identity: Fix erronous log statement.
Correct XSS attack vector in i18n usage.

Unfortunately the Grails provided <g:message> tag and
g.message() function do not encode their output to HTML by default.

This had previously gone unchecked within FR. This commit sets all
usages of message to use encodeAs HTML except for 3 manually approved
locations (org/idp/sp create message) that does not output any user
supplied data.

The messages within i18n properties have also been cleaned and all
markup removed sans the 3 cases above.
Correct XSS attack vector in flash messages.

Code to output flash messages was incorrectly printing the messages
without HTML encoding.
Correct error with radioGroup and HTML encoding.

With additional HTML encoding checks g:radioGroup was not functioning.
Changed to manually rendering of radio group HTML.
Correct XSS attack vector in reporting parsing.

Reports where simply appending names of O, IdP and SP to output.
Where someone malicious had managed to get XSS into the displayName
field of these objects the vuln could be triggered.
Correct low level framework XSS vulnerabilities.

Even with FR doing the right thing Grails 2.1.0 has vulnerabilities
of its own per http://jira.grails.org/browse/GRAILS-9247 which are
being triggered within the application.

This code upgrades the application to Grails 2.1.4 which corrects
the underlying grails fault.
Add further protection against XSS via defaults.

grails.views.default.codec - Sets the default encoding regime for
GSPs - can be one of 'none', 'html', or 'base64' (default: 'none').
To reduce risk of XSS attacks, set this to 'html'.

This commit changes our usage to 'html' across the project.
Ensure login error echo screen correctly encodes headers + values.
Ensure FR Tags correctly encode output.
Provide generic request and response verification/management.

Ensures that incoming requests for types POST, PUT, DELETE are
undertaken with a refer that is the local server to lower CSRF risks.

Ensures that all outbound requests are not cached as we run over SSL
and that OWASP recommended anti clickjaking headers are provided
as our app should never be embedded in a frame elsewhere.
Add CSRF tokens to core forms.

Adds csrf token checks to our core registration forms
for O, IdP and SP.

At this time other forms internal to the app are using javascript
submission. Setting and updating tokens on these type of form is not
currently supported. We'd need to review how this is handled much more
closely to support these forms.

While not foolproof referer checks which are being carried out in the
filter should provide some protection for these non token providing
forms.
Removing brittle workflow tests.

These tests are constantly breaking with even minor grails version
changes.

Corrected cases are present in AAF Base and will be utilised again
once FR is ported to that environment.
Losen certificate requirements.

Due to constant conflicts particuarly with SP that operate outside
of the AAF we are relaxing requirements of provided certificates.

Both wildcard and non subject matching entityID certs are now accepted
by FR.
Support shibmd:scope regexp as being true.

Allow FR to assert that scopes supplied for an organization are
formatted using a regular expression. Does a basic check for common
regexp patters in supplied scope and sets to true if they found.
Fix spelling mistake.

Closes #108.
Shows correct workflow submitter details.

Closes #105.
Fix utilization report bug.

Since upgrading to Grails 2.1.4 java.util.ArrayList doesn't seem
to work correctly with Groovy find{}. These changes introduce a for
loop to approximate that functionality.
Apply encodeAs fixes to Branding example.

Ensure that no potential XSS vulns can be introduced by use of
g:message in deployer provided branding.
Project: Upgrade underlying Grails to 2.2.0 from 2.1.4.
UI: Remove Grails version from footer