[maven-release-plugin] prepare release dspace-3.5

Conflicts:
	dspace-jspui/src/main/webapp/search/discovery.jsp

.gitignore

@@ -22,6 +22,6 @@ nbactions.xml
 nb-configuration.xml
 META-INF/
 
-## Ignore all *.properties file, EXCEPT build.properties (the default)
-*.properties
-!build.properties
+## Ignore all *.properties file in root folder, EXCEPT build.properties (the default)
+/*.properties
+!/build.properties

.travis.yml

@@ -0,0 +1 @@
+language: java

dspace-api/pom.xml

@@ -12,7 +12,7 @@
     <parent>
         <groupId>org.dspace</groupId>
         <artifactId>dspace-parent</artifactId>
-        <version>4.0-SNAPSHOT</version>
+        <version>3.5</version>
         <relativePath>..</relativePath>
     </parent>
 
@@ -423,6 +423,12 @@
             <version>0.18.6</version>
         </dependency>
 
+        <dependency>
+            <groupId>com.coverity.security</groupId>
+            <artifactId>coverity-escapers</artifactId>
+            <version>1.1.1</version>
+        </dependency>
+ 
         <!--  Gson: Java to Json conversion -->
         <dependency>
             <groupId>com.google.code.gson</groupId>

dspace-api/src/main/java/org/dspace/authenticate/LDAPAuthentication.java

@@ -612,7 +612,7 @@ public class LDAPAuthentication
 
     /*
      * Add authenticated users to the group defined in dspace.cfg by
-     * the ldap.login.groupmap.* key.
+     * the authentication-ldap.login.groupmap.* key.
      */
     private void assignGroupsBasedOnLdapDn(String dn, Context context)
     {
@@ -644,7 +644,7 @@ public class LDAPAuthentication
                             // The group does not exist
                             log.warn(LogManager.getHeader(context,
                                     "ldap_assignGroupsBasedOnLdapDn",
-                                    "Group defined in ldap.login.groupmap." + i + " does not exist :: " + dspaceGroupName));
+                                    "Group defined in authentication-ldap.login.groupmap." + i + " does not exist :: " + dspaceGroupName));
                         }
                     }
                     catch (AuthorizeException ae)
@@ -657,7 +657,7 @@ public class LDAPAuthentication
                     }
                 }
 
-                groupMap = ConfigurationManager.getProperty("ldap.login.groupmap." + ++i);
+                groupMap = ConfigurationManager.getProperty("authentication-ldap", "login.groupmap." + ++i);
             }
         }
     }

dspace-api/src/main/java/org/dspace/browse/SolrBrowseCreateDAO.java

@@ -372,6 +372,9 @@ public class SolrBrowseCreateDAO implements BrowseCreateDAO,
     public void insertIndex(String table, int itemID, Map sortCols)
             throws BrowseException
     {
+		// this is required to be sure that communities2item will be cleaned
+		// after the switch to SOLRBrowseDAOs. See DS-1619
+    	dbCreateDAO.deleteCommunityMappings(itemID);
     }
 
     @Override

dspace-api/src/main/java/org/dspace/browse/SolrBrowseDAO.java

@@ -31,7 +31,8 @@ import org.dspace.utils.DSpace;
 /**
  * 
  * @author Andrea Bollini (CILEA)
- *
+ * @author Adán Román Ruiz at arvo.es (bugfix)
+ * 
  */
 public class SolrBrowseDAO implements BrowseDAO
 {
@@ -344,11 +345,11 @@ public class SolrBrowseDAO implements BrowseDAO
         query.addFilterQueries("search.resourcetype:" + Constants.ITEM);
         if (isAscending)
         {
-            query.setQuery("bi_"+column + "_sort" + ": [* TO \"" + value + "\"]");
+            query.setQuery("bi_"+column + "_sort" + ": [* TO \"" + value + "\"}");
         }
         else
         {
-            query.setQuery("bi_" + column + "_sort" + ": [\"" + value + "\" TO *]");
+            query.setQuery("bi_" + column + "_sort" + ": {\"" + value + "\" TO *]");
         }
         DiscoverResult resp = null;
         try

dspace-api/src/main/java/org/dspace/content/dao/ItemDAOOracle.java

@@ -9,25 +9,107 @@ package org.dspace.content.dao;
 
 import org.dspace.core.Context;
 import org.dspace.content.Bitstream;
+import org.dspace.storage.rdbms.DatabaseManager;
+import org.dspace.storage.rdbms.TableRowIterator;
+import org.dspace.storage.rdbms.TableRow;
 
 import java.sql.SQLException;
 
 public class ItemDAOOracle extends ItemDAO
-{
+{		
+		private static final String selectPrimaryBitstreamID =
+            "SELECT bundle.primary_bitstream_id FROM item2bundle, bundle " +
+            "WHERE item2bundle.item_id=? AND item2bundle.bundle_id=bundle.bundle_id AND bundle.name=?";
+
+    private static final String selectFirstBitstreamID =
+        "SELECT bundle2bitstream.bitstream_id FROM item2bundle, bundle, bundle2bitstream " +
+        "WHERE item2bundle.item_id=? AND item2bundle.bundle_id=bundle.bundle_id AND bundle.name=? " +
+        "AND bundle.bundle_id=bundle2bitstream.bundle_id";
+    
+		private static final String selectNamedBitstreamID =
+        "SELECT bitstream.bitstream_id FROM item2bundle, bundle, bundle2bitstream, bitstream " +
+        "WHERE item2bundle.item_id=? AND item2bundle.bundle_id=bundle.bundle_id AND bundle.name=? " +
+        "AND bundle.bundle_id=bundle2bitstream.bundle_id AND bundle2bitstream.bitstream_id=bitstream.bitstream_id " +
+        "AND bitstream.name=?";
+    
     ItemDAOOracle(Context ctx)
     {
         super(ctx);
     }
 
-    public Bitstream getPrimaryBitstream(int itemId, String bundleName) throws SQLException {
-        return null;  //To change body of implemented methods use File | Settings | File Templates.
+    public Bitstream getPrimaryBitstream(int itemId, String bundleName) throws SQLException
+    {
+        TableRowIterator tri = null;
+
+        try
+        {
+            tri = DatabaseManager.query(context, selectPrimaryBitstreamID, itemId, bundleName);
+
+            if (tri.hasNext())
+            {
+                TableRow row = tri.next();
+                int bid = row.getIntColumn("primary_bitstream_id");
+                return Bitstream.find(context, bid);
+            }
+        }        
+        finally
+        {
+            if (tri != null)
+            {
+                tri.close();
+            }
+        }
+
+        return null;
     }
 
-    public Bitstream getFirstBitstream(int itemId, String bundleName) throws SQLException {
-        return null;  //To change body of implemented methods use File | Settings | File Templates.
+    public Bitstream getFirstBitstream(int itemId, String bundleName) throws SQLException
+    {
+        TableRowIterator tri = null;
+
+        try
+        {
+            tri = DatabaseManager.query(context, selectFirstBitstreamID, itemId, bundleName);
+            if (tri.hasNext())
+            {
+                TableRow row = tri.next();
+                int bid = row.getIntColumn("bitstream_id");
+                return Bitstream.find(context, bid);
+            }
+        }
+        finally
+        {
+            if (tri != null)
+            {
+                tri.close();
+            }
+        }
+
+        return null;
     }
 
-    public Bitstream getNamedBitstream(int itemId, String bundleName, String fileName) throws SQLException {
-        return null;  //To change body of implemented methods use File | Settings | File Templates.
+    public Bitstream getNamedBitstream(int itemId, String bundleName, String fileName) throws SQLException
+    {
+        TableRowIterator tri = null;
+
+        try
+        {
+            tri = DatabaseManager.query(context, selectNamedBitstreamID, itemId, bundleName, fileName);
+            if (tri.hasNext())
+            {
+                TableRow row = tri.next();
+                int bid = row.getIntColumn("bitstream_id");
+                return Bitstream.find(context, bid);
+            }
+        }
+        finally
+        {
+            if (tri != null)
+            {
+                tri.close();
+            }
+        }
+
+        return null;
     }
 }

dspace-api/src/main/java/org/dspace/core/Utils.java

@@ -26,7 +26,7 @@ import java.util.Calendar;
 import java.util.GregorianCalendar;
 import java.text.SimpleDateFormat;
 import java.text.ParseException;
-
+import com.coverity.security.Escape;
 import org.apache.log4j.Logger;
 
 /**
@@ -280,21 +280,7 @@ public final class Utils
      */
     public static String addEntities(String value)
     {
-        if (value==null || value.length() == 0)
-        {
-            return value;
-        }
-        
-        value = value.replaceAll("&", "&");
-        value = value.replaceAll("\"", """);
-
-        // actually, ' is an XML entity, not in HTML.
-        // that's why it's commented out.
-        // value = value.replaceAll("'", "'");
-        value = value.replaceAll("<", "&lt;");
-        value = value.replaceAll(">", "&gt;");
-
-        return value;
+        return Escape.html(value);
     }
 
     /**

dspace-api/src/main/java/org/dspace/discovery/SolrServiceImpl.java

@@ -13,6 +13,7 @@ import org.apache.commons.collections.Transformer;
 import org.apache.commons.httpclient.HttpClient;
 import org.apache.commons.httpclient.methods.GetMethod;
 import org.apache.commons.io.IOUtils;
+import org.apache.commons.io.input.AutoCloseInputStream;
 import org.apache.commons.lang.ArrayUtils;
 import org.apache.commons.lang.StringUtils;
 import org.apache.commons.lang.time.DateFormatUtils;
@@ -1198,7 +1199,6 @@ public class SolrServiceImpl implements SearchService, IndexingService {
         log.debug("  Added Grouping");
 
 
-        Vector<InputStreamReader> readers = new Vector<InputStreamReader>();
 
         try {
             // now get full text of any bitstreams in the TEXT bundle
@@ -1216,17 +1216,12 @@ public class SolrServiceImpl implements SearchService, IndexingService {
                     for (Bitstream myBitstream : myBitstreams)
                     {
                         try {
-                            InputStreamReader is = new InputStreamReader(
-                                    myBitstream.retrieve()); // get input
-                            readers.add(is);
 
-                            // Add each InputStream to the Indexed Document
-                            String value = IOUtils.toString(is);
-                            doc.addField("fulltext", value);
+                            doc.addField("fulltext", new AutoCloseInputStream(myBitstream.retrieve()));
 
