From: Ray Lee <rhlee@berkeley.edu>
Date: Sat, 2 Jul 2016 06:17:13 +0000 (-0700)
Subject: DRYD-22: Upgrade spring and spring security.
X-Git-Url: https://git.aero2k.de/?a=commitdiff_plain;h=3c107bd042ee218ca5b7d2019874297f3efaa813;p=tmp%2Fjakarta-migration.git

DRYD-22: Upgrade spring and spring security.
---

diff --git a/pom.xml b/pom.xml
index a1d29c7b5..c8ae0aebd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,8 +18,8 @@
 		<nuxeo.platform.version>${nuxeo.general.release}</nuxeo.platform.version>
 		<nuxeo.core.version>${nuxeo.general.release}</nuxeo.core.version>
 		<chemistry.opencmis.version.nx>0.12.0-NX2</chemistry.opencmis.version.nx>
-		<spring.version>3.0.5.RELEASE</spring.version>
-		<spring.security.version>3.0.5.RELEASE</spring.security.version>
+		<spring.version>4.3.1.RELEASE</spring.version>
+		<spring.security.version>4.1.0.RELEASE</spring.security.version>
 	</properties>
 
 	<distributionManagement>
diff --git a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml
index ca6e36183..569e3ce9a 100644
--- a/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml
+++ b/services/JaxRsServiceProvider/src/main/webapp/WEB-INF/applicationContext-security.xml
@@ -27,7 +27,7 @@
 	
     <bean id="springSecurityFilterChain"
           class="org.springframework.security.web.FilterChainProxy">
-        <sec:filter-chain-map path-type="ant">
+        <sec:filter-chain-map request-matcher="ant">
 			<!-- Exclude the resource path to public items' content from AuthN and AuthZ.  Let's us publish resources with anonymous access. -->
 			<sec:filter-chain pattern="/publicitems/*/*/content"
                               filters="none"/>
@@ -39,18 +39,18 @@
 
     <bean id="securityContextPersistenceFilter"
           class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
-        <property name='securityContextRepository'>
+        <constructor-arg>
             <bean class='org.springframework.security.web.context.HttpSessionSecurityContextRepository'>
                 <property name='allowSessionCreation' value='true' />
             </bean>
-        </property>
+        </constructor-arg>
     </bean>
 
 
     <bean id="basicAuthenticationFilter"
           class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter">
-        <property name="authenticationManager" ref="authenticationManager"/>
-        <property name="authenticationEntryPoint" ref="basicAuthenticationEntryPoint"/>
+        <constructor-arg ref="authenticationManager"/>
+        <constructor-arg ref="basicAuthenticationEntryPoint"/>
     </bean>
 
     <bean id="basicAuthenticationEntryPoint"
@@ -70,11 +70,11 @@
 
     <bean id="exTranslationFilter"
           class="org.springframework.security.web.access.ExceptionTranslationFilter">
-        <property name="authenticationEntryPoint" ref="basicAuthenticationEntryPoint"/>
+        <constructor-arg ref="basicAuthenticationEntryPoint"/>
     </bean>
 
     <sec:authentication-manager alias="authenticationManager">
-        <sec:authentication-provider ref="jaasAuthenticationProvider" user-service-ref="userDetailsService"/>
+        <sec:authentication-provider ref="jaasAuthenticationProvider"/>
     </sec:authentication-manager>
 
     <bean id="jaasAuthenticationProvider"
@@ -108,7 +108,7 @@
         <property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/>
         <!--property name="securityMetadataSource" ref="cspaceMetadataSource"/-->
         <property name="securityMetadataSource">
-            <sec:filter-security-metadata-source>
+            <sec:filter-security-metadata-source use-expressions="false">
                 <sec:intercept-url pattern="/**" access="IS_AUTHENTICATED_REMEMBERED"/>
             </sec:filter-security-metadata-source>
         </property>
@@ -116,13 +116,13 @@
 
     <bean id="httpRequestAccessDecisionManager"
           class="org.springframework.security.access.vote.AffirmativeBased">
-        <property name="allowIfAllAbstainDecisions" value="false"/>
-        <property name="decisionVoters">
+        <constructor-arg>
             <list>
                 <ref bean="roleVoter"/>
                 <ref bean="authenticatedVoter"/>
             </list>
-        </property>
+        </constructor-arg>
+        <property name="allowIfAllAbstainDecisions" value="false"/>
     </bean>
 
