Merge branch 'release/2.1.3' into develop
Merge branch 'hotfix/base_test_cases' into develop
identity: Correctly handles headers/attributes with no data.

Closes #82.

In the case that a header/attribute is being checked by FR but there is no data supplied by the IdP a NPE is being thrown as we jump straight to getBytes without ensuring data is present first. This commit performs stricter checking for this case.
foundation: Shows correct subject in attribute workflow.

Closes #84.
setup: Added missing requestedattribute_delete script.
app: Updated example to use JNDI FEDERATIONREGISTRY2 per documentation examples.
branding: Change naming from monitoring to status per business request.
foundation: Correct contact search on email address.

Closes #85.

Updated criteria to stop referencing FR 1.x MailURI and correctly
reference email directly in contact object as strong as is
FR 2 method.
identity: Fix erronous log statement.
Correct XSS attack vector in i18n usage.

Unfortunately the Grails provided <g:message> tag and
g.message() function do not encode their output to HTML by default.

This had previously gone unchecked within FR. This commit sets all
usages of message to use encodeAs HTML except for 3 manually approved
locations (org/idp/sp create message) that does not output any user
supplied data.

The messages within i18n properties have also been cleaned and all
markup removed sans the 3 cases above.
Correct XSS attack vector in flash messages.

Code to output flash messages was incorrectly printing the messages
without HTML encoding.
Correct error with radioGroup and HTML encoding.

With additional HTML encoding checks g:radioGroup was not functioning.
Changed to manually rendering of radio group HTML.
Correct XSS attack vector in reporting parsing.

Reports where simply appending names of O, IdP and SP to output.
Where someone malicious had managed to get XSS into the displayName
field of these objects the vuln could be triggered.
Correct low level framework XSS vulnerabilities.

Even with FR doing the right thing Grails 2.1.0 has vulnerabilities
of its own per http://jira.grails.org/browse/GRAILS-9247 which are
being triggered within the application.

This code upgrades the application to Grails 2.1.4 which corrects
the underlying grails fault.
Add further protection against XSS via defaults.

grails.views.default.codec - Sets the default encoding regime for
GSPs - can be one of 'none', 'html', or 'base64' (default: 'none').
To reduce risk of XSS attacks, set this to 'html'.

This commit changes our usage to 'html' across the project.
Ensure login error echo screen correctly encodes headers + values.
Ensure FR Tags correctly encode output.
Provide generic request and response verification/management.

Ensures that incoming requests for types POST, PUT, DELETE are
undertaken with a refer that is the local server to lower CSRF risks.

Ensures that all outbound requests are not cached as we run over SSL
and that OWASP recommended anti clickjaking headers are provided
as our app should never be embedded in a frame elsewhere.
Add CSRF tokens to core forms.

Adds csrf token checks to our core registration forms
for O, IdP and SP.

At this time other forms internal to the app are using javascript
submission. Setting and updating tokens on these type of form is not
currently supported. We'd need to review how this is handled much more
closely to support these forms.

While not foolproof referer checks which are being carried out in the
filter should provide some protection for these non token providing
forms.
Removing brittle workflow tests.

These tests are constantly breaking with even minor grails version
changes.

Corrected cases are present in AAF Base and will be utilised again
once FR is ported to that environment.