Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/filters/LocalStrings.properties
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/filters/LocalStrings.properties	2012-01-06 09:51:01.381741299 +0100
@@ -0,0 +1,19 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+csrfPrevention.invalidRandomClass=Unable to create Random source using class [{0}]
+filterbase.noSuchProperty=The property "{0}" is not defined for filters of type "{1}"
+
+http.403=Access to the specified resource ({0}) has been forbidden.
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/filters/FilterBase.java
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/filters/FilterBase.java	2012-01-06 09:51:01.384741401 +0100
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.catalina.filters;
+
+import java.util.Enumeration;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+
+import org.apache.juli.logging.Log;
+import org.apache.tomcat.util.IntrospectionUtils;
+import org.apache.tomcat.util.res.StringManager;
+
+/**
+ * Base class for filters that provides generic initialisation and a simple
+ * no-op destruction. 
+ * 
+ * @author xxd
+ */
+public abstract class FilterBase implements Filter {
+    
+    protected static final StringManager sm =
+        StringManager.getManager(Constants.Package);
+
+    protected abstract Log getLogger();
+    
+    public void init(FilterConfig filterConfig) throws ServletException {
+        
+        @SuppressWarnings("unchecked") // Servlet 2.5 doesn't use generics
+        Enumeration paramNames = filterConfig.getInitParameterNames();
+        
+        while (paramNames.hasMoreElements()) {
+            String paramName = (String) paramNames.nextElement();
+            if (!IntrospectionUtils.setProperty(this, paramName,
+                    filterConfig.getInitParameter(paramName))) {
+                getLogger().warn(sm.getString("filterbase.noSuchProperty",
+                        paramName, this.getClass().getName()));
+            }
+        }    
+    }
+
+    public void destroy() {
+        // NOOP
+    }
+
+}
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/filters/Constants.java
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/filters/Constants.java	2012-01-06 09:51:01.384741401 +0100
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+package org.apache.catalina.filters;
+
+
+/**
+ * Constants for this Java package.
+ */
+
+public final class Constants {
+
+    public static final String Package = "org.apache.catalina.filters";
+
+    public static final String CSRF_NONCE_SESSION_ATTR_NAME =
+        "org.apache.catalina.filters.CSRF_NONCE";
+    
+    public static final String CSRF_NONCE_REQUEST_PARAM =
+        "org.apache.catalina.filters.CSRF_NONCE";
+    
+    public static final String METHOD_GET = "GET";
+}
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/filters/CsrfPreventionFilter.java
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/filters/CsrfPreventionFilter.java	2012-01-06 09:51:01.385741435 +0100
@@ -0,0 +1,317 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.catalina.filters;
+
+import java.io.IOException;
+import java.security.SecureRandom;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Random;
+import java.util.Set;
+
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpServletResponseWrapper;
+
+import org.apache.juli.logging.Log;
+import org.apache.juli.logging.LogFactory;
+
+/**
+ * Provides basic CSRF protection for a web application. The filter assumes
+ * that:
+ * <ul>
+ * <li>The filter is mapped to /*</li>
+ * <li>{@link HttpServletResponse#encodeRedirectURL(String)} and
+ * {@link HttpServletResponse#encodeURL(String)} are used to encode all URLs
+ * returned to the client
+ * </ul>
+ */
+public class CsrfPreventionFilter extends FilterBase {
+
+    private static final Log log =
+        LogFactory.getLog(CsrfPreventionFilter.class);
+    
+    private String randomClass = SecureRandom.class.getName();
+    
+    private Random randomSource;
+
+    private final Set<String> entryPoints = new HashSet<String>();
+    
+    private int nonceCacheSize = 5;
+
+    @Override
+    protected Log getLogger() {
+        return log;
+    }
+
+    /**
+     * Entry points are URLs that will not be tested for the presence of a valid
+     * nonce. They are used to provide a way to navigate back to a protected
+     * application after navigating away from it. Entry points will be limited
+     * to HTTP GET requests and should not trigger any security sensitive
+     * actions.
+     * 
+     * @param entryPoints   Comma separated list of URLs to be configured as
+     *                      entry points.
+     */
+    public void setEntryPoints(String entryPoints) {
+        String values[] = entryPoints.split(",");
+        for (String value : values) {
+            this.entryPoints.add(value.trim());
+        }
+    }
+
+    /**
+     * Sets the number of previously issued nonces that will be cached on a LRU
+     * basis to support parallel requests, limited use of the refresh and back
+     * in the browser and similar behaviors that may result in the submission
+     * of a previous nonce rather than the current one. If not set, the default
+     * value of 5 will be used.
+     * 
+     * @param nonceCacheSize    The number of nonces to cache
+     */
+    public void setNonceCacheSize(int nonceCacheSize) {
+        this.nonceCacheSize = nonceCacheSize;
+    }
+    
+    /**
+     * Specify the class to use to generate the nonces. Must be in instance of
+     * {@link Random}.
+     * 
+     * @param randomClass   The name of the class to use
+     */
+    public void setRandomClass(String randomClass) {
+        this.randomClass = randomClass;
+    }
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+        // Set the parameters
+        super.init(filterConfig);
+        
+        try {
+            Class<?> clazz = Class.forName(randomClass);
+            randomSource = (Random) clazz.newInstance();
+        } catch (ClassNotFoundException e) {
+            ServletException se = new ServletException(sm.getString(
+                    "csrfPrevention.invalidRandomClass", randomClass), e);
+            throw se;
+        } catch (InstantiationException e) {
+            ServletException se = new ServletException(sm.getString(
+                    "csrfPrevention.invalidRandomClass", randomClass), e);
+            throw se;
+        } catch (IllegalAccessException e) {
+            ServletException se = new ServletException(sm.getString(
+                    "csrfPrevention.invalidRandomClass", randomClass), e);
+            throw se;
+        }
+    }
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response,
+            FilterChain chain) throws IOException, ServletException {