                             if(hitHighlightingFields.contains("*") || hitHighlightingFields.contains("fulltext"))
                             {
-                                doc.addField("fulltext_hl", value);
+                                doc.addField("fulltext_hl", new AutoCloseInputStream(myBitstream.retrieve()));
                             }
 
                             log.debug("  Added BitStream: "
@@ -1247,16 +1242,6 @@ public class SolrServiceImpl implements SearchService, IndexingService {
         {
             log.error(e.getMessage(), e);
         }
-        finally {
-            Iterator<InputStreamReader> itr = readers.iterator();
-            while (itr.hasNext()) {
-                InputStreamReader reader = itr.next();
-                if (reader != null) {
-                    reader.close();
-                }
-            }
-            log.debug("closed " + readers.size() + " readers");
-        }
 
         //Do any additional indexing, depends on the plugins
         List<SolrServiceIndexPlugin> solrServiceIndexPlugins = new DSpace().getServiceManager().getServicesByType(SolrServiceIndexPlugin.class);
@@ -1275,6 +1260,8 @@ public class SolrServiceImpl implements SearchService, IndexingService {
         } 
     }
 
+
+
     /**
      * Create Lucene document with all the shared fields initialized.
      *

dspace-api/src/main/java/org/dspace/harvest/OAIHarvester.java

@@ -29,6 +29,8 @@ import java.util.TimeZone;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.TransformerException;
 
+import ORG.oclc.oai.harvester2.verb.*;
+import org.apache.commons.lang.StringUtils;
 import org.apache.log4j.Logger;
 import org.dspace.authorize.AuthorizeException;
 import org.dspace.content.Bitstream;
@@ -63,12 +65,6 @@ import org.jdom.input.DOMBuilder;
 import org.jdom.output.XMLOutputter;
 import org.xml.sax.SAXException;
 
-import ORG.oclc.oai.harvester2.verb.GetRecord;
-import ORG.oclc.oai.harvester2.verb.Identify;
-import ORG.oclc.oai.harvester2.verb.ListMetadataFormats;
-import ORG.oclc.oai.harvester2.verb.ListRecords;
-import ORG.oclc.oai.harvester2.verb.ListSets;
-
 
 /**
  * This class handles OAI harvesting of externally located records into this repository. 
@@ -945,29 +941,21 @@ public class OAIHarvester {
     	try {
             //If we do not want to harvest from one set, then skip this.
     		if(!"all".equals(oaiSetId)){
-                ListSets ls = new ListSets(oaiSource);
+                ListIdentifiers ls = new ListIdentifiers(oaiSource, null, null, oaiSetId, DMDOAIPrefix);
 
                 // The only error we can really get here is "noSetHierarchy"
                 if (ls.getErrors() != null && ls.getErrors().getLength() > 0) {
                     for (int i=0; i<ls.getErrors().getLength(); i++) {
                         String errorCode = ls.getErrors().item(i).getAttributes().getNamedItem("code").getTextContent();
-                        errorSet.add(errorCode);
+                        errorSet.add(OAI_SET_ERROR + ": The OAI server does not have a set with the specified setSpec (" + errorCode + ")");
                     }
                 }
                 else {
                     // Drilling down to /OAI-PMH/ListSets/set
                     Document reply = db.build(ls.getDocument());
                     Element root = reply.getRootElement();
-                    List<Element> sets= root.getChild("ListSets",OAI_NS).getChildren("set",OAI_NS);
-
-                    for (Element set : sets)
-                    {
-                        String setSpec = set.getChildText("setSpec", OAI_NS);
-                        if (setSpec.equals(oaiSetId)) {
-                            foundSet = true;
-                            break;
-                        }
-                    }
+                    //Check if we can find items, if so this indicates that we have children and our sets exist
+                    foundSet = 0 < root.getChild("ListIdentifiers",OAI_NS).getChildren().size();
 
                     if (!foundSet) {
                         errorSet.add(OAI_SET_ERROR + ": The OAI server does not have a set with the specified setSpec");

dspace-api/src/main/java/org/dspace/identifier/VersionedHandleIdentifierProvider.java

@@ -545,7 +545,7 @@ public class VersionedHandleIdentifierProvider extends IdentifierProvider {
     protected String getCanonical(Item item)
     {
         String canonical = item.getHandle();
-        if( canonical.lastIndexOf(DOT)!=-1)
+        if( canonical.matches(".*/.*\\.\\d+") && canonical.lastIndexOf(DOT)!=-1)
         {
             canonical =  canonical.substring(0, canonical.lastIndexOf(DOT));
         }
@@ -556,7 +556,7 @@ public class VersionedHandleIdentifierProvider extends IdentifierProvider {
     protected String getCanonical(String identifier)
     {
         String canonical = identifier;
-        if( canonical.lastIndexOf(DOT)!=-1)
+        if( canonical.matches(".*/.*\\.\\d+") && canonical.lastIndexOf(DOT)!=-1)
         {
             canonical =  canonical.substring(0, canonical.lastIndexOf(DOT));
         }

dspace-api/src/main/java/org/dspace/statistics/SolrLogger.java

@@ -298,6 +298,13 @@ public class SolrLogger
                 log.debug(e.getMessage(),e);
             }
 
+            if(request.getHeader("User-Agent") != null)
+            {
+                doc1.addField("userAgent", request.getHeader("User-Agent"));
+            }
+
+            doc1.addField("isBot",isSpiderBot);
+
             // Save the location information if valid, save the event without
             // location information if not valid
             if(locationService != null)
@@ -321,12 +328,6 @@ public class SolrLogger
                     doc1.addField("city", location.city);
                     doc1.addField("latitude", location.latitude);
                     doc1.addField("longitude", location.longitude);
-                    doc1.addField("isBot",isSpiderBot);
-
-                    if(request.getHeader("User-Agent") != null)
-                    {
-                        doc1.addField("userAgent", request.getHeader("User-Agent"));
-                    }
                 }
             }
         }
@@ -365,8 +366,8 @@ public class SolrLogger
             }
             //Store the scope
             if(scope != null){
-                solrDoc.addField("scopeId", scope.getType());
-                solrDoc.addField("scopeType", scope.getID());
+                solrDoc.addField("scopeId", scope.getID());
+                solrDoc.addField("scopeType", scope.getType());
             }
 
             if(rpp != -1){

dspace-api/src/main/java/org/dspace/submit/step/DescribeStep.java

@@ -117,6 +117,10 @@ public class DescribeStep extends AbstractProcessingStep
             throws ServletException, IOException, SQLException,
             AuthorizeException
     {
+        if(!request.getParameterNames().hasMoreElements()){
+            //In case of an empty request do NOT just remove all metadata, just return to the submission page
+            return STATUS_MORE_INPUT_REQUESTED;
+        }
         // check what submit button was pressed in User Interface
         String buttonPressed = Util.getSubmitButton(request, NEXT_BUTTON);
 

dspace-jspui/pom.xml

@@ -13,7 +13,7 @@
    <parent>
       <groupId>org.dspace</groupId>
       <artifactId>dspace-parent</artifactId>
-      <version>4.0-SNAPSHOT</version>
+      <version>3.5</version>
       <relativePath>..</relativePath>
    </parent>
 

dspace-jspui/src/main/java/org/dspace/app/webui/servlet/AbstractBrowserServlet.java

@@ -14,6 +14,7 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.apache.commons.lang.StringUtils;
 import org.apache.log4j.Logger;
 import org.dspace.app.webui.util.UIUtil;
 import org.dspace.authorize.AuthorizeException;
@@ -30,6 +31,7 @@ import org.dspace.content.Community;
 import org.dspace.core.ConfigurationManager;
 import org.dspace.core.Context;
 import org.dspace.core.LogManager;
+import org.dspace.core.Utils;
 
 /**
  * Servlet for browsing through indices, as they are defined in
@@ -86,6 +88,25 @@ public abstract class AbstractBrowserServlet extends DSpaceServlet
             String month = request.getParameter("month");
             String year = request.getParameter("year");
             String startsWith = request.getParameter("starts_with");
+            //validate input to avoid cross-site scripting
+            try {
+            	if (StringUtils.isNotBlank(month) && !"-1".equals(month)) {
+            		Integer.valueOf(month);
+            	}
+            	if (StringUtils.isNotBlank(year) && !"-1".equals(year)) {
+            		Integer.valueOf(year);
+            	}
+            	if(StringUtils.isNotBlank(startsWith)) {
+            		startsWith = Utils.addEntities(startsWith);
+            	}
+            }
+            catch(Exception ex) {
+                log.warn("We were unable to parse the browse request: maybe a cross-site scripting attach?");
+                return null;
+            }
+            
+            
+            
             String valueFocus = request.getParameter("vfocus");
             String valueFocusLang = request.getParameter("vfocus_lang");
             String authority = request.getParameter("authority");
@@ -108,7 +129,7 @@ public abstract class AbstractBrowserServlet extends DSpaceServlet
 
             // process the input, performing some inline validation
             BrowseIndex bi = null;
-            if (type != null && !"".equals(type))
+            if (StringUtils.isNotEmpty(type))
             {
                 bi = BrowseIndex.getBrowseIndex(type);
             }

dspace-jspui/src/main/java/org/dspace/app/webui/servlet/BrowserServlet.java

@@ -65,7 +65,7 @@ public class BrowserServlet extends AbstractBrowserServlet
         // all browse requests currently come to GET.
         BrowserScope scope = getBrowserScopeForRequest(context, request, response);
 
-        if (scope.getBrowseIndex() == null)
+        if (scope == null || scope.getBrowseIndex() == null)
         {
             throw new ServletException("There is no browse index for the request");
         }

dspace-jspui/src/main/java/org/dspace/app/webui/servlet/HandleServlet.java

@@ -19,6 +19,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.lang.StringEscapeUtils;
+import org.apache.commons.lang.StringUtils;
 import org.apache.log4j.Logger;
 import org.dspace.app.util.GoogleMetadata;
 import org.dspace.app.webui.util.Authenticate;
@@ -129,8 +130,7 @@ public class HandleServlet extends DSpaceServlet
 
         if (dso == null)
         {
-            log.info(LogManager
-                    .getHeader(context, "invalid_id", "path=" + path));
+            log.info(LogManager.getHeader(context, "invalid_id", "path=" + path));
             JSPManager.showInvalidIDError(request, response, StringEscapeUtils.escapeHtml(path), -1);
 
             return;
@@ -152,8 +152,28 @@ public class HandleServlet extends DSpaceServlet
             // and firing a usage event for the DSO we're reporting for
             return;
 
