From 6aadb5a36314a4536390200bdd2369ac545fe0a2 Mon Sep 17 00:00:00 2001
From: Paulo Gustavo Veiga <pveiga@wisemapping.com>
Date: Sat, 19 Feb 2022 17:21:45 -0800
Subject: [PATCH] Complete security filter

---
 .../src/main/webapp/WEB-INF/wisemapping-security.xml     | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/wise-webapp/src/main/webapp/WEB-INF/wisemapping-security.xml b/wise-webapp/src/main/webapp/WEB-INF/wisemapping-security.xml
index e75ddd93..2fe23d81 100644
--- a/wise-webapp/src/main/webapp/WEB-INF/wisemapping-security.xml
+++ b/wise-webapp/src/main/webapp/WEB-INF/wisemapping-security.xml
@@ -13,8 +13,6 @@
     </bean>
 
     <sec:http-firewall ref="custom-firewall"/>
-
-
     <sec:http pattern="/static/webapp/**" security="none"/>
     <sec:http pattern="/static/mindplot/**" security="none"/>
     <sec:http pattern="/css/**" security="none"/>
@@ -29,8 +27,6 @@
     <sec:http pattern="/c/maps/*/public" security="none"/>
     <sec:http pattern="/c/restful/maps/*/document/xml-pub" security="none"/>
 
-    <sec:http pattern="/c/publicview.htm" security="none"/>
-    <sec:http pattern="/c/embeddedview.htm" security="none"/>
     <sec:http pattern="/c/termsOfUse" security="none"/>
     <sec:http pattern="/c/activation" security="none"/>
 
@@ -54,8 +50,8 @@
     </sec:http>
 
     <sec:http use-expressions="true" pattern="/c/**/*">
+        <sec:csrf request-matcher-ref="requestMatcher"/>
         <sec:intercept-url pattern="/c/login" access="hasRole('ANONYMOUS')"/>
-        <sec:intercept-url pattern="/c/logout" access="hasRole('ANONYMOUS')"/>
         <sec:intercept-url pattern="/c/registration" access="hasRole('ANONYMOUS')"/>
         <sec:intercept-url pattern="/c/registration-success" access="hasRole('ANONYMOUS')"/>
         <sec:intercept-url pattern="/c/forgot-password" access="hasRole('ANONYMOUS')"/>
@@ -72,10 +68,9 @@
         <!-- Expire in 28 days -->
         <sec:remember-me token-validity-seconds="2419200" remember-me-parameter="remember-me"/>
         <sec:logout logout-url="/c/logout" invalidate-session="true" logout-success-url="/c/login"/>
-        <sec:csrf request-matcher-ref="requestMatcher"/>
     </sec:http>
 
-    <!-- Extends CFSR check to get methods to have consistency in all errors. Otherwise, request is forward in some cases -->
+    <!-- Extends CSFR match to get methods to have consistency in all errors. Otherwise, get requests are forward in some cases -->
     <bean id="requestMatcher"
           class="com.wisemapping.security.CSFRRequestMatcher">
         <property name="prefix" value="/c/restful/"/>