+
+        ServletResponse wResponse = null;
+        
+        if (request instanceof HttpServletRequest &&
+                response instanceof HttpServletResponse) {
+            
+            HttpServletRequest req = (HttpServletRequest) request;
+            HttpServletResponse res = (HttpServletResponse) response;
+
+            boolean skipNonceCheck = false;
+            
+            if (Constants.METHOD_GET.equals(req.getMethod())) {
+                String path = req.getServletPath();
+                if (req.getPathInfo() != null) {
+                    path = path + req.getPathInfo();
+                }
+                
+                if (entryPoints.contains(path)) {
+                    skipNonceCheck = true;
+                }
+            }
+
+            @SuppressWarnings("unchecked")
+            LruCache<String> nonceCache =
+                (LruCache<String>) req.getSession(true).getAttribute(
+                    Constants.CSRF_NONCE_SESSION_ATTR_NAME);
+            
+            if (!skipNonceCheck) {
+                String previousNonce =
+                    req.getParameter(Constants.CSRF_NONCE_REQUEST_PARAM);
+
+                if (nonceCache != null && !nonceCache.contains(previousNonce)) {
+                    res.sendError(HttpServletResponse.SC_FORBIDDEN);
+                    return;
+                }
+            }
+            
+            if (nonceCache == null) {
+                nonceCache = new LruCache<String>(nonceCacheSize);
+                req.getSession().setAttribute(
+                        Constants.CSRF_NONCE_SESSION_ATTR_NAME, nonceCache);
+            }
+            
+            String newNonce = generateNonce();
+            
+            nonceCache.add(newNonce);
+            
+            wResponse = new CsrfResponseWrapper(res, newNonce);
+        } else {
+            wResponse = response;
+        }
+        
+        chain.doFilter(request, wResponse);
+    }
+
+    /**
+     * Generate a once time token (nonce) for authenticating subsequent
+     * requests. This will also add the token to the session. The nonce
+     * generation is a simplified version of ManagerBase.generateSessionId().
+     * 
+     */
+    protected String generateNonce() {
+        byte random[] = new byte[16];
+
+        // Render the result as a String of hexadecimal digits
+        StringBuilder buffer = new StringBuilder();
+
+        randomSource.nextBytes(random);
+       
+        for (int j = 0; j < random.length; j++) {
+            byte b1 = (byte) ((random[j] & 0xf0) >> 4);
+            byte b2 = (byte) (random[j] & 0x0f);
+            if (b1 < 10)
+                buffer.append((char) ('0' + b1));
+            else
+                buffer.append((char) ('A' + (b1 - 10)));
+            if (b2 < 10)
+                buffer.append((char) ('0' + b2));
+            else
+                buffer.append((char) ('A' + (b2 - 10)));
+        }
+
+        return buffer.toString();
+    }
+
+    protected static class CsrfResponseWrapper
+            extends HttpServletResponseWrapper {
+
+        private String nonce;
+
+        public CsrfResponseWrapper(HttpServletResponse response, String nonce) {
+            super(response);
+            this.nonce = nonce;
+        }
+
+        @Override
+        @Deprecated
+        public String encodeRedirectUrl(String url) {
+            return encodeRedirectURL(url);
+        }
+
+        @Override
+        public String encodeRedirectURL(String url) {
+            return addNonce(super.encodeRedirectURL(url));
+        }
+
+        @Override
+        @Deprecated
+        public String encodeUrl(String url) {
+            return encodeURL(url);
+        }
+
+        @Override
+        public String encodeURL(String url) {
+            return addNonce(super.encodeURL(url));
+        }
+        
+        /**
+         * Return the specified URL with the nonce added to the query string. 
+         *
+         * @param url URL to be modified
+         * @param nonce The nonce to add
+         */
+        private String addNonce(String url) {
+
+            if ((url == null) || (nonce == null))
+                return (url);
+
+            String path = url;
+            String query = "";
+            String anchor = "";
+            int pound = path.indexOf('#');
+            if (pound >= 0) {
+                anchor = path.substring(pound);
+                path = path.substring(0, pound);
+            }
+            int question = path.indexOf('?');
+            if (question >= 0) {
+                query = path.substring(question);
+                path = path.substring(0, question);
+            }
+            StringBuilder sb = new StringBuilder(path);
+            if (query.length() >0) {
+                sb.append(query);
+                sb.append('&');
+            } else {
+                sb.append('?');
+            }
+            sb.append(Constants.CSRF_NONCE_REQUEST_PARAM);
+            sb.append('=');
+            sb.append(nonce);
+            sb.append(anchor);
+            return (sb.toString());
+        }
+    }
+    
+    private static class LruCache<T> {
+
+        // Although the internal implementation uses a Map, this cache
+        // implementation is only concerned with the keys.
+        private final Map<T,T> cache;
+        
+        public LruCache(final int cacheSize) {
+            cache = new LinkedHashMap<T,T>() {
+                private static final long serialVersionUID = 1L;
+                @Override
+                protected boolean removeEldestEntry(Map.Entry<T,T> eldest) {
+                    if (size() > cacheSize) {
+                        return true;
+                    }
+                    return false;
+                }
+            };
+        }
+        
+        public void add(T key) {
+            cache.put(key, null);
+        }
+        
+        public boolean contains(T key) {
+            return cache.containsKey(key);
+        }
+    }
+}
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/manager/HTMLManagerServlet.java
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/java/org/apache/catalina/manager/HTMLManagerServlet.java	2012-01-06 09:50:30.000000000 +0100
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/manager/HTMLManagerServlet.java	2012-01-06 09:51:50.087425429 +0100
@@ -982,7 +982,7 @@
         " <td class=\"row-left\" bgcolor=\"{6}\" rowspan=\"2\"><small>{2}</small></td>\n" +
         " <td class=\"row-center\" bgcolor=\"{6}\" rowspan=\"2\"><small>{3}</small></td>\n" +
         " <td class=\"row-center\" bgcolor=\"{6}\" rowspan=\"2\">" +
-        "<small><a href=\"{4}\" target=\"_new\">{5}</a></small></td>\n";
+        "<small><a href=\"{4}\">{5}</a></small></td>\n";
 