+        } else if ("/display-statistics.jsp".equals(extraPathInfo))
+        {
+            request.getRequestDispatcher(extraPathInfo).forward(request, response);
+            // If we don't return here, we keep processing and end up
+            // throwing a NPE when checking community authorization
+            // and firing a usage event for the DSO we're reporting for
+            return;
+        } else if ("/browse".equals((extraPathInfo)) || StringUtils.startsWith(extraPathInfo, "/browse?")) {
+            request.getRequestDispatcher(extraPathInfo).forward(request, response);
+            // If we don't return here, we keep processing and end up
+            // throwing a NPE when checking community authorization
+            // and firing a usage event for the DSO we're reporting for
+            return;
+        } else if ("/simple-search".equals(extraPathInfo) || StringUtils.startsWith(extraPathInfo, "simple-search?")) {
+            request.getRequestDispatcher(extraPathInfo).forward(request, response);
+            // If we don't return here, we keep processing and end up
+            // throwing a NPE when checking community authorization
+            // and firing a usage event for the DSO we're reporting for
+            return;
         }
 
+
         // OK, we have a valid Handle. What is it?
         if (dso.getType() == Constants.ITEM)
         {
@@ -195,9 +215,9 @@ public class HandleServlet extends DSpaceServlet
             }
             else
             {
-                // Forward to another servlet
-                request.getRequestDispatcher(extraPathInfo).forward(request,
-                        response);
+                log.debug("Found Item with extraPathInfo => Error.");
+                JSPManager.showInvalidIDError(request, response, StringEscapeUtils.escapeHtml(path), -1);
+                return;
             }
 
         }
@@ -231,9 +251,9 @@ public class HandleServlet extends DSpaceServlet
             }
             else
             {
-                // Forward to another servlet
-                request.getRequestDispatcher(extraPathInfo).forward(request,
-                        response);
+                log.debug("Found Collection with extraPathInfo => Error.");
+                JSPManager.showInvalidIDError(request, response, StringEscapeUtils.escapeHtml(path), -1);
+                return;
             }
         }
         else if (dso.getType() == Constants.COMMUNITY)
@@ -255,9 +275,9 @@ public class HandleServlet extends DSpaceServlet
             }
             else
             {
-                // Forward to another servlet
-                request.getRequestDispatcher(extraPathInfo).forward(request,
-                        response);
+                log.debug("Found Community with extraPathInfo => Error.");
+                JSPManager.showInvalidIDError(request, response, StringEscapeUtils.escapeHtml(path), -1);
+                return;
             }
         }
         else

dspace-jspui/src/main/java/org/dspace/app/webui/servlet/LDAPServlet.java

@@ -45,8 +45,8 @@ public class LDAPServlet extends DSpaceServlet
         HttpServletResponse response)
         throws ServletException, IOException, SQLException, AuthorizeException
     {
-        // check if ldap is enables and forward to the correct login form
-        boolean ldap_enabled = ConfigurationManager.getBooleanProperty("ldap.enable");
+        // check if ldap is enables and forward to the correct login form        
+        boolean ldap_enabled = ConfigurationManager.getBooleanProperty("authentication-ldap", "enable");
         if (ldap_enabled)
         {
             JSPManager.showJSP(request, response, "/login/ldap.jsp");
@@ -104,4 +104,4 @@ public class LDAPServlet extends DSpaceServlet
                 "netid=" + netid + ", result=" + String.valueOf(status)));
         JSPManager.showJSP(request, response, jsp);
 	}
-}
+}

dspace-jspui/src/main/webapp/WEB-INF/web.xml

@@ -74,9 +74,6 @@
   <filter-mapping>
         <filter-name>dspace.request</filter-name>
         <url-pattern>/*</url-pattern>
-        <dispatcher>REQUEST</dispatcher>
-        <dispatcher>FORWARD</dispatcher>
-        <dispatcher>INCLUDE</dispatcher>
   </filter-mapping>
     
   <filter-mapping>

dspace-jspui/src/main/webapp/collection-home.jsp

@@ -34,6 +34,7 @@
 <%@ page import="org.dspace.browse.ItemCounter"%>
 <%@ page import="org.dspace.content.*"%>
 <%@ page import="org.dspace.core.ConfigurationManager"%>
+<%@ page import="org.dspace.core.Utils" %>
 <%@ page import="org.dspace.eperson.Group"     %>
 <%@ page import="javax.servlet.jsp.jstl.fmt.LocaleSupport" %>
 
@@ -317,7 +318,7 @@
 			{
 				if (dcv.length > 0)
 				{
-					displayTitle = dcv[0].value;
+					displayTitle = Utils.addEntities(dcv[0].value);
 				}
 			}
 			%><p class="recentItem"><a href="<%= request.getContextPath() %>/handle/<%= items[i].getHandle() %>"><%= displayTitle %></a></p><%

dspace-jspui/src/main/webapp/community-home.jsp

@@ -32,6 +32,7 @@
 <%@ page import="org.dspace.browse.ItemCounter" %>
 <%@ page import="org.dspace.content.*" %>
 <%@ page import="org.dspace.core.ConfigurationManager" %>
+<%@ page import="org.dspace.core.Utils" %>
 <%@ page import="javax.servlet.jsp.jstl.fmt.LocaleSupport" %>
 
 
@@ -357,7 +358,7 @@
 			{
 				if (dcv.length > 0)
 				{
-					displayTitle = dcv[0].value;
+					displayTitle = Utils.addEntities(dcv[0].value);
 				}
 			}
 			%><p class="recentItem"><a href="<%= request.getContextPath() %>/handle/<%= items[i].getHandle() %>"><%= displayTitle %></a></p><%

dspace-jspui/src/main/webapp/controlledvocabulary/search.jsp

@@ -14,6 +14,7 @@
 	The add-on may be turn off in dspace.cfg
 --%>  
 
+<%@page import="org.dspace.core.Utils"%>
 <%@ page contentType="text/html;charset=UTF-8" %>
 <%@ page  import="javax.servlet.jsp.jstl.fmt.LocaleSupport" %>
 <%@ taglib uri="/WEB-INF/dspace-tags.tld" prefix="dspace" %>
@@ -52,7 +53,7 @@
 	<form name="filterVocabulary" method="post" action="<%= request.getContextPath() %>/subject-search">
 	  <input style="border-width:1px;border-style:solid;" 
 	  		 name="filter" type="text" id="filter" 
-	  		 size="15" value="<%= filter %>" 
+	  		 size="15" value="<%= Utils.addEntities(filter) %>" 
 	  		 title="<%= LocaleSupport.getLocalizedMessage(pageContext, "jsp.controlledvocabulary.search.trimmessage") %>"/>
 	  <input type="submit" name="submit" value="<%= LocaleSupport.getLocalizedMessage(pageContext, "jsp.controlledvocabulary.search.trimbutton") %>"/>
 	  <input type="hidden" name="action" value="filter"/>

dspace-jspui/src/main/webapp/dspace-admin/eperson-browse.jsp

@@ -27,6 +27,7 @@
 <%@ taglib uri="http://www.dspace.org/dspace-tags.tld" prefix="dspace" %>
 
 <%@ page import="org.dspace.eperson.EPerson" %>
+<%@ page import="org.dspace.core.Utils" %>
 
 <%
     EPerson[] epeople =
@@ -115,10 +116,10 @@
                     <%= (e.getEmail() == null ? "" : e.getEmail()) %>
                 </td>
                 <td headers="t3" class="<%= row %>RowOddCol">
-                    <%= (e.getLastName() == null ? "" : e.getLastName()) %>
+                    <%= (e.getLastName() == null ? "" : Utils.addEntities(e.getLastName())) %>
                 </td>
                 <td headers="t4" class="<%= row %>RowEvenCol">
-                    <%= (e.getFirstName() == null ? "" : e.getFirstName()) %>
+                    <%= (e.getFirstName() == null ? "" : Utils.addEntities(e.getFirstName())) %>
                 </td>
                 <td headers="t5" class="<%= row %>RowOddCol" align="center">
                     <%= e.canLogIn() ? "yes" : "no" %>
@@ -130,7 +131,7 @@
                     <%= e.getSelfRegistered() ? "yes" : "no" %>
                 </td>
                 <td headers="t8" class="<%= row %>RowEvenCol">
-                    <%= (e.getMetadata("phone") == null ? "" : e.getMetadata("phone")) %>
+                    <%= (e.getMetadata("phone") == null ? "" : Utils.addEntities(e.getMetadata("phone"))) %>
                 </td>
                 <td headers="t9" class="<%= row %>RowOddCol">
                     <input type="hidden" name="eperson_id" value="<%= e.getID() %>"/>

dspace-jspui/src/main/webapp/dspace-admin/eperson-confirm-delete.jsp

@@ -20,6 +20,7 @@
     prefix="fmt" %>
 
 <%@ page import="org.dspace.eperson.EPerson" %>
+<%@ page import="org.dspace.core.Utils" %>
 
 <%@ taglib uri="http://www.dspace.org/dspace-tags.tld" prefix="dspace" %>
 
@@ -32,9 +33,9 @@
                parenttitlekey="jsp.administer"
                parentlink="/dspace-admin">
 
-    <%-- <h1>Delete e-person: <%= eperson.getFullName() %> (<%= eperson.getEmail() %>)</h1> --%>
+    <%-- <h1>Delete e-person: <%= Utils.addEntities(eperson.getFullName()) %> (<%= eperson.getEmail() %>)</h1> --%>
     <h1><fmt:message key="jsp.dspace-admin.eperson-confirm-delete.heading">
-        <fmt:param><%= eperson.getFullName() %></fmt:param>
+        <fmt:param><%= Utils.addEntities(eperson.getFullName()) %></fmt:param>
         <fmt:param><%= eperson.getEmail() %></fmt:param>
     </fmt:message></h1>
     

dspace-jspui/src/main/webapp/dspace-admin/eperson-deletion-error.jsp

@@ -28,11 +28,12 @@
 <%@ page import="org.dspace.eperson.EPerson" %>
 <%@ page import="java.util.List" %>
 <%@ page import="java.util.Iterator" %>
+<%@ page import="org.dspace.core.Utils" %>
 
 <%
     EPerson eperson = (EPerson) request.getAttribute("eperson");
     List tableList = (List) request.getAttribute("tableList");
-    String fullName = eperson.getFullName();
+    String fullName = Utils.addEntities(eperson.getFullName());
     Iterator tableIt = tableList.iterator();
   
 %>

dspace-jspui/src/main/webapp/dspace-admin/supervise-confirm-remove.jsp

@@ -28,6 +28,7 @@
 <%@ page import="org.dspace.eperson.EPerson" %>
 <%@ page import="org.dspace.eperson.Group" %>
 <%@ page import="org.dspace.content.WorkspaceItem" %>
+<%@ page import="org.dspace.core.Utils" %>
 
