CVE-2014-8115: Permissions, Privileges, and Access Controls (CWE-264)
value: The default authorization constrains in KIE Workbench 6.0.x allows remote authenticated users to read or write to arbitrary files, bypass intended access restrictions, and possibly have other unspecified impact via unknown vectors.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2015-02-20T16:59Z
Repository: https://github.com/droolsjbpm/kie-wb-distributions
Language: XML
Files changed: kie-drools-wb/kie-drools-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml, kie-drools-wb/kie-drools-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml, kie-drools-wb/kie-drools-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml, kie-drools-wb/kie-drools-wb-distribution-wars/src/main/was8/WEB-INF/web.xml, kie-drools-wb/kie-drools-wb-webapp/src/main/webapp/WEB-INF/web.xml, kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-exec-server.xml, kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-ui-server.xml, kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml, kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-exec-server.xml, kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-ui-server.xml, kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml, kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-exec-server.xml, kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-ui-server.xml, kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml, kie-wb/kie-wb-distribution-wars/src/main/was8/WEB-INF/web.xml, kie-wb/kie-wb-webapp/src/main/webapp/WEB-INF/web.xml
Commit date: 2014-12-24 10:29:23 -0300
Commit message: BZ(1169544,1169556,1169557,1169559,1169560,1169545,1169566,1169565,1169563,1169562): improvements on security related to file access and servlet restrictions (by role)

Diff: diff --git a/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml b/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml
index b416248..034cd91 100644
--- a/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml
+++ b/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml
@@ -109,46 +109,86 @@
   </servlet-mapping>
 
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileUploadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileDownloadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
@@ -493,10 +533,24 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
     <mime-type>image/x-icon</mime-type>
   </mime-mapping>
   <!-- END DESIGNER -->
 
   <!-- security settings -->
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>download</web-resource-name>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+    </auth-constraint>
+  </security-constraint>
+
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>console</web-resource-name>
       <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/*</url-pattern>
       <url-pattern>*.erraiBus</url-pattern>
diff --git a/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml b/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml
index b4d6c36..cd82341 100644
--- a/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml
+++ b/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml
@@ -108,46 +108,86 @@
   </servlet-mapping>
 
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileUploadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileDownloadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
@@ -492,10 +532,24 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
     <mime-type>image/x-icon</mime-type>
   </mime-mapping>
   <!-- END DESIGNER -->
 
   <!-- security settings -->
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>download</web-resource-name>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+    </auth-constraint>
+  </security-constraint>
+
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>console</web-resource-name>
       <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/*</url-pattern>
       <url-pattern>*.erraiBus</url-pattern>
diff --git a/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml b/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml
index 5be438f..e9cd462 100644
--- a/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml
+++ b/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml
@@ -141,46 +141,86 @@
   </servlet-mapping>
 
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileUploadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileDownloadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
@@ -537,10 +577,24 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
   <welcome-file-list>
     <welcome-file>index.jsp</welcome-file>
   </welcome-file-list>
   <!-- TOMCAT-JEE-SECURITY -->
   <!--
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>download</web-resource-name>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+    </auth-constraint>
+  </security-constraint>
+
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>console</web-resource-name>
       <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/*</url-pattern>
     </web-resource-collection>
diff --git a/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/was8/WEB-INF/web.xml b/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/was8/WEB-INF/web.xml
index c796da4..b6e09de 100644
--- a/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/was8/WEB-INF/web.xml
+++ b/kie-drools-wb/kie-drools-wb-distribution-wars/src/main/was8/WEB-INF/web.xml
@@ -101,46 +101,86 @@
   </servlet-mapping>
 
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileUploadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileDownloadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
@@ -485,10 +525,24 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
     <mime-type>image/x-icon</mime-type>
   </mime-mapping>
   <!-- END DESIGNER -->
 
   <!-- security settings -->
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>download</web-resource-name>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
+      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+    </auth-constraint>
+  </security-constraint>
+
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>console</web-resource-name>
       <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/*</url-pattern>
       <url-pattern>*.erraiBus</url-pattern>
diff --git a/kie-drools-wb/kie-drools-wb-webapp/src/main/webapp/WEB-INF/web.xml b/kie-drools-wb/kie-drools-wb-webapp/src/main/webapp/WEB-INF/web.xml
index a9c3000..64f77be 100644
--- a/kie-drools-wb/kie-drools-wb-webapp/src/main/webapp/WEB-INF/web.xml
+++ b/kie-drools-wb/kie-drools-wb-webapp/src/main/webapp/WEB-INF/web.xml
@@ -74,19 +74,35 @@
 