     private static final String MANAGER_APP_ROW_BUTTON_SECTION =
         " <td class=\"row-left\" bgcolor=\"{13}\">\n" +
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java	2008-07-22 02:01:29.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/manager/host/HTMLHostManagerServlet.java	2012-01-06 09:51:01.398741886 +0100
@@ -105,6 +105,13 @@
     }
 
     
+    @Override
+    public void doPost(HttpServletRequest request, HttpServletResponse response)
+            throws IOException, ServletException {
+        doGet(request, response);
+    }
+    
+    
     /**
      * Add a host using the specified parameters.
      *
@@ -435,7 +442,7 @@
         "</tr>\n" +
         "<tr>\n" +
         " <td colspan=\"2\">\n" +
-        "<form method=\"get\" action=\"{2}\">\n" +
+        "<form method=\"post\" action=\"{2}\">\n" +
         "<table cellspacing=\"0\" cellpadding=\"3\">\n" +
         "<tr>\n" +
         " <td class=\"row-right\">\n" +
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/conf/tomcat-users.xml
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/conf/tomcat-users.xml	2008-07-22 02:01:29.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/conf/tomcat-users.xml	2012-01-06 09:51:02.319773734 +0100
@@ -17,6 +17,16 @@
 -->
 <tomcat-users>
 <!--
+  NOTE:  By default, no user is included in the "manager-gui" role required
+  to operate the "/manager/html" web application.  If you wish to use this app,
+  you must define such a user - the username and password are arbitrary.
+-->
+<!--
+  NOTE:  The sample user and role entries below are wrapped in a comment
+  and thus are ignored when reading this file. Do not forget to remove
+  <!.. ..> that surrounds them.
+-->
+<!--
   <role rolename="tomcat"/>
   <role rolename="role1"/>
   <user username="tomcat" password="tomcat" roles="tomcat"/>
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/host-manager/401.jsp
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/host-manager/401.jsp	2012-01-06 09:51:02.320773769 +0100
@@ -0,0 +1,75 @@
+<%--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+--%>
+<%
+  response.setHeader("WWW-Authenticate", "Basic realm=\"Tomcat Host Manager Application\"");
+%>
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+ <head>
+  <title>401 Unauthorized</title>
+  <style type="text/css">
+    <!--
+    BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;font-size:12px;}
+    H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
+    PRE, TT {border: 1px dotted #525D76}
+    A {color : black;}A.name {color : black;}
+    -->
+  </style>
+ </head>
+ <body>
+   <h1>401 Unauthorized</h1>
+   <p>
+    You are not authorized to view this page. If you have not changed
+    any configuration files, please examine the file
+    <tt>conf/tomcat-users.xml</tt> in your installation. That
+    file must contain the credentials to let you use this webapp.
+   </p>
+   <p>
+    For example, to add the <tt>admin-gui</tt> role to a user named
+    <tt>tomcat</tt> with a password of <tt>s3cret</tt>, add the following to the
+    config file listed above.
+   </p>
+<pre>
+&lt;role rolename="admin-gui"/&gt;
+&lt;user username="tomcat" password="s3cret" roles="admin-gui"/&gt;
+</pre>
+   <p>
+    Note that for Tomcat with generic CSRF protection, the roles required to use the host
+    manager application were changed from the single <tt>admin</tt> role to the
+    following two roles. You will need to assign the role(s) required for
+    the functionality you wish to access.
+   </p>
+    <ul>
+      <li><tt>admin-gui</tt> - allows access to the HTML GUI</li>
+      <li><tt>admin-script</tt> - allows access to the text interface</li>
+    </ul>
+   <p>
+    The HTML interface is protected against CSRF but the text interface is not.
+    To maintain the CSRF protection:
+   </p>
+   <ul>
+    <li>The deprecated <tt>admin</tt> role should not be assigned to any
+        user.</li>
+    <li>Users with the <tt>admin-gui</tt> role should not be granted the
+       <tt>manager-script</tt> role.</li>
+    <li>If the text interface is accessed through a browser (e.g. for testing
+        since this interface is intended for tools not humans) then the browser
+        must be closed afterwards to terminate the session.</li>
+   </ul>
+ </body>
+
+</html>
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/host-manager/403.jsp
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/host-manager/403.jsp	2012-01-06 09:51:02.320773769 +0100
@@ -0,0 +1,90 @@
+<%--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+--%>
+<%
+  response.setHeader("WWW-Authenticate", "Basic realm=\"Tomcat Host Manager Application\"");
+%>
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+ <head>
+  <title>403 Access Denied</title>
+  <style type="text/css">
+    <!--
+    BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;font-size:12px;}
+    H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
+    PRE, TT {border: 1px dotted #525D76}
+    A {color : black;}A.name {color : black;}
+    -->
+  </style>
+ </head>
+ <body>
+   <h1>403 Access Denied</h1>
+   <p>
+    You are not authorized to view this page.
+   </p>
+   <p>
+    If you have already configured the Host Manager application to allow access
+    and you have used your browser's back button, used a saved book-mark or
+    similar then you may have triggered the cross-site request forgery (CSRF)
+    protection that has been enabled for the HTML interface of the Host Manager
+    application. You will need to reset this protection by returning to the 
+    <a href="<%=request.getContextPath()%>/html">main Host Manager page</a>.
+    Once you return to this page, you will be able to continue using the Host
+    Manager appliction's HTML interface normally. If you continue to see this
+    access denied message, check that you have the necessary permissions to
+    access this application.
+   </p>
+   <p> If you have not changed
+    any configuration files, please examine the file
+    <tt>conf/tomcat-users.xml</tt> in your installation. That
+    file must contain the credentials to let you use this webapp.
+   </p>
+   <p>
+    For example, to add the <tt>admin-gui</tt> role to a user named
+    <tt>tomcat</tt> with a password of <tt>s3cret</tt>, add the following to the
+    config file listed above.
+   </p>
+<pre>
+&lt;role rolename="admin-gui"/&gt;
+&lt;user username="tomcat" password="s3cret" roles="admin-gui"/&gt;
+</pre>
+   <p>
+    Note that for Tomcat with generic CSRF protection, the roles required to use the host
+    manager application were changed from the single <tt>admin</tt> role to the
+    following two roles. You will need to assign the role(s) required for
+    the functionality you wish to access. Note the <tt>admin</tt> role is still
+    valid but by-passes the CSRF protection.
+   </p>
+    <ul>
+      <li><tt>admin-gui</tt> - allows access to the HTML GUI</li>
+      <li><tt>admin-script</tt> - allows access to the text interface</li>
+    </ul>
+   <p>
+    The HTML interface is protected against CSRF but the text interface is not.
+    To maintain the CSRF protection:
+   </p>
+   <ul>
+    <li>The deprecated <tt>admin</tt> role should not be assigned to any
+        user.</li>
+    <li>Users with the <tt>admin-gui</tt> role should not be granted the
+       <tt>manager-script</tt> role.</li>
+    <li>If the text interface is accessed through a browser (e.g. for testing
+        since this interface is intended for tools not humans) then the browser
+        must be closed afterwards to terminate the session.</li>
+   </ul>
+ </body>
+
+</html>
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/host-manager/WEB-INF/web.xml
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/webapps/host-manager/WEB-INF/web.xml	2008-07-22 02:01:28.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/host-manager/WEB-INF/web.xml	2012-01-06 09:51:02.320773769 +0100
@@ -27,12 +27,6 @@
 	Manager lets you view, load/unload/etc particular web applications.
   </description>
 