 <%
     // get item and group out of the request
@@ -75,7 +76,7 @@
 <br/><br/>
 <strong><fmt:message key="jsp.dspace-admin.supervise-confirm-remove.authorheader"/></strong>:
 <br/>
-<a href="mailto:<%= submitter.getEmail() %>"><%= submitter.getFullName() %></a>
+<a href="mailto:<%= submitter.getEmail() %>"><%= Utils.addEntities(submitter.getFullName()) %></a>
 <br/><br/>
 <strong><fmt:message key="jsp.dspace-admin.supervise-confirm-remove.supervisorgroupheader"/></strong>:
 <br/>

dspace-jspui/src/main/webapp/dspace-admin/supervise-link.jsp

@@ -28,6 +28,7 @@
 <%@ page import="org.dspace.eperson.EPerson" %>
 <%@ page import="org.dspace.eperson.Group" %>
 <%@ page import="org.dspace.eperson.Supervisor" %>
+<%@ page import="org.dspace.core.Utils" %>
 
 <%
     // get objects from request
@@ -109,7 +110,7 @@
                         <%= workspaceItems[i].getID() %>
                     </td>
                     <td class="<%= row %>RowEvenCol">
-                        <a href="mailto:<%= submitter.getEmail() %>"><%= submitter.getFullName() %></a>
+                        <a href="mailto:<%= submitter.getEmail() %>"><%= Utils.addEntities(submitter.getFullName()) %></a>
                     </td>
                     <td class="<%= row %>RowOddCol">
 <%

dspace-jspui/src/main/webapp/dspace-admin/supervise-list.jsp

@@ -25,6 +25,7 @@
 <%@ page import="org.dspace.content.SupervisedItem" %>
 <%@ page import="org.dspace.eperson.EPerson" %>
 <%@ page import="org.dspace.eperson.Group" %>
+<%@ page import="org.dspace.core.Utils" %>
 
 <%
     // get the object array out of the request
@@ -97,7 +98,7 @@
             <%= supervisors[j].getName() %>
         </td>
         <td class="<%= row %>RowOddCol">
-            <a href="mailto:<%= submitter.getEmail() %>"><%= submitter.getFullName() %></a>
+            <a href="mailto:<%= submitter.getEmail() %>"><%= Utils.addEntities(submitter.getFullName()) %></a>
         </td>
         <td class="<%= row %>RowEvenCol">
 <%

dspace-jspui/src/main/webapp/mydspace/main.jsp

@@ -25,7 +25,6 @@
 <%@ taglib uri="http://java.sun.com/jsp/jstl/fmt"
     prefix="fmt" %>
 
-
 <%@ taglib uri="http://www.dspace.org/dspace-tags.tld" prefix="dspace" %>
 
 <%@ page  import="javax.servlet.jsp.jstl.fmt.LocaleSupport" %>
@@ -78,7 +77,7 @@
         <tr>
             <td align="left">
                 <h1>
-                    <fmt:message key="jsp.mydspace"/>: <%= user.getFullName() %>
+                    <fmt:message key="jsp.mydspace"/>: <%= Utils.addEntities(user.getFullName()) %>
                 </h1>
             </td>
             <td align="right" class="standard">
@@ -136,7 +135,7 @@
                 </td>
                 <td headers="t2" class="<%= row %>RowEvenCol"><%= Utils.addEntities(title) %></td>
                 <td headers="t3" class="<%= row %>RowOddCol"><%= owned[i].getCollection().getMetadata("name") %></td>
-                <td headers="t4" class="<%= row %>RowEvenCol"><a href="mailto:<%= submitter.getEmail() %>"><%= submitter.getFullName() %></a></td>
+                <td headers="t4" class="<%= row %>RowEvenCol"><a href="mailto:<%= submitter.getEmail() %>"><%= Utils.addEntities(submitter.getFullName()) %></a></td>
                 <!-- <td headers="t5" class="<%= row %>RowOddCol"></td> -->
                 <td headers="t5" class="<%= row %>RowEvenCol">
                      <form action="<%= request.getContextPath() %>/mydspace" method="post">
@@ -200,7 +199,7 @@
                     </td>
                     <td headers="t7" class="<%= row %>RowEvenCol"><%= Utils.addEntities(title) %></td>
                     <td headers="t8" class="<%= row %>RowOddCol"><%= pooled[i].getCollection().getMetadata("name") %></td>
-                    <td headers="t9" class="<%= row %>RowEvenCol"><a href="mailto:<%= submitter.getEmail() %>"><%= submitter.getFullName() %></a></td>
+                    <td headers="t9" class="<%= row %>RowEvenCol"><a href="mailto:<%= submitter.getEmail() %>"><%= Utils.addEntities(submitter.getFullName()) %></a></td>
                     <td class="<%= row %>RowOddCol">
                         <form action="<%= request.getContextPath() %>/mydspace" method="post">
                             <input type="hidden" name="step" value="<%= MyDSpaceServlet.MAIN_PAGE %>" />
@@ -285,7 +284,7 @@
                 </form>
             </td>
             <td headers="t10" class="<%= row %>RowEvenCol">
-                <a href="mailto:<%= submitter.getEmail() %>"><%= submitter.getFullName() %></a>
+                <a href="mailto:<%= submitter.getEmail() %>"><%= Utils.addEntities(submitter.getFullName()) %></a>
             </td>
             <td headers="t11" class="<%= row %>RowOddCol"><%= Utils.addEntities(title) %></td>
             <td headers="t12" class="<%= row %>RowEvenCol"><%= workspaceItems[i].getCollection().getMetadata("name") %></td>
@@ -332,7 +331,7 @@
                 </form>
             </td>
             <td class="<%= row %>RowEvenCol">
-                <a href="mailto:<%= submitter.getEmail() %>"><%= submitter.getFullName() %></a>
+                <a href="mailto:<%= submitter.getEmail() %>"><%= Utils.addEntities(submitter.getFullName()) %></a>
             </td>
             <td class="<%= row %>RowOddCol"><%= Utils.addEntities(title) %></td>
             <td class="<%= row %>RowEvenCol"><%= supervisedItems[i].getCollection().getMetadata("name") %></td>

dspace-jspui/src/main/webapp/register/new-password.jsp

@@ -29,6 +29,7 @@
 
 <%@ page import="org.dspace.app.webui.servlet.RegisterServlet" %>
 <%@ page import="org.dspace.eperson.EPerson" %>
+<%@ page import="org.dspace.core.Utils" %>
 
 <%
     EPerson eperson = (EPerson) request.getAttribute("eperson");
@@ -43,9 +44,9 @@
     <%-- <h1>Enter a New Password</h1> --%>
 	<h1><fmt:message key="jsp.register.new-password.title"/></h1>
     
-    <!-- <p>Hello <%= eperson.getFullName() %>,</p> -->
+    <!-- <p>Hello <%= Utils.addEntities(eperson.getFullName()) %>,</p> -->
 	<p><fmt:message key="jsp.register.new-password.hello">
-        <fmt:param><%= eperson.getFullName() %></fmt:param>
+        <fmt:param><%= Utils.addEntities(eperson.getFullName()) %></fmt:param>
     </fmt:message></p>
     
 <%

dspace-jspui/src/main/webapp/register/registered.jsp

@@ -25,6 +25,7 @@
 
 <%@ page import="org.dspace.app.webui.servlet.RegisterServlet" %>
 <%@ page import="org.dspace.eperson.EPerson" %>
+<%@ page import="org.dspace.core.Utils" %>
 
 <%
     EPerson eperson = (EPerson) request.getAttribute("eperson");
@@ -35,9 +36,9 @@
     <%-- <h1>Registration Complete</h1> --%>
 	<h1><fmt:message key="jsp.register.registered.title"/></h1>
     
-    <%-- <p>Thank you <%= eperson.getFirstName() %>,</p> --%>
+    <%-- <p>Thank you <%= Utils.addEntities(eperson.getFirstName()) %>,</p> --%>
 	<p><fmt:message key="jsp.register.registered.thank">
-        <fmt:param><%= eperson.getFirstName() %></fmt:param>
+        <fmt:param><%= Utils.addEntities(eperson.getFirstName()) %></fmt:param>
     </fmt:message></p>
 
     <%-- <p>You're now registered to use the DSpace system.  You can subscribe to

dspace-jspui/src/main/webapp/search/advanced.jsp

@@ -106,7 +106,7 @@
 						{
 							String key = "jsp.search.advanced.type." + index;
 					%>
-							<option value="<%= index %>" <%= field1.equals(index) ? "selected=\"selected\"" : "" %>><fmt:message key="<%= key %>"/></option>
+							<option value="<%= StringEscapeUtils.escapeHtml(index) %>" <%= field1.equals(index) ? "selected=\"selected\"" : "" %>><fmt:message key="<%= key %>"/></option>
 					<%
 						}
 					%>
@@ -136,7 +136,7 @@
 						{
 							String key = "jsp.search.advanced.type." + index;
 					%>
-							<option value="<%= index %>" <%= field2.equals(index) ? "selected=\"selected\"" : "" %>><fmt:message key="<%= key %>"/></option>
+							<option value="<%= StringEscapeUtils.escapeHtml(index) %>" <%= field2.equals(index) ? "selected=\"selected\"" : "" %>><fmt:message key="<%= key %>"/></option>
 					<%
 						}
 					%>
@@ -162,7 +162,7 @@
 						{
 							String key = "jsp.search.advanced.type." + index;
 					%>
-							<option value="<%= index %>" <%= field3.equals(index) ? "selected=\"selected\"" : "" %>><fmt:message key="<%= key %>"/></option>
+							<option value="<%= StringEscapeUtils.escapeHtml(index) %>" <%= field3.equals(index) ? "selected=\"selected\"" : "" %>><fmt:message key="<%= key %>"/></option>
 					<%
 						}
 					%>

dspace-jspui/src/main/webapp/search/discovery.jsp

@@ -32,6 +32,8 @@
   -   admin_button     - If the user is an admin
   --%>
 
+<%@page import="org.dspace.core.Utils"%>
+<%@page import="com.coverity.security.Escape"%>
 <%@page import="org.dspace.discovery.configuration.DiscoverySearchFilterFacet"%>
 <%@page import="org.dspace.app.webui.util.UIUtil"%>
 <%@page import="java.util.HashMap"%>
@@ -46,6 +48,7 @@
 <%@page import="org.dspace.discovery.DiscoverResult"%>
 <%@page import="org.dspace.content.DSpaceObject"%>
 <%@page import="java.util.List"%>
+<%@ page import="org.apache.commons.lang.StringEscapeUtils" %>
 <%@ page contentType="text/html;charset=UTF-8" %>
 