     <bean id="authenticatedVoter"
diff --git a/services/authentication/service/pom.xml b/services/authentication/service/pom.xml
index aa2e5cd82..8e3cf394b 100644
--- a/services/authentication/service/pom.xml
+++ b/services/authentication/service/pom.xml
@@ -72,6 +72,12 @@
             <version>${spring.security.version}</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-jdbc</artifactId>
+            <version>${spring.version}</version>
+            <scope>provided</scope>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/services/authorization-mgt/import/pom.xml b/services/authorization-mgt/import/pom.xml
index badb6134c..af0122ffc 100644
--- a/services/authorization-mgt/import/pom.xml
+++ b/services/authorization-mgt/import/pom.xml
@@ -108,6 +108,12 @@
 			<version>${spring.version}</version>
 			<scope>provided</scope>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework</groupId>
+			<artifactId>spring-beans</artifactId>
+			<version>${spring.version}</version>
+			<scope>provided</scope>
+		</dependency>
 		<dependency>
 			<groupId>aopalliance</groupId>
 			<artifactId>aopalliance</artifactId>
@@ -116,10 +122,16 @@
 		</dependency>
 		<!--dependency> <groupId>org.springframework</groupId> <artifactId>spring-tx</artifactId> 
 			<version>${spring.version}</version> <scope>provided</scope> </dependency -->
+		<dependency>
+			<groupId>org.jboss.security</groupId>
+			<artifactId>jbosssx</artifactId>
+			<version>2.0.3.SP1</version>
+			<scope>provided</scope>
+		</dependency>
 		<dependency>
 			<groupId>net.sf.ehcache</groupId>
 			<artifactId>ehcache</artifactId>
-			<version>1.6.2</version>
+			<version>2.10.2</version>
 		</dependency>
 		<dependency>
 			<groupId>mysql</groupId>
diff --git a/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/driver/AuthorizationSeedDriver.java b/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/driver/AuthorizationSeedDriver.java
index af74c698e..f005d1248 100644
--- a/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/driver/AuthorizationSeedDriver.java
+++ b/services/authorization-mgt/import/src/main/java/org/collectionspace/services/authorization/driver/AuthorizationSeedDriver.java
@@ -45,6 +45,8 @@ import org.collectionspace.services.common.storage.jpa.JpaStorageUtils;
 
 import org.hibernate.exception.ConstraintViolationException;
 
+import org.jboss.security.SimpleGroup;
+
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -52,7 +54,7 @@ import org.springframework.context.support.ClassPathXmlApplicationContext;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.GrantedAuthorityImpl;
+import org.springframework.security.authentication.jaas.JaasGrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.transaction.TransactionDefinition;
 import org.springframework.transaction.TransactionStatus;
@@ -174,8 +176,8 @@ public class AuthorizationSeedDriver {
     }
 
     private void login() {
-        //GrantedAuthority cspace_admin = new GrantedAuthorityImpl("ROLE_ADMINISTRATOR");
-        GrantedAuthority spring_security_admin = new GrantedAuthorityImpl("ROLE_SPRING_ADMIN"); //NOTE: Must match with value in applicationContext-authorization-test.xml (aka SPRING_SECURITY_METADATA)
+        //GrantedAuthority cspace_admin = new JaasGrantedAuthority("ROLE_ADMINISTRATOR", new SimpleGroup("Role"));
+        GrantedAuthority spring_security_admin = new JaasGrantedAuthority("ROLE_SPRING_ADMIN", new SimpleGroup("Role")); //NOTE: Must match with value in applicationContext-authorization-test.xml (aka SPRING_SECURITY_METADATA)
         HashSet<GrantedAuthority> gauths = new HashSet<GrantedAuthority>();
         //gauths.add(cspace_admin);
         gauths.add(spring_security_admin);
diff --git a/services/authorization-mgt/import/src/main/resources/applicationContext-authorization-test.xml b/services/authorization-mgt/import/src/main/resources/applicationContext-authorization-test.xml
index dad3b3b0f..fe73984e6 100644
--- a/services/authorization-mgt/import/src/main/resources/applicationContext-authorization-test.xml
+++ b/services/authorization-mgt/import/src/main/resources/applicationContext-authorization-test.xml
@@ -54,14 +54,13 @@
     <bean id="aclAuthorizationStrategy" class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
         <constructor-arg>
             <list>
-                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
-                    <constructor-arg value="ROLE_SPRING_ADMIN"/>
-                </bean>
-                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
-                    <constructor-arg value="ROLE_SPRING_ADMIN"/>
-                </bean>
-                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
+                <bean class="org.springframework.security.authentication.jaas.JaasGrantedAuthority">
                     <constructor-arg value="ROLE_SPRING_ADMIN"/>
+                    <constructor-arg>
+                        <bean class="org.jboss.security.SimpleGroup">
+                            <constructor-arg value="Role"/>
+                        </bean>
+                    </constructor-arg>
                 </bean>
             </list>
         </constructor-arg>
@@ -78,6 +77,14 @@
                 <property name="cacheName" value="aclCache"/>
             </bean>
         </constructor-arg>
+        <constructor-arg>
+            <bean class="org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy">
+                <constructor-arg>
+                    <bean class="org.springframework.security.acls.domain.ConsoleAuditLogger"/>
+                </constructor-arg>
+            </bean>
+        </constructor-arg>
+        <constructor-arg ref="aclAuthorizationStrategy"/>
     </bean>
 