 
   <servlet>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileUploadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileDownloadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
   </servlet-mapping>
@@ -166,28 +182,52 @@ profile in pom.xml to use that. -->
   </servlet-mapping>
 
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
diff --git a/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-exec-server.xml b/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-exec-server.xml
index 04e712e..dc3cac3 100644
--- a/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-exec-server.xml
+++ b/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-exec-server.xml
@@ -70,10 +70,18 @@ Their default values are shown as example param-values -->
   </context-param>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
diff --git a/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-ui-server.xml b/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-ui-server.xml
index 8349f67..a2c3b33 100644
--- a/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-ui-server.xml
+++ b/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web-ui-server.xml
@@ -96,28 +96,52 @@
 
   <!-- drools-wb servlets -->
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
@@ -474,10 +498,25 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
   </servlet-mapping>
   <!-- end form-modeler-->
 
   <!-- security settings -->
 
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>download</web-resource-name>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+      <role-name>developer</role-name>
+    </auth-constraint>
+  </security-constraint>
+
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>console</web-resource-name>
       <url-pattern>/org.kie.workbench.KIEWebapp/*</url-pattern>
       <url-pattern>*.erraiBus</url-pattern>
diff --git a/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml b/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml
index 458dcb8..28eaf74 100644
--- a/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml
+++ b/kie-wb/kie-wb-distribution-wars/src/main/eap6_1/WEB-INF/web.xml
@@ -110,46 +110,86 @@
 
   <!-- drools-wb servlets -->
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileUploadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileDownloadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
@@ -506,10 +546,24 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
     <url-pattern>/org.kie.workbench.KIEWebapp/Controller</url-pattern>
   </servlet-mapping>
   <!-- end form-modeler-->
 
   <!-- security settings -->
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>download</web-resource-name>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+      <role-name>developer</role-name>
+    </auth-constraint>
+  </security-constraint>
 
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>console</web-resource-name>
       <url-pattern>/org.kie.workbench.KIEWebapp/*</url-pattern>
diff --git a/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-exec-server.xml b/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-exec-server.xml
index 04e712e..dc3cac3 100644
--- a/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-exec-server.xml
+++ b/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-exec-server.xml
@@ -70,10 +70,18 @@ Their default values are shown as example param-values -->
   </context-param>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
diff --git a/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-ui-server.xml b/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-ui-server.xml
index d30d507..b16ad81 100644
--- a/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-ui-server.xml
+++ b/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web-ui-server.xml
@@ -96,28 +96,52 @@
 
   <!-- drools-wb servlets -->
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
@@ -474,10 +498,25 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
   </servlet-mapping>
   <!-- end form-modeler-->
 
   <!-- security settings -->
 
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>download</web-resource-name>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+      <role-name>developer</role-name>
+    </auth-constraint>
+  </security-constraint>
+
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>console</web-resource-name>
       <url-pattern>/org.kie.workbench.KIEWebapp/*</url-pattern>
       <url-pattern>*.erraiBus</url-pattern>
diff --git a/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml b/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml
index fee4c96..750fdc2 100644
--- a/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml
+++ b/kie-wb/kie-wb-distribution-wars/src/main/jbossas7/WEB-INF/web.xml
@@ -62,11 +62,11 @@
     <url-pattern>/transformer</url-pattern>
     <url-pattern>/assetservice</url-pattern>
     <url-pattern>/filestore</url-pattern>
     <url-pattern>/dictionary</url-pattern>
     <url-pattern>/themes</url-pattern>
-    <url-pattern>/customeditors </url-pattern>
+    <url-pattern>/customeditors</url-pattern>
     <url-pattern>/simulation</url-pattern>
     <url-pattern>/formwidget</url-pattern>
     <url-pattern>/calledelement</url-pattern>
     <url-pattern>/stencilpatterns</url-pattern>
     <url-pattern>/jbpmservicerepo</url-pattern>
@@ -110,46 +110,86 @@
 
   <!-- drools-wb servlets -->
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileUploadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileDownloadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
@@ -507,10 +547,25 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
   </servlet-mapping>
   <!-- end form-modeler-->
 