 <%@ taglib uri="http://java.sun.com/jsp/jstl/fmt"
@@ -54,7 +57,6 @@
     prefix="c" %>
 
 <%@ taglib uri="http://www.dspace.org/dspace-tags.tld" prefix="dspace" %>
-<%@ page import="org.apache.commons.lang.StringEscapeUtils" %>
 <%@ page import="java.net.URLEncoder"            %>
 <%@ page import="org.dspace.content.Community"   %>
 <%@ page import="org.dspace.content.Collection"  %>
@@ -184,11 +186,11 @@
     }
 %>                                </select><br/>
                                 <label for="query"><fmt:message key="jsp.search.results.searchfor"/></label>
-                                <input type="text" size="50" name="query" value="<%= (query==null ? "" : StringEscapeUtils.escapeHtml(query)) %>"/>
+                                <input type="text" size="50" name="query" value="<%= (query==null ? "" : Utils.addEntities(StringEscapeUtils.escapeHtml(query))) %>"/>
                                 <input type="submit" value="<fmt:message key="jsp.general.go"/>" />
                                 <input type="hidden" value="<%= rpp %>" name="rpp" />
-                                <input type="hidden" value="<%= sortedBy %>" name="sort_by" />
-                                <input type="hidden" value="<%= order %>" name="order" />
+                                <input type="hidden" value="<%= Utils.addEntities(sortedBy) %>" name="sort_by" />
+                                <input type="hidden" value="<%= Utils.addEntities(order) %>" name="order" />
 <% if (appliedFilters.size() > 0 ) { %>                                
 		<div class="discovery-search-appliedFilters">
 		<span><fmt:message key="jsp.search.filter.applied" /></span>
@@ -202,8 +204,8 @@
 				<%
 					for (DiscoverySearchFilter searchFilter : availableFilters)
 					{
-					    String fkey = "jsp.search.filter."+searchFilter.getIndexFieldName();
-					    %><option value="<%= searchFilter.getIndexFieldName() %>"<% 
+					    String fkey = "jsp.search.filter." + Escape.uriParam(searchFilter.getIndexFieldName());
+					    %><option value="<%= Utils.addEntities(searchFilter.getIndexFieldName()) %>"<% 
 					            if (filter[0].equals(searchFilter.getIndexFieldName()))
 					            {
 					                %> selected="selected"<%
@@ -213,8 +215,8 @@
 					}
 					if (!found)
 					{
-					    String fkey = "jsp.search.filter."+filter[0];
-					    %><option value="<%= filter[0] %>" selected="selected"><fmt:message key="<%= fkey %>"/></option><%
+					    String fkey = "jsp.search.filter." + Escape.uriParam(filter[0]);
+					    %><option value="<%= Utils.addEntities(filter[0]) %>" selected="selected"><fmt:message key="<%= fkey %>"/></option><%
 					}
 				%>
 				</select>
@@ -222,12 +224,12 @@
 				<%
 					for (String opt : options)
 					{
-					    String fkey = "jsp.search.filter.op."+opt;
-					    %><option value="<%= opt %>"<%= opt.equals(filter[1])?" selected=\"selected\"":"" %>><fmt:message key="<%= fkey %>"/></option><%
+					    String fkey = "jsp.search.filter.op." + Escape.uriParam(opt);
+					    %><option value="<%= Utils.addEntities(opt) %>"<%= opt.equals(filter[1])?" selected=\"selected\"":"" %>><fmt:message key="<%= fkey %>"/></option><%
 					}
 				%>
 				</select>
-				<input type="text" id="filter_value_<%=idx %>" name="filter_value_<%=idx %>" value="<%= StringEscapeUtils.escapeHtml(filter[2]) %>" size="45"/>
+				<input type="text" id="filter_value_<%=idx %>" name="filter_value_<%=idx %>" value="<%= Utils.addEntities(filter[2]) %>" size="45"/>
 				<input type="submit" id="submit_filter_remove_<%=idx %>" name="submit_filter_remove_<%=idx %>" value="X" />
 				<br/>
 				<%
@@ -242,17 +244,17 @@
 <% if (availableFilters.size() > 0) { %>
 		<div class="discovery-search-filters">
 		<form action="simple-search" method="get">
-		<input type="hidden" value="<%= StringEscapeUtils.escapeHtml(searchScope) %>" name="location" />
-		<input type="hidden" value="<%= StringEscapeUtils.escapeHtml(query) %>" name="query" />
+		<input type="hidden" value="<%= Utils.addEntities(searchScope) %>" name="location" />
+		<input type="hidden" value="<%= Utils.addEntities(query) %>" name="query" />
 		<% if (appliedFilterQueries.size() > 0 ) { 
 				int idx = 1;
 				for (String[] filter : appliedFilters)
 				{
 				    boolean found = false;
 				    %>
-				    <input type="hidden" id="filter_field_<%=idx %>" name="filter_field_<%=idx %>" value="<%= filter[0] %>" />
-					<input type="hidden" id="filter_type_<%=idx %>" name="filter_type_<%=idx %>" value="<%= filter[1] %>" />
-					<input type="hidden" id="filter_value_<%=idx %>" name="filter_value_<%=idx %>" value="<%= StringEscapeUtils.escapeHtml(filter[2]) %>" />
+				    <input type="hidden" id="filter_field_<%=idx %>" name="filter_field_<%=idx %>" value="<%= Utils.addEntities(filter[0]) %>" />
+					<input type="hidden" id="filter_type_<%=idx %>" name="filter_type_<%=idx %>" value="<%= Utils.addEntities(filter[1]) %>" />
+					<input type="hidden" id="filter_value_<%=idx %>" name="filter_value_<%=idx %>" value="<%= Utils.addEntities(filter[2]) %>" />
 					<%
 					idx++;
 				}
@@ -263,8 +265,8 @@
 		<%
 			for (DiscoverySearchFilter searchFilter : availableFilters)
 			{
-			    String fkey = "jsp.search.filter."+searchFilter.getIndexFieldName();
-			    %><option value="<%= searchFilter.getIndexFieldName() %>"><fmt:message key="<%= fkey %>"/></option><%
+			    String fkey = "jsp.search.filter." + Escape.uriParam(searchFilter.getIndexFieldName());
+			    %><option value="<%= Utils.addEntities(searchFilter.getIndexFieldName()) %>"><fmt:message key="<%= fkey %>"/></option><%
 			}
 		%>
 		</select>
@@ -272,15 +274,15 @@
 		<%
 			for (String opt : options)
 			{
-			    String fkey = "jsp.search.filter.op."+opt;
-			    %><option value="<%= opt %>"><fmt:message key="<%= fkey %>"/></option><%
+			    String fkey = "jsp.search.filter.op." + Escape.uriParam(opt);
+			    %><option value="<%= Utils.addEntities(opt) %>"><fmt:message key="<%= fkey %>"/></option><%
 			}
 		%>
 		</select>
 		<input type="text" id="filterquery" name="filterquery" size="45"/>
         <input type="hidden" value="<%= rpp %>" name="rpp" />
-        <input type="hidden" value="<%= sortedBy %>" name="sort_by" />
-        <input type="hidden" value="<%= order %>" name="order" />
+		<input type="hidden" value="<%= Utils.addEntities(sortedBy) %>" name="sort_by" />
+		<input type="hidden" value="<%= Utils.addEntities(order) %>" name="order" />
 		<input type="submit" value="<fmt:message key="jsp.search.filter.add"/>" />
 		</form>
 		</div>        
@@ -288,17 +290,17 @@
         <%-- Include a component for modifying sort by, order, results per page, and et-al limit --%>
    <div class="discovery-pagination-controls">
    <form action="simple-search" method="get">
-   <input type="hidden" value="<%= StringEscapeUtils.escapeHtml(searchScope) %>" name="location" />
-   <input type="hidden" value="<%= StringEscapeUtils.escapeHtml(query) %>" name="query" />
+   <input type="hidden" value="<%= Utils.addEntities(searchScope) %>" name="location" />
+   <input type="hidden" value="<%= Utils.addEntities(query) %>" name="query" />
 	<% if (appliedFilterQueries.size() > 0 ) { 
 				int idx = 1;
 				for (String[] filter : appliedFilters)
 				{
 				    boolean found = false;
 				    %>
-				    <input type="hidden" id="filter_field_<%=idx %>" name="filter_field_<%=idx %>" value="<%= filter[0] %>" />
-					<input type="hidden" id="filter_type_<%=idx %>" name="filter_type_<%=idx %>" value="<%= filter[1] %>" />
-					<input type="hidden" id="filter_value_<%=idx %>" name="filter_value_<%=idx %>" value="<%= StringEscapeUtils.escapeHtml(filter[2]) %>" />
+				    <input type="hidden" id="filter_field_<%=idx %>" name="filter_field_<%=idx %>" value="<%= Utils.addEntities(filter[0]) %>" />
+					<input type="hidden" id="filter_type_<%=idx %>" name="filter_type_<%=idx %>" value="<%= Utils.addEntities(filter[1]) %>" />
+					<input type="hidden" id="filter_value_<%=idx %>" name="filter_value_<%=idx %>" value="<%= Utils.addEntities(filter[2]) %>" />
 					<%
 					idx++;
 				}
@@ -327,8 +329,8 @@
                for (String sortBy : sortOptions)
                {
                    String selected = (sortBy.equals(sortedBy) ? "selected=\"selected\"" : "");
-                   String mKey = "search.sort-by." + sortBy;
-                   %> <option value="<%= sortBy %>" <%= selected %>><fmt:message key="<%= mKey %>"/></option><%
+                   String mKey = "search.sort-by." + Utils.addEntities(sortBy);
+                   %> <option value="<%= Utils.addEntities(sortBy) %>" <%= selected %>><fmt:message key="<%= mKey %>"/></option><%
                }
 %>
                </select>
@@ -602,28 +604,30 @@ if (pageTotal > pageCurrent)
 		
