Merge branch 'hotfix/2019.1.5' into stable-2019.1

Source/Plugins/Core/com.equella.core/plugin-jpf.xml

@@ -4784,6 +4784,11 @@
     <parameter id="url-pattern" value="/*" />
     <parameter id="order" value="800" />
   </extension>
+  <extension plugin-id="com.tle.web.core" point-id="webFilter" id="sameSiteFilter">
+    <parameter id="bean" value="bean:com.tle.web.core.filter.SameSiteFilter" />
+    <parameter id="url-pattern" value="/*" />
+    <parameter id="order" value="850" />
+  </extension>
   <extension plugin-id="com.tle.web.core" point-id="webServlet" id="doNotServeServlet">
     <parameter id="bean" value="bean:com.tle.web.core.servlet.DoNotServeServlet" />
     <parameter id="url-pattern" value="/WEB-INF/*" />

Source/Plugins/Core/com.equella.core/src/com/tle/tomcat/guice/TomcatModule.java

@@ -28,6 +28,11 @@ protected void configure() {
     bindInt("http.port", -1);
     bindInt("https.port", -1);
     bindInt("ajp.port", -1);
+    bindProp("ajp.address", "127.0.0.1");
+    // Makes sense for this to be in mandatory-config, but we have to provide a default, non-null
+    // value
+    bindProp("ajp.secret", "ignore");
+    bindBoolean("ajp.secret.required", true);
     bindInt("tomcat.max.threads", -2);
     install(new TomcatOptionalModule());
   }

Source/Plugins/Core/com.equella.core/src/com/tle/tomcat/service/impl/TomcatServiceImpl.java

@@ -83,6 +83,18 @@ public class TomcatServiceImpl implements TomcatService, StartupBean, TomcatRest
   @Named("ajp.port")
   private int ajpPort;
 
+  @Inject
+  @Named("ajp.address")
+  private String ajpAddress;
+
+  @Inject
+  @Named("ajp.secret")
+  private String ajpSecret;
+
+  @Inject
+  @Named("ajp.secret.required")
+  private boolean ajpSecretRequired;
+
   @Inject
   @Named("tomcat.max.threads")
   private int maxThreads;
@@ -182,8 +194,13 @@ public void startup() {
       if (ajpPort != -1) {
         Connector connector = new Connector(useBio ? BIO_AJP : "AJP/1.3");
         connector.setPort(ajpPort);
+        if (!ajpSecret.equals("ignore")) {
+          connector.setAttribute("secret", ajpSecret);
+        }
+        connector.setAttribute("secretRequired", ajpSecretRequired);
         connector.setAttribute("tomcatAuthentication", false);
         connector.setAttribute("packetSize", "65536");
+        connector.setAttribute("address", ajpAddress);
         setConnector(connector);
       }
 

Source/Plugins/Core/com.equella.core/src/com/tle/web/core/filter/SameSiteFilter.java

@@ -0,0 +1,53 @@
+/*
+ * Licensed to The Apereo Foundation under one or more contributor license
+ * agreements. See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * The Apereo Foundation licenses this file to you under the Apache License,
+ * Version 2.0, (the "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.tle.web.core.filter;
+
+import com.tle.core.guice.Bind;
+import com.tle.web.dispatcher.AbstractWebFilter;
+import com.tle.web.dispatcher.FilterResult;
+import java.io.IOException;
+import java.util.Collection;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.ws.rs.core.HttpHeaders;
+
+@Bind
+public class SameSiteFilter extends AbstractWebFilter {
+
+  @Override
+  public FilterResult filterRequest(HttpServletRequest request, HttpServletResponse response)
+      throws IOException, ServletException {
+    if (request.isSecure()) {
+      Collection<String> headers = response.getHeaders(HttpHeaders.SET_COOKIE);
+      boolean firstHeader = true;
+      for (String header : headers) {
+        if (firstHeader) {
+          response.setHeader(
+              HttpHeaders.SET_COOKIE, String.format("%s; %s", header, "SameSite=None"));
+          firstHeader = false;
+          continue;
+        }
+        response.addHeader(
+            HttpHeaders.SET_COOKIE, String.format("%s; %s", header, "SameSite=None"));
+      }
+    }
+    return FilterResult.FILTER_CONTINUE;
+  }
+}