     <bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
diff --git a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/AuthZ.java b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/AuthZ.java
index 68dff9c0e..4ba05d374 100644
--- a/services/authorization/service/src/main/java/org/collectionspace/services/authorization/AuthZ.java
+++ b/services/authorization/service/src/main/java/org/collectionspace/services/authorization/AuthZ.java
@@ -29,11 +29,12 @@ import java.util.HashSet;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.collectionspace.services.authorization.spi.CSpaceAuthorizationProvider;
+import org.jboss.security.SimpleGroup;
 import org.springframework.context.support.ClassPathXmlApplicationContext;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.GrantedAuthorityImpl;
+import org.springframework.security.authentication.jaas.JaasGrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
 
 /**
@@ -187,7 +188,7 @@ public class AuthZ {
     public void login() {
     	String user = "SPRING_ADMIN";
     	String password = "SPRING_ADMIN";
-        GrantedAuthority spring_security_admin = new GrantedAuthorityImpl("ROLE_SPRING_ADMIN"); //NOTE: Must match with value in applicationContext-authorization-test.xml (aka SPRING_SECURITY_METADATA)
+        GrantedAuthority spring_security_admin = new JaasGrantedAuthority("ROLE_SPRING_ADMIN", new SimpleGroup("Role")); //NOTE: Must match with value in applicationContext-authorization-test.xml (aka SPRING_SECURITY_METADATA)
         HashSet<GrantedAuthority> gauths = new HashSet<GrantedAuthority>();
         gauths.add(spring_security_admin);
         Authentication authRequest = new UsernamePasswordAuthenticationToken(user, password, gauths);
diff --git a/services/authorization/service/src/main/resources/applicationContext-authorization.xml b/services/authorization/service/src/main/resources/applicationContext-authorization.xml
index d92c1735a..b3f17aa41 100644
--- a/services/authorization/service/src/main/resources/applicationContext-authorization.xml
+++ b/services/authorization/service/src/main/resources/applicationContext-authorization.xml
@@ -60,14 +60,13 @@
     <bean id="aclAuthorizationStrategy" class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
         <constructor-arg>
             <list>
-                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
-                    <constructor-arg value="ROLE_SPRING_ADMIN"/>
-                </bean>
-                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
-                    <constructor-arg value="ROLE_SPRING_ADMIN"/>
-                </bean>
-                <bean class="org.springframework.security.core.authority.GrantedAuthorityImpl">
+                <bean class="org.springframework.security.authentication.jaas.JaasGrantedAuthority">
                     <constructor-arg value="ROLE_SPRING_ADMIN"/>
+                    <constructor-arg>
+                        <bean class="org.jboss.security.SimpleGroup">
+                            <constructor-arg value="Role"/>
+                        </bean>
+                    </constructor-arg>
                 </bean>
             </list>
         </constructor-arg>
@@ -84,6 +83,14 @@
                 <property name="cacheName" value="aclCache"/>
             </bean>
         </constructor-arg>
+        <constructor-arg>
+            <bean class="org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy">
+                <constructor-arg>
+                    <bean class="org.springframework.security.acls.domain.ConsoleAuditLogger"/>
+                </constructor-arg>
+            </bean>
+        </constructor-arg>
+        <constructor-arg ref="aclAuthorizationStrategy"/>
     </bean>
 