-  <!-- Define the Manager Servlet
-       Change servlet-class to: org.apache.catalina.servlets.HTMLManagerServlet
-       to get a Servlet with a more intuitive HTML interface, don't change if you
-       have software that is expected to parse the output from ManagerServlet
-       since they're not compatible.
-   -->
   <servlet>
     <servlet-name>HostManager</servlet-name>
     <servlet-class>org.apache.catalina.manager.host.HostManagerServlet</servlet-class>
@@ -76,11 +70,24 @@
     <url-pattern>/html/*</url-pattern>
   </servlet-mapping>
 
+  <filter>
+    <filter-name>CSRF</filter-name>
+    <filter-class>org.apache.catalina.filters.CsrfPreventionFilter</filter-class>
+    <init-param>
+      <param-name>entryPoints</param-name>
+      <param-value>/html,/html/list</param-value>
+    </init-param>
+  </filter>
+
+  <filter-mapping>
+    <filter-name>CSRF</filter-name>
+    <servlet-name>HTMLHostManager</servlet-name>
+  </filter-mapping>
+
   <!-- Define a Security Constraint on this Application -->
   <security-constraint>
     <web-resource-collection>
-      <web-resource-name>HTMLHostManager and HostManager commands</web-resource-name>
-      <url-pattern>/html/*</url-pattern>
+      <web-resource-name>HostManager commands</web-resource-name>
       <url-pattern>/list</url-pattern>
       <url-pattern>/add</url-pattern>
       <url-pattern>/remove</url-pattern>
@@ -88,8 +95,33 @@
       <url-pattern>/stop</url-pattern>
     </web-resource-collection>
     <auth-constraint>
-       <!-- NOTE:  This role is not present in the default users file -->
+       <!-- NOTE: 1. These roles are not present in the default users file
+                  2. The admin role is deprecated, it will be removed in
+                     Tomcat 7.
+                  3. Use the admin-script role to take advantage of the new
+                     CSRF protection. Using the admin role or assigning both
+                     the admin-script and admin-gui roles to the same user
+                     will bypass the CSRF protection. -->
        <role-name>admin</role-name>
+       <role-name>admin-script</role-name>
+    </auth-constraint>
+  </security-constraint>
+
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>HTMLHostManager commands</web-resource-name>
+      <url-pattern>/html/*</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+       <!-- NOTE: 1. These roles are not present in the default users file
+                  2. The admin role is deprecated, it will be removed in
+                     Tomcat 7.
+                  3. Use the admin-gui role to take advantage of the new
+                     CSRF protection. Using the admin role or assigning both
+                     the admin-script and admin-gui roles to the same user
+                     will bypass the CSRF protection. -->
+       <role-name>admin</role-name>
+       <role-name>admin-gui</role-name>
     </auth-constraint>
   </security-constraint>
 