Source/Server/equellaserver/build.sbt

@@ -17,8 +17,8 @@ unmanagedClasspath in Runtime += (baseDirectory in LocalProject("learningedge_co
 
 val jacksonVersion   = "2.9.9"
 val axis2Version     = "1.6.2"
-val TomcatVersion    = "8.5.41"
-val SwaggerVersion   = "1.5.22"
+val TomcatVersion    = "8.5.51"
+val SwaggerVersion   = "1.5.24"
 val RestEasyVersion  = "3.5.0.Final"
 val simpledbaVersion = "0.1.9"
 val circeVersion     = "0.11.1"

autotest/OldTests/src/test/java/com/tle/webtests/test/contribute/ItemUnlock.java

@@ -9,16 +9,15 @@
 import com.tle.webtests.pageobject.wizard.ContributePage;
 import com.tle.webtests.pageobject.wizard.WizardPageTab;
 import com.tle.webtests.pageobject.wizard.controls.UniversalControl;
-import com.tle.webtests.pageobject.wizard.controls.universal.YouTubeUniversalControlType;
+import com.tle.webtests.pageobject.wizard.controls.universal.UrlUniversalControlType;
 import com.tle.webtests.test.AbstractCleanupTest;
 import org.testng.annotations.Test;
 
 @TestInstitution("fiveo")
 public class ItemUnlock extends AbstractCleanupTest {
-  private static final String RENAMED_NAME = "A Video";
-  private static final String ORIGINAL_NAME =
-      "What is a function? | Functions and their graphs | Algebra II | Khan Academy";
-  private static final String DISPLAY_NAME = "Original Displayname";
+  private static final String RENAMED_NAME = "Google Renamed";
+  private static final String DISPLAY_NAME = "Google";
+  private final String LINK_ATTACHMENT_URL = "https://www.google.com";
 
   @Test
   public void unlockAndResumeItem() {
@@ -30,10 +29,10 @@ public void unlockAndResumeItem() {
         new ContributePage(context).load().openWizard("Youtube Channel Testing Collection");
     wizard.editbox(1, itemName);
     UniversalControl control = wizard.universalControl(2);
-    YouTubeUniversalControlType youtube =
-        control.addDefaultResource(new YouTubeUniversalControlType(control));
-    youtube.search("Functions and their graphs", "The Khan Academy").selectVideo(1, ORIGINAL_NAME);
-    control.editResource(youtube.editPage(), ORIGINAL_NAME).setDisplayName(DISPLAY_NAME).save();
+
+    UrlUniversalControlType urlControl =
+        control.addDefaultResource(new UrlUniversalControlType(control));
+    urlControl.addUrl(LINK_ATTACHMENT_URL, DISPLAY_NAME);
     SummaryPage item = wizard.save().publish();
     assertTrue(item.attachments().attachmentExists(DISPLAY_NAME));
 
@@ -49,7 +48,7 @@ public void unlockAndResumeItem() {
 
     control = wizard.universalControl(2);
     control
-        .editResource(new YouTubeUniversalControlType(control), DISPLAY_NAME)
+        .editResource(new UrlUniversalControlType(control), DISPLAY_NAME)
         .setDisplayName(RENAMED_NAME)
         .save();
 

autotest/OldTests/src/test/java/com/tle/webtests/test/contribute/controls/MaxAttachmentsTest.java

@@ -4,7 +4,7 @@
 import com.tle.webtests.pageobject.wizard.ContributePage;
 import com.tle.webtests.pageobject.wizard.WizardPageTab;
 import com.tle.webtests.pageobject.wizard.controls.UniversalControl;
-import com.tle.webtests.pageobject.wizard.controls.universal.YouTubeUniversalControlType;
+import com.tle.webtests.pageobject.wizard.controls.universal.UrlUniversalControlType;
 import com.tle.webtests.test.AbstractCleanupAutoTest;
 import com.tle.webtests.test.files.Attachments;
 import java.net.URL;
@@ -15,8 +15,8 @@
 public class MaxAttachmentsTest extends AbstractCleanupAutoTest {
   private static final String COLLECTION = "Max attachments restriction";
   private final URL[] ATTACHMENTS = {Attachments.get("page.html"), Attachments.get("pageB.html")};
-  private final String ORIGINAL_TITLE = "Peter Andre - Mysterious Girl (Official Music Video)";
-  private final String YOUTUBE_TITLE = "good song";
+  private final String LINK_ATTACHMENT_URL = "https://www.google.com";
+  private final String LINK_ATTACHMENT_NAME = "Google";
 
   @Test
   public void maxFiles() {
@@ -25,19 +25,15 @@ public void maxFiles() {
     wizard.editbox(1, fullName);
     UniversalControl control = wizard.universalControl(2);
 