 
diff --git a/services/common/build.xml b/services/common/build.xml
index ac37e2194..a1afca65e 100644
--- a/services/common/build.xml
+++ b/services/common/build.xml
@@ -198,7 +198,8 @@
             description="undeploy spring binaries from ${jee.server.cspace}">
         <delete>
             <fileset dir="${jee.server.cspace}/lib" includes="org.springframework.*.jar"/>
-            <fileset dir="${jee.server.cspace}/lib" includes="spring-security*.jar"/>
+            <fileset dir="${jee.server.cspace}/lib" includes="spring-*.jar"/>
+            <fileset dir="${jee.server.cspace}/lib" includes="ehcache-*.jar"/>
         </delete>
     </target>
 	
diff --git a/services/common/lib/spring/ehcache-1.6.2.jar b/services/common/lib/spring/ehcache-1.6.2.jar
deleted file mode 100644
index 85a0ab428..000000000
Binary files a/services/common/lib/spring/ehcache-1.6.2.jar and /dev/null differ
diff --git a/services/common/lib/spring/ehcache-2.10.2.jar b/services/common/lib/spring/ehcache-2.10.2.jar
new file mode 100644
index 000000000..60ad56e50
Binary files /dev/null and b/services/common/lib/spring/ehcache-2.10.2.jar differ
diff --git a/services/common/lib/spring/spring-aop-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-aop-3.0.5.RELEASE.jar
deleted file mode 100644
index db6f529fd..000000000
Binary files a/services/common/lib/spring/spring-aop-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-aop-4.3.1.RELEASE.jar b/services/common/lib/spring/spring-aop-4.3.1.RELEASE.jar
new file mode 100644
index 000000000..d4903262c
Binary files /dev/null and b/services/common/lib/spring/spring-aop-4.3.1.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-asm-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-asm-3.0.5.RELEASE.jar
deleted file mode 100644
index 7cd3a6261..000000000
Binary files a/services/common/lib/spring/spring-asm-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-beans-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-beans-3.0.5.RELEASE.jar
deleted file mode 100644
index f2e2e9275..000000000
Binary files a/services/common/lib/spring/spring-beans-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-beans-4.3.1.RELEASE.jar b/services/common/lib/spring/spring-beans-4.3.1.RELEASE.jar
new file mode 100644
index 000000000..062a39c92
Binary files /dev/null and b/services/common/lib/spring/spring-beans-4.3.1.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-context-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-context-3.0.5.RELEASE.jar
deleted file mode 100644
index bd1367d8a..000000000
Binary files a/services/common/lib/spring/spring-context-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-context-4.3.1.RELEASE.jar b/services/common/lib/spring/spring-context-4.3.1.RELEASE.jar
new file mode 100644
index 000000000..8c3f5f498
Binary files /dev/null and b/services/common/lib/spring/spring-context-4.3.1.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-context-support-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-context-support-3.0.5.RELEASE.jar
deleted file mode 100644
index e46f9eb88..000000000
Binary files a/services/common/lib/spring/spring-context-support-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-context-support-4.3.1.RELEASE.jar b/services/common/lib/spring/spring-context-support-4.3.1.RELEASE.jar
new file mode 100644
index 000000000..a0509dbb6
Binary files /dev/null and b/services/common/lib/spring/spring-context-support-4.3.1.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-core-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-core-3.0.5.RELEASE.jar
deleted file mode 100644
index ea9500d6f..000000000
Binary files a/services/common/lib/spring/spring-core-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-core-4.3.1.RELEASE.jar b/services/common/lib/spring/spring-core-4.3.1.RELEASE.jar
new file mode 100644
index 000000000..fe9bd5972
Binary files /dev/null and b/services/common/lib/spring/spring-core-4.3.1.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-expression-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-expression-3.0.5.RELEASE.jar
deleted file mode 100644
index 6ef99d8d8..000000000
Binary files a/services/common/lib/spring/spring-expression-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-expression-4.3.1.RELEASE.jar b/services/common/lib/spring/spring-expression-4.3.1.RELEASE.jar
new file mode 100644
index 000000000..670769614