@@ -102,7 +134,19 @@
   <!-- Security roles referenced by this web application -->
   <security-role>
     <description>
-      The role that is required to log in to the Manager Application
+      The role that is required to access the text Host Manager pages
+    </description>
+    <role-name>admin-script</role-name>
+  </security-role>
+  <security-role>
+    <description>
+      The role that is required to access the HTML Host Manager pages
+    </description>
+    <role-name>admin-gui</role-name>
+  </security-role>
+  <security-role>
+    <description>
+      Deprecated role that can access all Host Manager functionality
     </description>
     <role-name>admin</role-name>
   </security-role>
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/docs/changelog.xml
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/webapps/docs/changelog.xml	2012-01-06 09:50:30.000000000 +0100
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/docs/changelog.xml	2012-01-06 09:51:02.323773874 +0100
@@ -61,6 +61,10 @@
       <fix>
         Code clean-up. Avoid some casts in StandardContext. (markt)
       </fix>
+      <add>
+        Add a new filter to provide generic cross-site request forgery (CSRF)
+        protection for web applications. (markt)
+      </add>
     </changelog>
   </subsection>
   <subsection name="Webapps">
@@ -282,6 +286,18 @@
         <bug>45195</bug>: Passing in null into setAttribute or removeAttribute
         cause NPE. (markt)
       </fix>
+      <add>
+        Configure the Manager web application to use the new CSRF protection. To
+        take advantge of this protection, the manager role must be removed from
+        all users and the new manager-gui and manager-script roles used instead.
+        (markt)
+      </add>
+      <add>
+        Configure the Host Manager web application to use the new CSRF
+        protection. To take advantge of this protection, the admin role must be
+        removed from all users and the new admin-gui and admin-script roles used
+        instead. (markt)
+      </add>
     </changelog>
   </subsection>
   <subsection name="Coyote">
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/docs/config/filter.xml
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/docs/config/filter.xml	2012-01-06 09:51:02.326773977 +0100
@@ -0,0 +1,118 @@
+<?xml version="1.0"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<!DOCTYPE document [
+  <!ENTITY project SYSTEM "project.xml">
+]>
+<document url="filter.html">
+
+  &project;
+
+  <properties>
+    <title>Container Provided Filters</title>
+  </properties>
+
+<body>
+
+<section name="Table of Contents">
+<toc/>
+</section>
+
+<section name="Introduction">
+
+  <p>Tomcat provides a number of <strong>Filters</strong> which may be
+  configured for use with all web applications using
+  <code>$CATALINA_BASE/conf/web.xml</code> or may be configured for individual
+  web applications by configuring them in the application's
+  <code>WEB-INF/web.xml</code>. Each filter is described below.</p>
+
+    <blockquote><em>
+    <p>This description uses the variable name $CATALINA_BASE to refer the
+    base directory against which most relative paths are resolved. If you have
+    not configured Tomcat for multiple instances by setting a CATALINA_BASE
+    directory, then $CATALINA_BASE will be set to the value of $CATALINA_HOME,
+    the directory into which you have installed Tomcat.</p>
+    </em></blockquote>
+
+</section>
+
+
+<section name="CSRF Prevention Filter">
+
+  <subsection name="Introduction">
+
+    <p>This filter provides basic CSRF protection for a web application. The
+    filter assumes that it is mapped to <code>/*</code> and that all URLs
+    returned to the client are encoded via a call to
+    <code>HttpServletResponse#encodeRedirectURL(String)</code> or
+    <code>HttpServletResponse#encodeURL(String)</code>.</p>
+    
+    <p>This filter prevents CSRF by generating a nonce and storing it in the
+    session. URLs are also encoded with the same nonce. When the next request is
+    received the nonce in the request is compared to the nonce in the session
+    and only if they are the same is the request allowed to continue.</p>
+    
+  </subsection>
+
+  <subsection name="Filter Class Name">
+
+    <p>The filter class name for the CSRF Prevention Filter is
+    <strong><code>org.apache.catalina.filters.CsrfPreventionFilter</code>
+    </strong>.</p>
+
+  </subsection>
+
+  <subsection name="Initialisation parameters">
+
+    <p>The CSRF Prevention Filter supports the following initialisation
+    parameters:</p>
+
+    <attributes>
+
+      <attribute name="entryPoints" required="false">
+        <p>A comma separated list of URLs that will not be tested for the
+        presence of a valid nonce. They are used to provide a way to navigate
+        back to a protected application after having navigated away from it.
+        Entry points will be limited to HTTP GET requests and should not trigger
+        any security sensitive actions.</p>
+      </attribute>
+      
+      <attribute name="nonceCacheSize" required="false">
+        <p>The number of previously issued nonces that will be cached on a LRU
+        basis to support parallel requests, limited use of the refresh and back
+        in the browser and similar behaviors that may result in the submission
+        of a previous nonce rather than the current one. If not set, the default
+        value of 5 will be used.</p>
+      </attribute>
+      
+      <attribute name="randomClass" required="false">
+        <p>The name of the class to use to generate nonces. The class must be an
+        instance of <code>java.util.Random</code>. If not set, the default value
+        of <code>java.security.SecureRandom</code> will be used.</p>
+      </attribute>
+      
+    </attributes>
+    
+  </subsection>
+
+</section>
+
+
+</body>
+
+
+</document>
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/docs/config/project.xml
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/webapps/docs/config/project.xml	2008-07-22 02:01:28.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/docs/config/project.xml	2012-01-06 09:52:49.736487694 +0100
@@ -54,7 +54,9 @@
     </menu>
 
     <menu name="Nested Components">
+        <item name="Filter"                href="filter.html"/>
         <item name="Global Resources"      href="globalresources.html"/>
+        <item name="Listeners"             href="listeners.html"/>
         <item name="Loader"                href="loader.html"/>
         <item name="Manager"               href="manager.html"/> 
         <item name="Realm"                 href="realm.html"/>
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/docs/manager-howto.xml
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/webapps/docs/manager-howto.xml	2008-07-22 02:01:29.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/docs/manager-howto.xml	2012-01-06 09:51:02.331774150 +0100
@@ -105,7 +105,7 @@
 example:
 <pre>
 &lt;Context path="/manager" debug="0" privileged="true"
-         docBase="/usr/local/kinetic/tomcat6/server/webapps/manager"&gt;
+         docBase="/usr/local/tomcat6/webapps/manager"&gt;
 &lt;/Context&gt;
 </pre>
 </p>
@@ -146,17 +146,29 @@
 anyone on the Internet to execute the Manager application on your server.
 Therefore, the Manager application is shipped with the requirement that anyone
 who attempts to use it must authenticate themselves, using a username and
-password that have the role <strong>manager</strong> associated with them.
+password that have the appropriate role associated with them.
 Further, there is no username in the default users file
 (<conf>$CATALINA_BASE/conf/tomcat-users.xml</conf>) that is assigned this
 role.  Therefore, access to the Manager application is completely disabled
 by default.</p>
 
 <p>To enable access to the Manager web application, you must either create
-a new username/password combination and associate the role name
-<strong>manager</strong> with it, or add the <strong>manager</strong> role
-to some existing username/password combination.  Exactly where this is done
-depends on which <code>Realm</code> implementation you are using:</p>
+a new username/password combination and associate on of the manager roles with
+it, or add a manager role to some existing username/password combination. There
+are four roles defined by the manager application:</p>
+<ul>
+<li><em>manager-gui</em> - Allows access to the html interface</li>
+<li><em>manager-script</em> - Allows access to the plain text interface</li>
+<li><em>manager-jmx</em> - Allows access to the JMX proxy interface</li>
+<li><em>manager-status</em> - Allows access to the read-only status pages</li>
+</ul>
+<p>The manager application is configured to use the CSRF prevention filter. For
+this filter to be effective, any user assigned the <code>manager-gui</code> role
+must not be assigned the <code>manager-script</code> nor the
+<code>manager-jmx</code> roles.</p>
+
+<p>Exactly where roles are associated to users depends on which
+<code>Realm</code> implementation you are using:</p>
 <ul>
 <li><em>MemoryRealm</em> - If you have not customized your
     <code>$CATALINA_BASE/conf/server.xml</code> to select a different one,
@@ -166,22 +178,22 @@
     <code>&lt;user&gt;</code> for each individual user, which might
     look something like this:
 <source>
-&lt;user name="craigmcc" password="secret" roles="standard,manager" /&gt;
+&lt;user name="craigmcc" password="secret" roles="standard,manager-gui" /&gt;
 </source>
     which defines the username and password used by this individual to
     log on, and the role names he or she is associated with.  You can
-    add the <strong>manager</strong> role to the comma-delimited
+    add a role, e.g. <strong>manager-gui</strong>, to the comma-delimited
     <code>roles</code> attribute for one or more existing users, and/or
     create new users with that assigned role.</li>
 <li><em>JDBCRealm</em> - Your user and role information is stored in
-    a database accessed via JDBC.  Add the <strong>manager</strong> role
-    to one or more existing users, and/or create one or more new users
-    with this role assigned, following the standard procedures for your
+    a database accessed via JDBC.  Add the required role(s) to one or more
+    existing users, and/or create one or more new users with the required
+    role(s) assigned, following the standard procedures for your
     environment.</li>
 <li><em>JNDIRealm</em> - Your user and role information is stored in
-    a directory server accessed via LDAP.  Add the <strong>manager</strong>
-    role to one or more existing users, and/or create one or more new users
-    with this role assigned, following the standard procedures for your
+    a directory server accessed via LDAP.  Add the required role(s) to one or
+    more existing users, and/or create one or more new users with the required
+    role(s) assigned, following the standard procedures for your
     environment.</li>
 </ul>
 