   <!-- security settings -->
 
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>download</web-resource-name>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+      <role-name>developer</role-name>
+    </auth-constraint>
+  </security-constraint>
+
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>console</web-resource-name>
       <url-pattern>/org.kie.workbench.KIEWebapp/*</url-pattern>
       <url-pattern>*.erraiBus</url-pattern>
@@ -522,23 +577,23 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
       <role-name>user</role-name>
       <role-name>manager</role-name>
     </auth-constraint>
   </security-constraint>
 
-    <security-constraint>
-        <web-resource-collection>
-          <web-resource-name>formModeler</web-resource-name>
-          <url-pattern>/formModeler/*</url-pattern>
-        </web-resource-collection>
-        <auth-constraint>
-          <role-name>admin</role-name>
-          <role-name>analyst</role-name>
-          <role-name>developer</role-name>
-          <role-name>user</role-name>
-          <role-name>manager</role-name>
-        </auth-constraint>
-    </security-constraint>
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>formModeler</web-resource-name>
+      <url-pattern>/formModeler/*</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+      <role-name>developer</role-name>
+      <role-name>user</role-name>
+      <role-name>manager</role-name>
+    </auth-constraint>
+  </security-constraint>
 
   <login-config>
     <auth-method>FORM</auth-method>
     <form-login-config>
       <form-login-page>/login.jsp</form-login-page>
@@ -579,31 +634,31 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
     <role-name>user</role-name>
   </security-role>
 
   <security-role>
     <description>Manager/Viewer-only User - Viewer of the system that is interested in statistics
-      around the  business processes and their performance, business indicators, and other
+      around the business processes and their performance, business indicators, and other
       reporting of the system and people who interact with the system.
     </description>
     <role-name>manager</role-name>
   </security-role>
 
   <error-page>
     <error-code>403</error-code>
     <location>/not_authorized.jsp</location>
   </error-page>
-  
+
   <context-param>
     <param-name>resteasy.document.expand.entity.references</param-name>
     <param-value>false</param-value>
   </context-param>
- 
+
   <filter>
     <filter-name>Dynamic JAXBContext Filter</filter-name>
     <filter-class>org.kie.remote.services.rest.jaxb.DynamicJaxbContextFilter</filter-class>
   </filter>
   <filter-mapping>
     <filter-name>Dynamic JAXBContext Filter</filter-name>
     <url-pattern>/rest/*</url-pattern>
-  </filter-mapping> 
-   
+  </filter-mapping>
+
 </web-app>
\ No newline at end of file
diff --git a/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-exec-server.xml b/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-exec-server.xml
index 7dea4ac..4a05b97 100644
--- a/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-exec-server.xml
+++ b/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-exec-server.xml
@@ -113,10 +113,18 @@
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
diff --git a/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-ui-server.xml b/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-ui-server.xml
index e2b00b6..37acbba 100644
--- a/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-ui-server.xml
+++ b/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web-ui-server.xml
@@ -114,28 +114,52 @@
 
   <!-- drools-wb servlets -->
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
@@ -512,10 +536,25 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
     <res-auth>Container</res-auth>
   </resource-ref>
 
   <!-- TOMCAT-JEE-SECURITY -->
   <!--
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>download</web-resource-name>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+      <role-name>developer</role-name>
+    </auth-constraint>
+  </security-constraint>
+
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>console</web-resource-name>
       <url-pattern>/org.kie.workbench.KIEWebapp/*</url-pattern>
       <url-pattern>*.erraiBus</url-pattern>
diff --git a/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml b/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml
index dc77580..b1e3d30 100644
--- a/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml
+++ b/kie-wb/kie-wb-distribution-wars/src/main/tomcat7/WEB-INF/web.xml
@@ -150,46 +150,86 @@
 
   <!-- drools-wb servlets -->
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileUploadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileDownloadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
@@ -565,10 +605,25 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
     <res-auth>Container</res-auth>
   </resource-ref>
 
   <!-- TOMCAT-JEE-SECURITY -->
   <!--
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>download</web-resource-name>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+      <role-name>developer</role-name>
+    </auth-constraint>
+  </security-constraint>
+
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>console</web-resource-name>
       <url-pattern>/org.kie.workbench.KIEWebapp/*</url-pattern>
       <url-pattern>*.erraiBus</url-pattern>
diff --git a/kie-wb/kie-wb-distribution-wars/src/main/was8/WEB-INF/web.xml b/kie-wb/kie-wb-distribution-wars/src/main/was8/WEB-INF/web.xml
index e70a458..f366850 100644
--- a/kie-wb/kie-wb-distribution-wars/src/main/was8/WEB-INF/web.xml
+++ b/kie-wb/kie-wb-distribution-wars/src/main/was8/WEB-INF/web.xml
@@ -98,46 +98,86 @@
 