Binary files /dev/null and b/services/common/lib/spring/spring-expression-4.3.1.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-jdbc-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-jdbc-3.0.5.RELEASE.jar
deleted file mode 100644
index f7a3b837d..000000000
Binary files a/services/common/lib/spring/spring-jdbc-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-jdbc-4.3.1.RELEASE.jar b/services/common/lib/spring/spring-jdbc-4.3.1.RELEASE.jar
new file mode 100644
index 000000000..d68003c0a
Binary files /dev/null and b/services/common/lib/spring/spring-jdbc-4.3.1.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-orm-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-orm-3.0.5.RELEASE.jar
deleted file mode 100644
index d0550ccd5..000000000
Binary files a/services/common/lib/spring/spring-orm-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-security-acl-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-security-acl-3.0.5.RELEASE.jar
deleted file mode 100644
index 5874d96b5..000000000
Binary files a/services/common/lib/spring/spring-security-acl-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-security-acl-4.1.0.RELEASE.jar b/services/common/lib/spring/spring-security-acl-4.1.0.RELEASE.jar
new file mode 100644
index 000000000..38202c098
Binary files /dev/null and b/services/common/lib/spring/spring-security-acl-4.1.0.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-security-config-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-security-config-3.0.5.RELEASE.jar
deleted file mode 100644
index 78818fc54..000000000
Binary files a/services/common/lib/spring/spring-security-config-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-security-config-4.1.0.RELEASE.jar b/services/common/lib/spring/spring-security-config-4.1.0.RELEASE.jar
new file mode 100644
index 000000000..257428cce
Binary files /dev/null and b/services/common/lib/spring/spring-security-config-4.1.0.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-security-core-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-security-core-3.0.5.RELEASE.jar
deleted file mode 100644
index a8077d5d3..000000000
Binary files a/services/common/lib/spring/spring-security-core-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-security-core-4.1.0.RELEASE.jar b/services/common/lib/spring/spring-security-core-4.1.0.RELEASE.jar
new file mode 100644
index 000000000..d2cb459dc
Binary files /dev/null and b/services/common/lib/spring/spring-security-core-4.1.0.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-security-web-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-security-web-3.0.5.RELEASE.jar
deleted file mode 100644
index 26611b558..000000000
Binary files a/services/common/lib/spring/spring-security-web-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-security-web-4.1.0.RELEASE.jar b/services/common/lib/spring/spring-security-web-4.1.0.RELEASE.jar
new file mode 100644
index 000000000..0949291ef
Binary files /dev/null and b/services/common/lib/spring/spring-security-web-4.1.0.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-tx-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-tx-3.0.5.RELEASE.jar
deleted file mode 100644
index 2f52122ba..000000000
Binary files a/services/common/lib/spring/spring-tx-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-tx-4.3.1.RELEASE.jar b/services/common/lib/spring/spring-tx-4.3.1.RELEASE.jar
new file mode 100644
index 000000000..753bf6862
Binary files /dev/null and b/services/common/lib/spring/spring-tx-4.3.1.RELEASE.jar differ
diff --git a/services/common/lib/spring/spring-web-3.0.5.RELEASE.jar b/services/common/lib/spring/spring-web-3.0.5.RELEASE.jar
deleted file mode 100644
index 5a2381a04..000000000
Binary files a/services/common/lib/spring/spring-web-3.0.5.RELEASE.jar and /dev/null differ
diff --git a/services/common/lib/spring/spring-web-4.3.1.RELEASE.jar b/services/common/lib/spring/spring-web-4.3.1.RELEASE.jar
new file mode 100644
index 000000000..26273ec96
Binary files /dev/null and b/services/common/lib/spring/spring-web-4.3.1.RELEASE.jar differ
diff --git a/services/pom.xml b/services/pom.xml
index 947ea65c0..9d3edee8d 100644
--- a/services/pom.xml
+++ b/services/pom.xml
@@ -303,7 +303,7 @@
 			<dependency>
 				<groupId>net.sf.ehcache</groupId>
 				<artifactId>ehcache</artifactId>
-				<version>2.7.7</version> <!-- More recent version is 2.9.1 -->
+				<version>2.10.2</version>
 			</dependency>
 			 <dependency>
 				<artifactId>servlet-api</artifactId>