@@ -189,7 +201,7 @@
 described in the next section, you will be challenged to log on using
 BASIC authentication.  The username and password you enter do not matter,
 as long as they identify a valid user in the users database who possesses
-the role <strong>manager</strong>.</p>
+the appropriate role.</p>
 
 <p>In addition to the password restrictions the manager web application
 could be restricted by the remote IP address or host by adding a
@@ -197,7 +209,7 @@
 an example of restricting access to the localhost by IP address:
 <pre>
 &lt;Context path="/manager" privileged="true"
-         docBase="/usr/local/kinetic/tomcat6/server/webapps/manager"&gt;
+         docBase="/usr/local/tomcat6/server/manager"&gt;
          &lt;Valve className="org.apache.catalina.valves.RemoteAddrValve"
                 allow="127\.0\.0\.1"/&gt;
 &lt;/Context&gt;
@@ -917,7 +929,7 @@
 <li>Add the <code>$ANT_HOME/bin</code> directory to your <code>PATH</code>
     environment variable.</li>
 <li>Configure at least one username/password combination in your Tomcat
-    user database that includes the <code>manager</code> role.</li>
+    user database that includes the <code>manager-script</code> role.</li>
 </ul>
 
 <p>To use custom tasks within Ant, you must declare them first with a
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/manager/401.jsp
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/webapps/manager/401.jsp	2008-07-22 02:01:28.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/manager/401.jsp	2012-01-06 09:51:03.061799394 +0100
@@ -1,4 +1,4 @@
-<!--
+<%--
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
@@ -13,14 +13,15 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
--->
+--%>
 <%
   response.setHeader("WWW-Authenticate", "Basic realm=\"Tomcat Manager Application\"");
 %>
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
 <html>
  <head>
   <title>401 Unauthorized</title>
-  <style>
+  <style type="text/css">
     <!--
     BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;font-size:12px;}
     H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
@@ -35,16 +36,45 @@
     You are not authorized to view this page. If you have not changed
     any configuration files, please examine the file
     <tt>conf/tomcat-users.xml</tt> in your installation. That
-    file will contain the credentials to let you use this webapp.
+    file must contain the credentials to let you use this webapp.
    </p>
    <p>
-    You will need to add <tt>manager</tt> role to the config file listed above.
-    For example:
+    For example, to add the <tt>manager-gui</tt> role to a user named
+    <tt>tomcat</tt> with a password of <tt>s3cret</tt>, add the following to the
+    config file listed above.
+   </p>
 <pre>
-&lt;role rolename="manager"/&gt;
-&lt;user username="tomcat" password="s3cret" roles="manager"/&gt;
+&lt;role rolename="manager-gui"/&gt;
+&lt;user username="tomcat" password="s3cret" roles="manager-gui"/&gt;
 </pre>
+   <p>
+    Note that for Tomcat with generic CSRF protection, the roles required to use the manager
+    application were changed from the single <tt>manager</tt> role to the
+    following four roles. You will need to assign the role(s) required for
+    the functionality you wish to access.
+   </p>
+    <ul>
+      <li><tt>manager-gui</tt> - allows access to the HTML GUI and the status
+          pages</li>
+      <li><tt>manager-script</tt> - allows access to the text interface and the
+          status pages</li>
+      <li><tt>manager-jmx</tt> - allows access to the JMX proxy and the status
+          pages</li>
+      <li><tt>manager-status</tt> - allows access to the status pages only</li>
+    </ul>
+   <p>
+    The HTML interface is protected against CSRF but the text and JMX interfaces
+    are not. To maintain the CSRF protection:
    </p>
+   <ul>
+    <li>The deprecated <tt>manager</tt> role should not be assigned to any
+        user.</li>
+    <li>Users with the <tt>manager-gui</tt> role should not be granted either
+        the <tt>manager-script</tt> or <tt>manager-jmx</tt> roles.</li>
+    <li>If the text or jmx interfaces are accessed through a browser (e.g. for
+        testing since these interfaces are intended for tools not humans) then
+        the browser must be closed afterwards to terminate the session.</li>
+   </ul>
    <p>
     For more information - please see the
     <a href="/docs/manager-howto.html">Manager App HOW-TO</a>.
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/manager/403.jsp
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/manager/403.jsp	2012-01-06 09:51:03.604818172 +0100
@@ -0,0 +1,98 @@
+<%--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+--%>
+<%
+  response.setHeader("WWW-Authenticate", "Basic realm=\"Tomcat Manager Application\"");
+%>
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+ <head>
+  <title>403 Access Denied</title>
+  <style type="text/css">
+    <!--
+    BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;font-size:12px;}
+    H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;}
+    PRE, TT {border: 1px dotted #525D76}
+    A {color : black;}A.name {color : black;}
+    -->
+  </style>
+ </head>
+ <body>
+   <h1>403 Access Denied</h1>
+   <p>
+    You are not authorized to view this page.
+   </p>
+   <p>
+    If you have already configured the Manager application to allow access and
+    you have used your browser's back button, used a saved book-mark or similar
+    then you may have triggered the cross-site request forgery (CSRF) protection
+    that has been enabled for the HTML interface of the Manager application. You
+    will need to reset this protection by returning to the 
+    <a href="<%=request.getContextPath()%>/html">main Manager page</a>. Once you
+    return to this page, you will be able to continue using the Manager
+    appliction's HTML interface normally. If you continue to see this access
+    denied message, check that you have the necessary permissions to access this
+    application.
+   </p>
+   <p>
+    If you have not changed
+    any configuration files, please examine the file
+    <tt>conf/tomcat-users.xml</tt> in your installation. That
+    file must contain the credentials to let you use this webapp.
+   </p>
+   <p>
+    For example, to add the <tt>manager-gui</tt> role to a user named
+    <tt>tomcat</tt> with a password of <tt>s3cret</tt>, add the following to the
+    config file listed above.
+   </p>
+<pre>
+&lt;role rolename="manager-gui"/&gt;
+&lt;user username="tomcat" password="s3cret" roles="manager-gui"/&gt;
+</pre>
+   <p>
+    Note that for Tomcat with generic CSRF protection, the roles required to use the manager
+    application were changed from the single <tt>manager</tt> role to add the
+    following four roles. (The manager role is still available but should not be
+    used as it avoids the CSRF protection). You will need to assign the role(s)
+    required for the functionality you wish to access.
+   </p>
+    <ul>
+      <li><tt>manager-gui</tt> - allows access to the HTML GUI and the status
+          pages</li>
+      <li><tt>manager-script</tt> - allows access to the text interface and the
+          status pages</li>
+      <li><tt>manager-jmx</tt> - allows access to the JMX proxy and the status
+          pages</li>
+      <li><tt>manager-status</tt> - allows access to the status pages only</li>
+    </ul>
+   <p>
+    The HTML interface is protected against CSRF but the text and JMX interfaces
+    are not. To maintain the CSRF protection:
+   </p>
+   <ul>
+    <li>users with the <tt>manager-gui</tt> role should not be granted either
+        the <tt>manager-script</tt> or <tt>manager-jmx</tt> roles.</li>
+    <li>if the text or jmx interfaces are accessed through a browser (e.g. for
+         testing since these interfaces are intended for tools not humans) then
+         the browser must be closed afterwards to terminate the session.</li>
+   </ul>
+   <p>
+    For more information - please see the
+    <a href="/docs/manager-howto.html">Manager App HOW-TO</a>.
+   </p>
+ </body>
+
+</html>
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/manager/sessionDetail.jsp
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/webapps/manager/sessionDetail.jsp	2012-01-06 09:50:29.000000000 +0100
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/manager/sessionDetail.jsp	2012-01-06 09:51:03.613818483 +0100
@@ -88,7 +88,14 @@
   </tr>
 </table>
 