   <!-- drools-wb servlets -->
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileUploadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileDownloadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>
@@ -495,10 +535,25 @@ See http://www.w3.org/TR/SVG/intro.html#MIMEType. -->
   </servlet-mapping>
   <!-- end form-modeler-->
 
   <!-- security settings -->
 
+  <security-constraint>
+    <web-resource-collection>
+      <web-resource-name>download</web-resource-name>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
+      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
+    </web-resource-collection>
+    <auth-constraint>
+      <role-name>admin</role-name>
+      <role-name>analyst</role-name>
+      <role-name>developer</role-name>
+    </auth-constraint>
+  </security-constraint>
+
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>console</web-resource-name>
       <url-pattern>/org.kie.workbench.KIEWebapp/*</url-pattern>
       <url-pattern>*.erraiBus</url-pattern>
diff --git a/kie-wb/kie-wb-webapp/src/main/webapp/WEB-INF/web.xml b/kie-wb/kie-wb-webapp/src/main/webapp/WEB-INF/web.xml
index fd0ac9f..ea53656 100644
--- a/kie-wb/kie-wb-webapp/src/main/webapp/WEB-INF/web.xml
+++ b/kie-wb/kie-wb-webapp/src/main/webapp/WEB-INF/web.xml
@@ -130,47 +130,87 @@
 
 
   <servlet>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileUploadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileUploadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <servlet-class>org.uberfire.server.FileDownloadServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>UberfireFileDownloadServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
   </servlet-mapping>
 
   <!-- drools-wb servlets -->
   <servlet>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.dtablexls.backend.server.DecisionTableXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>DTableXLSFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <servlet-class>org.drools.workbench.screens.scorecardxls.backend.server.ScoreCardXLSFileServlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>ScoreCardFileServlet</servlet-name>
     <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
   </servlet-mapping>
 
   <servlet>
     <servlet-name>M2Servlet</servlet-name>
     <servlet-class>org.guvnor.m2repo.backend.server.M2Servlet</servlet-class>
+    <init-param>
+      <param-name>includes-path</param-name>
+      <param-value>git://**,default://**</param-value>
+    </init-param>
+    <init-param>
+      <param-name>excludes-path</param-name>
+      <param-value>file://**</param-value>
+    </init-param>
   </servlet>
   <servlet-mapping>
     <servlet-name>M2Servlet</servlet-name>
     <url-pattern>/maven2/*</url-pattern>
   </servlet-mapping>

Vulnerable code:     <url-pattern>/customeditors </url-pattern>
    <security-constraint>
        <web-resource-collection>
          <web-resource-name>formModeler</web-resource-name>
          <url-pattern>/formModeler/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
          <role-name>admin</role-name>
          <role-name>analyst</role-name>
          <role-name>developer</role-name>
          <role-name>user</role-name>
          <role-name>manager</role-name>
        </auth-constraint>
    </security-constraint>
      around the  business processes and their performance, business indicators, and other
  
 
  </filter-mapping> 
   
Fixed code:     <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.drools.KIEDroolsWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

    <url-pattern>/customeditors</url-pattern>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

  <security-constraint>
    <web-resource-collection>
      <web-resource-name>formModeler</web-resource-name>
      <url-pattern>/formModeler/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
      <role-name>user</role-name>
      <role-name>manager</role-name>
    </auth-constraint>
  </security-constraint>
      around the business processes and their performance, business indicators, and other


  </filter-mapping>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>download</web-resource-name>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/upload/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/defaulteditor/download/*</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/dtablexls/file</url-pattern>
      <url-pattern>/org.kie.workbench.KIEWebapp/scorecardxls/file</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
      <role-name>analyst</role-name>
      <role-name>developer</role-name>
    </auth-constraint>
  </security-constraint>

    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>
    <init-param>
      <param-name>includes-path</param-name>
      <param-value>git://**,default://**</param-value>
    </init-param>
    <init-param>
      <param-name>excludes-path</param-name>
      <param-value>file://**</param-value>
    </init-param>