bizCustomer || '/' || userName = ? and not inactive" />
	</b:bean>
	
<!--
	<b:bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
		<b:property name="driverClassName" value="org.h2.Driver" />
		<b:property name="url" value="jdbc:h2:file:/Users/mike/dtf/skyve/skyve-ee/content/demo;IFEXISTS=FALSE;IGNORECASE=TRUE;AUTO_SERVER=TRUE" />
		<b:property name="username" value="sa" />
		<b:property name="password" value="sa" />
	</b:bean>

	<b:bean id="dataSource" class="org.springframework.jdbc.datasource.lookup.JndiDataSourceLookup">
		<b:constructor-arg name="dataSourceName" value="java:/H2Demo" />
	</b:bean>
-->
	<jee:jndi-lookup id="dataSource" jndi-name="java:/H2Demo" expected-type="javax.sql.DataSource" />
</b:beans>
{'fraction_non_alphanumeric': 0.18607967204348988, 'fraction_numerical': 0.002406202655734783, 'mean_word_length': 4.328584995251662, 'pattern_counts': {'":': 0, '<': 177, '<?xml version=': 2, '>': 177, 'https://': 0, 'lorem ipsum': 0, 'www.': 17, 'xml': 9}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3521829', 'n_tokens_mistral': 3822, 'n_tokens_neox': 3402, 'n_words': 678}