-<p style="text-align: center;"><button type="button" onclick="window.location.reload()">Refresh</button></p>
+<form method="post" action="<%= submitUrl %>">
+  <div>
+    <input type="hidden" name="path" value="<%= path %>" />
+    <input type="hidden" name="sessionId" value="<%= currentSessionId %>" />
+    <input type="hidden" name="action" value="sessionDetail" />
+    <input type="submit" value="Refresh" />
+  </div>
+</form>
 
 <div class="error"><%= JspHelper.escapeXml(request.getAttribute("error")) %></div>
 <div class="message"><%= JspHelper.escapeXml(request.getAttribute("message")) %></div>
@@ -121,16 +128,31 @@
    while (attributeNamesEnumeration.hasMoreElements()) {
    	String attributeName = (String) attributeNamesEnumeration.nextElement();
 %>
-		<tr>
-			<td align="center"><form action="<%= submitUrl %>"><div><input type="hidden" name="action" value="removeSessionAttribute" /><input type="hidden" name="sessionId" value="<%= currentSessionId %>" /><input type="hidden" name="attributeName" value="<%= attributeName %>" /><input type="submit" value="Remove" /></div></form></td>
-			<td><%= JspHelper.escapeXml(attributeName) %></td>
-			<td><% Object attributeValue = currentHttpSession.getAttribute(attributeName); %><span title="<%= attributeValue == null ? "" : attributeValue.getClass().toString() %>"><%= JspHelper.escapeXml(attributeValue) %></span></td>
-		</tr>
+        <tr>
+            <td align="center">
+                <form method="post" action="<%= submitUrl %>">
+                    <div>
+                        <input type="hidden" name="path" value="<%= path %>" />
+                        <input type="hidden" name="action" value="removeSessionAttribute" />
+                        <input type="hidden" name="sessionId" value="<%= currentSessionId %>" />
+                        <input type="hidden" name="attributeName" value="<%= attributeName %>" />
+                        <input type="submit" value="Remove" />
+                    </div>
+                </form>
+            </td>
+            <td><%= JspHelper.escapeXml(attributeName) %></td>
+            <td><% Object attributeValue = currentHttpSession.getAttribute(attributeName); %><span title="<%= attributeValue == null ? "" : attributeValue.getClass().toString() %>"><%= JspHelper.escapeXml(attributeValue) %></span></td>
+        </tr>
 <% } // end while %>
 	</tbody>
 </table>
 
-<p style="text-align: center;"><button type="button" onclick="window.close()">Close window</button></p>
+<form method="post" action="<%=submitUrl%>">
+  <p style="text-align: center;">
+    <input type="hidden" name="path" value="<%= path %>" />
+    <input type="submit" value="Return to session list" />
+  </p>
+</form>
 
 <%--div style="display: none;">
 <p>
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/manager/sessionsList.jsp
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/webapps/manager/sessionsList.jsp	2012-01-06 09:50:30.000000000 +0100
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/manager/sessionsList.jsp	2012-01-06 09:51:03.621818760 +0100
@@ -101,7 +101,7 @@
 %>
 				<tr>
 					<td>
-<input type="checkbox" name="sessionIds" value="<%= currentSessionId %>" /><a href="<%= submitUrl %>&amp;action=sessionDetail&amp;sessionId=<%= currentSessionId %>" target="_new"><%= currentSessionId %></a>
+<input type="checkbox" name="sessionIds" value="<%= currentSessionId %>" /><a href="<%= submitUrl %>&amp;action=sessionDetail&amp;sessionId=<%= currentSessionId %>"><%= JspHelper.escapeXml(currentSessionId) %></a>
 					</td>
 					<td style="text-align: center;"><%= JspHelper.guessDisplayLocaleFromSession(currentSession) %></td>
 					<td style="text-align: center;"><%= JspHelper.guessDisplayUserFromSession(currentSession) %></td>
@@ -120,7 +120,11 @@
 	</fieldset>
 </form>
 