-    YouTubeUniversalControlType youTubeControl =
-        control.addResource(new YouTubeUniversalControlType(control));
-    youTubeControl.search("mysterious girl peter andre", null).selectVideo(1, ORIGINAL_TITLE);
-    control
-        .editResource(youTubeControl.editPage(), ORIGINAL_TITLE)
-        .setDisplayName(YOUTUBE_TITLE)
-        .save();
+    UrlUniversalControlType urlControl = control.addResource(new UrlUniversalControlType(control));
+    urlControl.addUrl(LINK_ATTACHMENT_URL, LINK_ATTACHMENT_NAME);
+
     wizard.addFiles(2, false, ATTACHMENTS);
     wizard.save().finishInvalid(wizard);
     Assert.assertEquals(
         wizard.getErrorMessage(2),
         "This control is restricted to a maximum of 2 attachments. Please remove 1 attachment(s).");
-    control.deleteResource(YOUTUBE_TITLE);
+    control.deleteResource(LINK_ATTACHMENT_NAME);
     wizard.save().publish();
   }
 }

autotest/OldTests/src/test/java/com/tle/webtests/test/viewing/ViewerTest.java

@@ -84,7 +84,7 @@ public void testHtml5Player() {
   public void testLTIViewer() {
     SummaryPage summary = SearchPage.searchAndView(context, "lti viewer item");
     LTIViewerPage lti =
-        summary.attachments().viewAttachment("youtube tool", new LTIViewerPage(context));
+        summary.attachments().viewAttachment("Vimeo tool", new LTIViewerPage(context));
     lti.searchYoutube("ghosts");
     lti.embedYTResult(4);
   }

autotest/Tests/tests/asc/institution/itemdefinition/2/2406791c-0f71-4059-8e3e-2a3c529e23e1.xml

@@ -179,7 +179,7 @@
                   <string>StoreJs</string>
                   <string>if (request.get(&apos;doit&apos;) == &apos;Create binary file&apos;)
 {
-	var connection = utils.getConnection(&quot;https://github.com/equella/Equella/blob/cfd7f9027de68635d73b60958079196bab165ead/Installer/resources/images/logo.gif?raw=true&quot;);
+	var connection = utils.getConnection(&quot;https://raw.githubusercontent.com/openequella/openEQUELLA/develop/Installer/resources/images/logo.gif?raw=true&quot;);
 	var response = connection.getResponse(true);
 	staging.writeBinaryFile(&quot;equellaLogo.gif &quot;,response.getAsBinaryData());
 }
@@ -350,4 +350,4 @@ if(request.get(&quot;doit&quot;) == &apos;Get File Details&apos;)
     </itemSummarySections>
   </slow>
   <denyDirectContribution>false</denyDirectContribution>
-</com.tle.beans.entity.itemdef.ItemDefinition>
+</com.tle.beans.entity.itemdef.ItemDefinition>

autotest/Tests/tests/asc/institution/itemdefinition/29/4f1739d7-dadf-4d97-8259-e224b9459f18.xml

@@ -143,7 +143,7 @@ if(request.get('doit') == 'Edit text file')
 
 if (request.get('doit') == 'Create binary attachment')
 {
-	var response = utils.getConnection("https://github.com/equella/Equella/blob/cfd7f9027de68635d73b60958079196bab165ead/Installer/resources/images/logo.gif?raw=true").getResponse(true);
+	var response = utils.getConnection("https://raw.githubusercontent.com/openequella/openEQUELLA/develop/Installer/resources/images/logo.gif?raw=true").getResponse(true);
 	attachments.createBinaryFileAttachment("equellaLogo.gif ","EQUELLA Logo",response.getAsBinaryData());
 	attachments.addExistingFileAsAttachment("equellaLogo.gif ","EQUELLA Logo");
 
@@ -362,4 +362,4 @@ Contents:
     </itemSummarySections>
   </slow>
   <denyDirectContribution>false</denyDirectContribution>
-</com.tle.beans.entity.itemdef.ItemDefinition>
+</com.tle.beans.entity.itemdef.ItemDefinition>

autotest/Tests/tests/cal/institution/items/90/63706-extra/activations.xml

@@ -8,9 +8,9 @@
     <status>0</status>
     <time class="sql-timestamp">2009-04-16 15:49:15.643</time>
     <from class="sql-timestamp">2009-04-16 15:49:02.687</from>
-    <until class="sql-timestamp">2020-04-01 11:00:00.0</until>
+    <until class="sql-timestamp">2100-12-31 11:00:00.0</until>
     <course entityclass="com.tle.beans.item.cal.request.CourseInfo" uuid="313213e6-049a-8834-46d1-230be99f4490"/>
     <citation>Harvard</citation>
     <description>, &apos;Part Two&apos; in</description>
   </com.tle.beans.activation.ActivateRequest>
-</list>
+</list>