 	for (DiscoverySearchFilterFacet facetConf : facetsConf)
 	{
-	    String f = facetConf.getIndexFieldName();
-	    List<FacetResult> facet = qResults.getFacetResult(f);
-	    if (facet.size() == 0)
-	    {
-	        facet = qResults.getFacetResult(f+".year");
+		if(qResults!=null) {
+		    String f = facetConf.getIndexFieldName();
+		    List<FacetResult> facet = qResults.getFacetResult(f);
 		    if (facet.size() == 0)
 		    {
-		        showFacets.put(f, false);
-		        continue;
+		        facet = qResults.getFacetResult(f+".year");
+			    if (facet.size() == 0)
+			    {
+			        showFacets.put(f, false);
+			        continue;
+			    }
 		    }
-	    }
-	    boolean showFacet = false;
-	    for (FacetResult fvalue : facet)
-	    { 
-			if(!appliedFilterQueries.contains(f+"::"+fvalue.getFilterType()+"::"+fvalue.getAsFilterQuery()))
-		    {
-		        showFacet = true;
-		        break;
+		    boolean showFacet = false;
+		    for (FacetResult fvalue : facet)
+		    { 
+				if(!appliedFilterQueries.contains(f+"::"+fvalue.getFilterType()+"::"+fvalue.getAsFilterQuery()))
+			    {
+			        showFacet = true;
+			        break;
+			    }
 		    }
-	    }
-	    showFacets.put(f, showFacet);
-	    brefine = brefine || showFacet;
+		    showFacets.put(f, showFacet);
+		    brefine = brefine || showFacet;
+		}
 	}
 	if (brefine) {
 %>
@@ -717,4 +721,3 @@ if (pageTotal > pageCurrent)
 <% } %>
 </dspace:sidebar>
 </dspace:layout>
-

dspace-jspui/src/main/webapp/search/results.jsp

@@ -396,7 +396,7 @@ if (pageTotal > pageCurrent)
 </p>
 
 <form id="dso-display" action="<%=request.getContextPath()%>/dso-display" method="post">
-    <input type="hidden" name="query"   value="<%=query%>"/>
+    <input type="hidden" name="query"   value="<%=StringEscapeUtils.escapeHtml(query)%>"/>
     <input type="hidden" name="rpp"     value="<%=rpp%>"/>
     <input type="hidden" name="page"   value="<%=pageCurrent%>"/>
     <input type="hidden" name="sort_by" value="<%=(so != null ? so.getNumber() : 0)%>"/>

dspace-jspui/src/main/webapp/submit/edit-metadata.jsp

@@ -50,6 +50,7 @@
 <%@ page import="org.dspace.content.authority.ChoiceAuthorityManager" %>
 <%@ page import="org.dspace.content.authority.Choices" %>
 <%@ page import="org.dspace.core.ConfigurationManager" %>
+<%@ page import="org.dspace.core.Utils" %>
 
 <%@ taglib uri="http://www.dspace.org/dspace-tags.tld" prefix="dspace" %>
 <%@ taglib uri="http://java.sun.com/jsp/jstl/fmt" prefix="fmt" %>
@@ -325,9 +326,9 @@
          if (repeatable && !readonly && i < defaults.length)
          {
             name.setLength(0);
-            name.append(dpn.getLastName())
+            name.append(Utils.addEntities(dpn.getLastName()))
                 .append(' ')
-                .append(dpn.getFirstNames());
+                .append(Utils.addEntities(dpn.getFirstNames()));
             // put a remove button next to filled in values
             sb.append("<td><input type=\"submit\" name=\"submit_")
               .append(fieldName)

dspace-jspui/src/main/webapp/tools/eperson-list.jsp

@@ -281,7 +281,7 @@ function clearEPeople()
     {
         EPerson e = epeople[i];
 		// Make sure no quotes in full name will mess up our Javascript
-        String fullname = e.getFullName().replace('\'', ' ');
+        String fullname = Utils.addEntities(e.getFullName().replace('\'', ' '));
 %>
         <tr>
 			<td headers="t1" class="<%= row %>RowOddCol">
@@ -291,10 +291,10 @@ function clearEPeople()
 			<td headers="t2" class="<%= row %>RowEvenCol"><%= e.getID() %></td>
 			<td headers="t3" class="<%= row %>RowOddCol"><%= e.getEmail() %></td>
             <td headers="t4" class="<%= row %>RowEvenCol">
-                <%= (e.getLastName() == null ? "" : e.getLastName()) %>
+                <%= (e.getLastName() == null ? "" : Utils.addEntities(e.getLastName())) %>
             </td>
             <td headers="t5" class="<%= row %>RowOddCol">
-                <%= (e.getFirstName() == null ? "" : e.getFirstName()) %>
+                <%= (e.getFirstName() == null ? "" : Utils.addEntities(e.getFirstName())) %>
             </td>
             <td headers="t6" class="<%= row %>RowOddCol">
                 <%= (e.getLanguage() == null ? "" : e.getLanguage()) %>

dspace-jspui/src/main/webapp/workspace/ws-main.jsp

@@ -26,6 +26,7 @@
 <%@ page import="org.dspace.content.WorkspaceItem" %>
 <%@ page import="org.dspace.eperson.EPerson" %>
 <%@ page import="javax.servlet.jsp.jstl.fmt.LocaleSupport" %>
+<%@ page import="org.dspace.core.Utils" %>
 
 <%
     // get the workspace item from the request
@@ -73,7 +74,7 @@
 		}
 %>
 
-    <p><strong><a href="mailto:<%= submitter.getEmail() %>"><%= submitter.getFullName() %></a></strong></p>
+    <p><strong><a href="mailto:<%= submitter.getEmail() %>"><%= Utils.addEntities(submitter.getFullName()) %></a></strong></p>
 
 	<p><fmt:message key="jsp.workspace.ws-main.submitmsg"/> 
     <%= workspaceItem.getCollection().getMetadata("name") %></p>

dspace-lni/dspace-lni-client/pom.xml

@@ -10,18 +10,33 @@
 
    <parent>
       <groupId>org.dspace</groupId>
-      <artifactId>dspace-lni</artifactId>
-      <version>3.0-SNAPSHOT</version>
-      <relativePath>..</relativePath>
+      <artifactId>dspace-parent</artifactId>
+      <version>3.5</version>
+      <relativePath>../..</relativePath>
    </parent>
+   
+   <properties>
+       <!-- This is the path to the root [dspace-src] directory. -->
+       <root.basedir>${basedir}/../..</root.basedir>
+   </properties>
 
+   <!--
+        Running this profile will regenerate (from WSDL) most of the classes
+        under the 'org.dspace.app.dav.client' package, based on the existing
+        'org.dspace.app.dav.LNISoapServlet' class in the dspace-lni API.
+
+        This profile is only activated if you explicitly run:
+           mvn package -P regenerate-wsdl
+
+        Please note that after regenerating these classes, you will need to manually
+        re-apply the DSpace license header, in order for them to pass license header
+        checks executed during "mvn install" or "mvn release".
+   -->
    <profiles>
       <profile>
+         <id>regenerate-wsdl</id>
          <activation>
-            <property>
-               <name>regenerate-wsdl</name>
-               <value>true</value>
-            </property>
+            <activeByDefault>false</activeByDefault>
          </activation>
          <build>
             <plugins>
@@ -174,6 +189,12 @@
          <artifactId>servlet-api</artifactId>
          <scope>provided</scope>
       </dependency>
+      <dependency>
+         <groupId>org.dspace</groupId>
+         <artifactId>dspace-lni</artifactId>
+         <type>jar</type>
+         <classifier>classes</classifier>
+      </dependency>
    </dependencies>
 
 </project>

dspace-lni/pom.xml

@@ -11,7 +11,7 @@
    <parent>
       <groupId>org.dspace</groupId>
       <artifactId>dspace-parent</artifactId>
-      <version>4.0-SNAPSHOT</version>
+      <version>3.5</version>
       <relativePath>..</relativePath>
    </parent>
 

dspace-oai/pom.xml

@@ -8,7 +8,7 @@
     <parent>
         <artifactId>dspace-parent</artifactId>
         <groupId>org.dspace</groupId>
-        <version>4.0-SNAPSHOT</version>
+        <version>3.5</version>
         <relativePath>..</relativePath>
     </parent>
 
@@ -72,7 +72,7 @@
         <dependency>
             <groupId>com.lyncode</groupId>
             <artifactId>xoai</artifactId>
-            <version>2.2.9</version>
+            <version>3.0.0</version>
         </dependency>
         <dependency>
             <groupId>org.dspace</groupId>

dspace-oai/src/main/java/org/dspace/xoai/DSpaceOAIDataProvider.java

@@ -158,6 +158,11 @@ public class DSpaceOAIDataProvider extends HttpServlet
                     "Requested OAI context \""
                     + request.getPathInfo().replace("/", "")
                     + "\" does not exist");
+        } finally {
+            if(context != null && context.isValid())
+            {
+                context.abort();
+            }
         }
 
     }

dspace-oai/src/main/java/org/dspace/xoai/data/DSpaceIdentify.java

@@ -7,6 +7,8 @@
  */
 package org.dspace.xoai.data;
 
+import java.io.File;
+import java.io.IOException;
 import java.sql.SQLException;
 import java.util.ArrayList;
 import java.util.Date;
@@ -14,6 +16,7 @@ import java.util.List;
 
 import javax.servlet.http.HttpServletRequest;
 
+import org.apache.commons.io.FileUtils;
 import org.apache.log4j.LogManager;
 import org.apache.log4j.Logger;
 import org.dspace.core.ConfigurationManager;
@@ -157,4 +160,36 @@ public class DSpaceIdentify extends AbstractIdentify
         return _name;
     }
 