-<p style="text-align: center;"><button type="button" onclick="window.close()">Close window</button></p>
+<form method="get" action="<%=request.getContextPath()%>/html">
+  <p style="text-align: center;">
+    <input type="submit" value="Return to main page" />
+  </p>
+</form>
 
 <%--div style="display: none;">
 <p>
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/manager/WEB-INF/web.xml
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/webapps/manager/WEB-INF/web.xml	2008-07-22 02:01:28.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/webapps/manager/WEB-INF/web.xml	2012-01-06 09:51:03.622818795 +0100
@@ -27,12 +27,6 @@
     Manager lets you view, load/unload/etc particular web applications.
   </description>
 
-  <!-- Define the Manager Servlet
-       Change servlet-class to: org.apache.catalina.servlets.HTMLManagerServlet
-       to get a Servlet with a more intuitive HTML interface, don't change if you
-       have software that is expected to parse the output from ManagerServlet
-       since they're not compatible.
-   -->
   <servlet>
     <servlet-name>Manager</servlet-name>
     <servlet-class>org.apache.catalina.manager.ManagerServlet</servlet-class>
@@ -133,6 +127,20 @@
     <url-pattern>/html/*</url-pattern>
   </servlet-mapping>
 
+  <filter>
+    <filter-name>CSRF</filter-name>
+    <filter-class>org.apache.catalina.filters.CsrfPreventionFilter</filter-class>
+    <init-param>
+      <param-name>entryPoints</param-name>
+      <param-value>/html,/html/,/html/list</param-value>
+    </init-param>
+  </filter>
+
+  <filter-mapping>
+    <filter-name>CSRF</filter-name>
+    <servlet-name>HTMLManager</servlet-name>
+  </filter-mapping>
+
   <!-- Define reference to the user database for looking up roles -->
   <resource-env-ref>
     <description>
@@ -150,9 +158,7 @@
   <!-- Define a Security Constraint on this Application -->
   <security-constraint>
     <web-resource-collection>
-      <web-resource-name>HTMLManger and Manager command</web-resource-name>
-      <url-pattern>/jmxproxy/*</url-pattern>
-      <url-pattern>/html/*</url-pattern>
+      <web-resource-name>Manager commands</web-resource-name>
       <url-pattern>/list</url-pattern>
       <url-pattern>/expire</url-pattern>
       <url-pattern>/sessions</url-pattern>
@@ -165,12 +171,71 @@
       <url-pattern>/reload</url-pattern>
       <url-pattern>/save</url-pattern>
       <url-pattern>/serverinfo</url-pattern>
-      <url-pattern>/status/*</url-pattern>
       <url-pattern>/roles</url-pattern>
       <url-pattern>/resources</url-pattern>
     </web-resource-collection>
     <auth-constraint>
-       <!-- NOTE:  This role is not present in the default users file -->
+       <!-- NOTE: 1. These roles are not present in the default users file
+                  2. The manager role is deprecated, it will be removed in
+                     Tomcat 7.
+                  3. Use the manager-script role to take advantage of the new
+                     CSRF protection. Using the manager role or assigning both
+                     the manager-script and manager-gui roles to the same user
+                     will bypass the CSRF protection. -->
+       <role-name>manager-script</role-name>
+       <role-name>manager</role-name>
+    </auth-constraint>
+  </security-constraint>
+
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>HTML Manager commands</web-resource-name>
+      <url-pattern>/html/*</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+       <!-- NOTE: 1. These roles are not present in the default users file
+                  2. The manager role is deprecated, it will be removed in
+                     Tomcat 7.
+                  3. Use just the manager-gui role to take advantage of the new
+                     CSRF protection. Assigning the manager role or manager-gui
+                     role along with either the manager-script or manager-jmx
+                     roles to the same user will bypass the CSRF protection. -->
+       <role-name>manager-gui</role-name>
+       <role-name>manager</role-name>
+    </auth-constraint>
+  </security-constraint>
+
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>JMX proxy</web-resource-name>
+      <url-pattern>/jmxproxy/*</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+       <!-- NOTE: 1. These roles are not present in the default users file
+                  2. The manager role is deprecated, it will be removed in
+                     Tomcat 7.
+                  3. Use the manager-jmx role to take advantage of the new
+                     CSRF protection. Using the manager role or assigning both
+                     the manager-jmx and manager-gui roles to the same user
+                     will bypass the CSRF protection. -->
+       <role-name>manager-jmx</role-name>
+       <role-name>manager</role-name>
+    </auth-constraint>
+  </security-constraint>
+
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>Status</web-resource-name>
+      <url-pattern>/status/*</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+       <!-- NOTE: 1. These roles are not present in the default users file
+                  2. The manager role is deprecated, it will be removed in
+                     Tomcat 7. -->
+       <role-name>manager-status</role-name>
+       <role-name>manager-gui</role-name>
+       <role-name>manager-script</role-name>
+       <role-name>manager-jmx</role-name>
        <role-name>manager</role-name>
     </auth-constraint>
   </security-constraint>
@@ -184,7 +249,31 @@
   <!-- Security roles referenced by this web application -->
   <security-role>
     <description>
-      The role that is required to log in to the Manager Application
+      The role that is required to access the HTML Manager pages
+    </description>
+    <role-name>manager-gui</role-name>
+  </security-role>
+  <security-role>
+    <description>
+      The role that is required to access the text Manager pages
+    </description>
+    <role-name>manager-script</role-name>
+  </security-role>
+  <security-role>
+    <description>
+      The role that is required to access the HTML JMX Proxy
+    </description>
+    <role-name>manager-jmx</role-name>
+  </security-role>
+  <security-role>
+    <description>
+      The role that is required to access to the Manager Status pages 
+    </description>
+    <role-name>manager-status</role-name>
+  </security-role>
+  <security-role>
+    <description>
+      Deprecated role that can access all Manager functionality
     </description>
     <role-name>manager</role-name>
   </security-role>
@@ -193,5 +282,9 @@
     <error-code>401</error-code>
     <location>/401.jsp</location>
   </error-page>
+  <error-page>
+    <error-code>403</error-code>
+    <location>/403.jsp</location>
+  </error-page>
 
 </web-app>