+	@Override
+	public List<String> getDescription() {
+		List<String> result = new ArrayList<String>();
+		String descriptionFile = ConfigurationManager.getProperty("oai", "description.file");
+		if (descriptionFile == null) {
+			// Try indexed
+			boolean stop = false;
+			List<String> descriptionFiles = new ArrayList<String>();
+			for (int i=0;!stop;i++) {
+				String tmp = ConfigurationManager.getProperty("oai", "description.file."+i);
+				if (tmp == null && i!=0) stop = true;
+				else descriptionFiles.add(tmp);
+			}
+			
+			for (String path : descriptionFiles) {
+				try {
+					result.add(FileUtils.readFileToString(new File(path)));
+				} catch (IOException e) {
+					log.error(e.getMessage(), e);
+				}
+			}
+			
+		} else {
+			try {
+				result.add(FileUtils.readFileToString(new File(descriptionFile)));
+			} catch (IOException e) {
+				log.error(e.getMessage(), e);
+			}
+		}
+		return result;
+	}
+
 }

dspace-oai/src/main/java/org/dspace/xoai/data/DSpaceItemRepository.java

@@ -156,7 +156,7 @@ public abstract class DSpaceItemRepository extends AbstractItemRepository
     public ListItemsResults getItemsUntil(List<Filter> filters, int offset,
             int length, String setSpec, Date from)
     {
-        filters.add(new Filter(new DateFromFilter(from), FilterScope.Query));
+        filters.add(new Filter(new DateUntilFilter(from), FilterScope.Query));
         filters.add(new Filter(new DspaceSetSpecFilter(setSpec),
                 FilterScope.Query));
         return this.getItems(filters, offset, length);

dspace-oai/src/main/java/org/dspace/xoai/filter/DateUntilFilter.java

@@ -45,7 +45,6 @@ public class DateUntilFilter extends DSpaceFilter
     @Override
     public SolrFilterResult getQuery()
     {
-    	System.out.println("HEYYYY!!!!");
         return new SolrFilterResult("item.lastmodified:[* TO "
                 + ClientUtils.escapeQueryChars(DateUtils.formatToSolr(_date, false)) + "]");
     }

dspace-oai/src/main/java/org/dspace/xoai/util/ItemUtils.java

@@ -165,7 +165,7 @@ public class ItemUtils
                     Element bitstream = create(factory, "bitstream");
                     bitstreams.getElement().add(bitstream);
                     String url = "";
-                    String bsName = bitstream.getName();
+                    String bsName = bit.getName();
                     String sid = String.valueOf(bit.getSequenceID());
                     String baseUrl = ConfigurationManager.getProperty("oai",
                             "bitstream.baseUrl");
@@ -190,7 +190,7 @@ public class ItemUtils
                     if (handle != null && baseUrl != null)
                     {
                         url = baseUrl + "/bitstream/"
-                                + URLUtils.encode(handle) + "/"
+                                + handle + "/"
                                 + sid + "/"
                                 + URLUtils.encode(bsName);
                     }

dspace-services/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.dspace</groupId>
         <artifactId>dspace-parent</artifactId>
-        <version>4.0-SNAPSHOT</version>
+        <version>3.5</version>
     </parent>
 
     <properties>

dspace-sword/pom.xml

@@ -15,7 +15,7 @@
    <parent>
       <groupId>org.dspace</groupId>
       <artifactId>dspace-parent</artifactId>
-      <version>4.0-SNAPSHOT</version>
+      <version>3.5</version>
       <relativePath>..</relativePath>
    </parent>
 

dspace-swordv2/pom.xml

@@ -13,7 +13,7 @@
     <parent>
         <groupId>org.dspace</groupId>
         <artifactId>dspace-parent</artifactId>
-        <version>4.0-SNAPSHOT</version>
+        <version>3.5</version>
         <relativePath>..</relativePath>
     </parent>
 

dspace-xmlui/pom.xml

@@ -11,7 +11,7 @@
    <parent>
       <groupId>org.dspace</groupId>
       <artifactId>dspace-parent</artifactId>
-      <version>4.0-SNAPSHOT</version>
+      <version>3.5</version>
       <relativePath>..</relativePath>
    </parent>
 

dspace-xmlui/src/main/java/org/dspace/app/xmlui/aspect/artifactbrowser/Navigation.java

@@ -211,13 +211,22 @@ public class Navigation extends AbstractDSpaceTransformer implements CacheablePr
         {
             if (dso instanceof Item)
             {
+                pageMeta.addMetadata("focus","containerType").addContent("type:item");
                 pageMeta.addMetadata("focus","object").addContent("hdl:"+dso.getHandle());
                 this.getObjectManager().manageObject(dso);
                 dso = ((Item) dso).getOwningCollection();
             }
             
-            if (dso instanceof Collection || dso instanceof Community)
+            if (dso instanceof Collection)
             {
+                pageMeta.addMetadata("focus","containerType").addContent("type:collection");
+                pageMeta.addMetadata("focus","container").addContent("hdl:"+dso.getHandle());
+                this.getObjectManager().manageObject(dso);
+            }
+            
+            if (dso instanceof Community)
+            {
+                pageMeta.addMetadata("focus","containerType").addContent("type:community");
                 pageMeta.addMetadata("focus","container").addContent("hdl:"+dso.getHandle());
                 this.getObjectManager().manageObject(dso);
             }

dspace-xmlui/src/main/java/org/dspace/app/xmlui/aspect/discovery/SimpleSearch.java

@@ -39,6 +39,7 @@ import org.xml.sax.SAXException;
  * @author Kevin Van de Velde (kevin at atmire dot com)
  * @author Mark Diggory (markd at atmire dot com)
  * @author Ben Bosman (ben at atmire dot com)
+ * @author Adán Román Ruiz <aroman@arvo.es> (Bugfix)
  */
 public class SimpleSearch extends AbstractSearch implements CacheableProcessingComponent {
     /**
@@ -185,8 +186,8 @@ public class SimpleSearch extends AbstractSearch implements CacheableProcessingC
 
                     if(StringUtils.isNotBlank(filterValue))
                     {
-                        Row row = filtersTable.addRow("used-filters-" + i, Row.ROLE_DATA, "search-filter used-filter");
-                        addFilterRow(filterFields, i, row, filterType, filterOperator, filterValue);
+                        Row row = filtersTable.addRow("used-filters-" + i+1, Row.ROLE_DATA, "search-filter used-filter");
+                        addFilterRow(filterFields, i+1, row, filterType, filterOperator, filterValue);
                     }
                 }
                 filtersTable.addRow("filler-row", Row.ROLE_DATA, "search-filter filler").addCell(1, 4).addContent("");

dspace-xmlui/src/main/java/org/dspace/app/xmlui/aspect/viewArtifacts/Navigation.java

@@ -133,13 +133,22 @@ public class Navigation extends AbstractDSpaceTransformer implements CacheablePr
         {
             if (dso instanceof Item)
             {
+                pageMeta.addMetadata("focus","containerType").addContent("type:item");
                 pageMeta.addMetadata("focus","object").addContent("hdl:"+dso.getHandle());
                 this.getObjectManager().manageObject(dso);
                 dso = ((Item) dso).getOwningCollection();
             }
-
-            if (dso instanceof Collection || dso instanceof Community)
+            
+            if (dso instanceof Collection)
             {
+                pageMeta.addMetadata("focus","containerType").addContent("type:collection");
+                pageMeta.addMetadata("focus","container").addContent("hdl:"+dso.getHandle());
+                this.getObjectManager().manageObject(dso);
+            }
+            
+            if (dso instanceof Community)
+            {
+                pageMeta.addMetadata("focus","containerType").addContent("type:community");
                 pageMeta.addMetadata("focus","container").addContent("hdl:"+dso.getHandle());
                 this.getObjectManager().manageObject(dso);
             }

dspace-xmlui/src/main/java/org/dspace/app/xmlui/cocoon/ConcatenationReader.java

@@ -12,6 +12,7 @@ import com.yahoo.platform.yui.compressor.JavaScriptCompressor;
 import org.apache.avalon.framework.parameters.ParameterException;
 import org.apache.avalon.framework.parameters.Parameters;
 import org.apache.cocoon.ProcessingException;
+import org.apache.cocoon.ResourceNotFoundException;
 import org.apache.cocoon.environment.*;
 import org.apache.cocoon.reading.ResourceReader;
 import org.apache.excalibur.source.Source;
@@ -69,10 +70,19 @@ public class ConcatenationReader extends ResourceReader {
 
         // setup list of sources, get relevant parts of path
         this.inputSources = new ArrayList<Source>();
-        String path = src.substring(0, src.lastIndexOf('/'));
+        
+        // Check for an empty path
+        String path = "";
+        if(src.contains("/"))
+        {
+            path = src.substring(0, src.lastIndexOf('/'));
+        }
         String file = src.substring(src.lastIndexOf('/')+1);
 
-        // now build own list of inputsources
+        // Now build own list of inputsources
+        // Several files may be passed in at once, e.g.
+        // "themes/Mirage/lib/css/reset,base,helper,style,print.css"
+        // So, we need to build the fullPath to *each* file individually
         String[] files = file.split(",");
         for (String f : files) {
             if (file.endsWith(".json") && !f.endsWith(".json")) {
@@ -85,8 +95,21 @@ public class ConcatenationReader extends ResourceReader {
                 f += ".css";
             }
 
-            String fullPath = path + "/" + f;
-            this.inputSources.add(resolver.resolveURI(fullPath));
+            // Build full path to this individual file
+            String fullPath;
+            if(!path.isEmpty())
+                fullPath = path + "/" + f;
+            else
+                fullPath = f;
+
+            // Add to list of inputsources if this file exists
+            Source inSource = resolver.resolveURI(fullPath);
+            if(inSource.exists())
+            {
+                this.inputSources.add(inSource);
+            }
+            else // else throw a ResourceNotFound (which triggers a 404)
+                throw new ResourceNotFoundException("Resource not found (" + fullPath + ")");
         }
 
         // do super stuff

dspace-xmlui/src/main/java/org/dspace/app/xmlui/cocoon/SafeResourceReader.java

@@ -0,0 +1,68 @@
+package org.dspace.app.xmlui.cocoon;
+
+import java.io.IOException;
+import java.util.Map;
+
+import org.apache.avalon.framework.configuration.Configurable;
+import org.apache.avalon.framework.parameters.Parameters;
+import org.apache.cocoon.ResourceNotFoundException;
+import org.apache.cocoon.reading.ResourceReader;
+
+import org.apache.cocoon.ProcessingException;
+import org.apache.cocoon.caching.CacheableProcessingComponent;
+import org.apache.cocoon.environment.SourceResolver;
+import org.apache.excalibur.source.Source;
+
+import org.xml.sax.SAXException;
+
+/**
+ * The SafeResourceReader blocks access to specific paths which we do NOT want
+ * to be readable on the web. By default, the Cocoon ResourceReader just loads
+ * whatever local file you request, which is not very secure and exposes XMLUI 
+ * to possible directory traversal vulnerabilities (when encoded dots or slashes
+ * are passed on the URL).
+ */
+public class SafeResourceReader extends ResourceReader
+        implements CacheableProcessingComponent, Configurable {
+
+    /**
+     * Setup the reader.
+     * The resource is opened to get an <code>InputStream</code>,
+     * the length and the last modification date
+     */
+    @Override
+    public void setup(SourceResolver resolver, Map objectModel, String src, Parameters par)
+            throws ProcessingException, SAXException, IOException {
+
+        // If the requested path includes any of the following strings/characters
+        // then block access and return "Resource Not Found"
+        if(src != null && (
+            // %252e = double encoded dot (.)
+            src.toLowerCase().contains("%252e") ||
+            // %2e = encoded dot (.)
+            src.toLowerCase().contains("%2e") ||
+            // %2f = encoded slash (/)
+            src.toLowerCase().contains("%2f") ||
+            // block public access to all Cocoon Sitemaps (*.xmap)
+            src.toLowerCase().contains(".xmap") ||
+            // block public access to all Theme XSLs
+            src.toLowerCase().contains(".xsl")
+        ))
+        {
+            // Block access by throwing a ResourceNotFound (triggers a 404)
+            throw new ResourceNotFoundException("Resource not found (" + src + ")");
+        }
+
+        // See if this resource actually exists by attempting to resolve it
+        // If not, throw a ResourceNotFound (triggers a 404)
+        Source resource = resolver.resolveURI(src);
+        if(!resource.exists())
+        {
+            throw new ResourceNotFoundException("Resource not found (" + src + ")");
+        }    
+        
+        // Otherwise, simply load the requested resource via ResourceReader
+        super.setup(resolver, objectModel, src, par);
+    }
+
+}

dspace-xmlui/src/main/resources/aspects/Discovery/sitemap.xmap

@@ -178,17 +178,8 @@ and searching the repository.
                             <map:serialize type="xml"/>
                         </map:match>
                     </map:match>
-
-                    <map:match type="HandleAuthorizedMatcher" pattern="!READ">
-                        <map:transform type="RestrictedItem">
-                            <map:parameter name="header" value="xmlui.ArtifactBrowser.RestrictedItem.auth_header"/>
-                            <map:parameter name="message" value="xmlui.ArtifactBrowser.RestrictedItem.auth_message"/>
-                        </map:transform>
-                        <map:serialize type="xml"/>
-                    </map:match>
                 </map:match>
 
-
             </map:match> <!-- End match handle/*/** -->
 
             <!-- Not a URL we care about, so just pass it on. -->

dspace-xmlui/src/main/webapp/WEB-INF/web.xml

@@ -117,9 +117,6 @@
   <filter-mapping>
         <filter-name>dspace.request</filter-name>
         <url-pattern>/*</url-pattern>
-        <dispatcher>REQUEST</dispatcher>
-        <dispatcher>FORWARD</dispatcher>
-        <dispatcher>INCLUDE</dispatcher>
   </filter-mapping>
   
   <!--

dspace-xmlui/src/main/webapp/i18n/messages.xml

@@ -531,7 +531,7 @@
 	<!-- org.dspace.app.xmlui.Submission.submissions -->
 	<message key="xmlui.Submission.Submissions.title">Submissions &amp; Workflow</message>
 	<message key="xmlui.Submission.Submissions.trail">Submissions</message>
-	<message key="xmlui.Submission.Submissions.head">Submissions &amp; workflow tasks</message>
+	<message key="xmlui.Submission.Submissions.head">Submissions &amp; Workflow Tasks</message>
 	<message key="xmlui.Submission.Submissions.untitled"><i>Untitled</i></message>
 	<message key="xmlui.Submission.Submissions.email">email: </message>
 	<!-- Same transformer, workflow section -->

dspace-xmlui/src/main/webapp/sitemap.xmap

@@ -184,7 +184,7 @@
                         <map:selector name="AuthenticatedSelector" src="org.dspace.app.xmlui.aspect.general.AuthenticatedSelector"/>
                 </map:selectors>
                 <map:readers default="resource">
-                    <map:reader name="resource" src="org.apache.cocoon.reading.ResourceReader"
+                    <map:reader name="resource" src="org.dspace.app.xmlui.cocoon.SafeResourceReader"
                             logger="sitemap.reader.resource" pool-max="32">
                             <expires>3600000</expires> <!-- 1000 * 60 * 60 = 3600000 = One hour -->
                     </map:reader>

dspace-xmlui/src/main/webapp/static/js/bitstream-ordering.js

@@ -65,8 +65,8 @@
         }
         orderElement.val(newOrder);
 
-        var upArrow = row.find('input[name$^="submit_order_"][name$="_up"]');
-        var downArrow = row.find('input[name$^="submit_order_"][name$="_down"]');
+        var upArrow = row.find('input[name^="submit_order_"][name$="_up"]');
+        var downArrow = row.find('input[name^="submit_order_"][name$="_down"]');
 
         //Check if we are the first row, if so hide the up arrow
         if(isBundleRow(row.prev())){
@@ -93,7 +93,11 @@
      */
     function isBundleRow(row){
         // Checks if the identifier starts with the bundle head identifier
-        return row.attr("id").indexOf("aspect_administrative_item_EditItemBitstreamsForm_row_bundle_head_") == 0;
+
+        //DS-2027, found error condition in which attribute is not set when reordering original bitstreams
+    	var id = row.attr("id");
+    	if (id === undefined) return false;
+        return id.indexOf("aspect_administrative_item_EditItemBitstreamsForm_row_bundle_head_") == 0;
     }
 
 

dspace-xmlui/src/main/webapp/static/js/discovery/search-controls.js

@@ -119,7 +119,7 @@
             //Hide ourselves & clear our values!
             parentRow.find('input[type=text]", select').val('');
         }else{
-            if(parentRow.parents('table:first').find('tr[id^="aspect_discovery_SimpleSearch_row_used-filters-"]').length == 1)
+            if(parentRow.is('[id^="aspect_discovery_SimpleSearch_row_used-filters-"]') && parentRow.parents('table:first').find('tr[id^="aspect_discovery_SimpleSearch_row_used-filters-"]').length == 1)
             {
                 parentRow.next().remove();
                 parentRow.prev().remove();

dspace-xmlui/src/main/webapp/themes/Mirage/lib/xsl/core/page-structure.xsl

@@ -139,7 +139,7 @@
             initial-scale = 1.0 retains dimensions instead of zooming out if page height > device height
             maximum-scale = 1.0 retains dimensions instead of zooming in if page width < device width
             -->
-            <meta name="viewport" content="width=device-width; initial-scale=1.0; maximum-scale=1.0;"/>
+            <meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0"/>
 
             <link rel="shortcut icon">
                 <xsl:attribute name="href">

dspace-xmlui/src/main/webapp/themes/mobile/readme.txt

@@ -47,8 +47,8 @@ Installation:
 2.  Add a call for the detectmobile.js and cookies.js file in the header 
     of your current main theme.xsl file.
     It should look like:
-    <script type="text/javascript" src="/themes/mobile/lib/detectmobile.js">&#160;</script>
     <script type="text/javascript" src="/themes/mobile/lib/cookies.js">&#160;</script>
+    <script type="text/javascript" src="/themes/mobile/lib/detectmobile.js">&#160;</script>
     * In this file, we also add a "View mobile site" link in the footer
     section, which allows users to view the full site on their
     mobile devices.  The cookies.js file saves this preference 

dspace/bin/dspace

@@ -61,6 +61,12 @@ else
 fi
 
 
+# If the user only wants the CLASSPATH, just give it now.
+if [ "$1" = "classpath" ]; then
+  echo $FULLPATH
+  exit 0
+fi
+
 
 
 #Allow user to specify java options through JAVA_OPTS variable

dspace/config/crosswalks/oai/description.xml

@@ -0,0 +1 @@
+<XOAIDescription xmlns="http://www.lyncode.com/XOAIConfiguration">XOAI: OAI-PMH Java Toolkit</XOAIDescription>

dspace/config/crosswalks/oai/metadataFormats/mets.xsl

@@ -48,12 +48,14 @@
 						<mods:mods
 							xsi:schemaLocation="http://www.loc.gov/mods/v3 http://www.loc.gov/standards/mods/v3/mods-3-1.xsd">
 							<xsl:for-each select="doc:metadata/doc:element[@name='dc']/doc:element[@name='contributor']/doc:element">
-							<mods:name>
-								<mods:role>
-									<mods:roleTerm type="text"><xsl:value-of select="@name" /></mods:roleTerm>
-								</mods:role>
-								<mods:namePart><xsl:value-of select="doc:element/doc:field[@name='value']/text()" /></mods:namePart>
-							</mods:name>
+								<xsl:for-each select="doc:element/doc:field[@name='value']">
+								<mods:name>
+									<mods:role>
+										<mods:roleTerm type="text"><xsl:value-of select="../../@name" /></mods:roleTerm>
+									</mods:role>
+									<mods:namePart><xsl:value-of select="text()" /></mods:namePart>
+								</mods:name>
+								</xsl:for-each>
 							</xsl:for-each>
 							<xsl:for-each select="doc:metadata/doc:element[@name='dc']/doc:element[@name='date']/doc:element[@name='accessioned']">
 							<mods:extension>
@@ -65,7 +67,7 @@
 							<xsl:for-each select="doc:metadata/doc:element[@name='dc']/doc:element[@name='date']/doc:element[@name='available']">
 							<mods:extension>
 								<mods:dateAvailable encoding="iso8601">
-									<xsl:value-of select="doc:field[@name='value']/text()" />
+									<xsl:value-of select="doc:element/doc:field[@name='value']/text()" />
 								</mods:dateAvailable>
 							</mods:extension>
 							</xsl:for-each>

dspace/config/crosswalks/oai/metadataFormats/qdc.xsl

@@ -41,6 +41,7 @@
 		</xsl:for-each>
 		<xsl:for-each select="doc:metadata/doc:element[@name='dc']/doc:element[@name='description']/doc:element[@name='abstract']/doc:element/doc:field[@name='value']">
 			<dcterms:abstract xmlns:dcterms="http://purl.org/dc/terms/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://purl.org/dc/terms/ http://dublincore.org/schemas/xmls/qdc/2006/01/06/dcterms.xsd http://purl.org/dc/elements/1.1/ http://dublincore.org/schemas/xmls/qdc/2006/01/06/dc.xsd">
+				<xsl:value-of select="." />
 				</dcterms:abstract>
 		</xsl:for-each>
 		<xsl:for-each select="doc:metadata/doc:element[@name='dc']/doc:element[@name='date']/doc:element[@name='available']/doc:element/doc:field[@name='value']">

dspace/config/crosswalks/oai/xoai.xml

@@ -239,7 +239,7 @@
 				<Value>starts_with</Value>
 			</Parameter>
 			<Parameter key="value">
-				<Value>info:eurepo/grantAgreement/EC/FP</Value>
+				<Value>info:eu-repo/grantAgreement/EC/FP</Value>
 			</Parameter>
 		</Filter>
 	</Filters>

dspace/config/modules/discovery.cfg

@@ -5,7 +5,7 @@
 # faceted-search system.                                        #
 #---------------------------------------------------------------#
 ##### Search Indexing #####
-search.server = http://localhost:8080/solr/search
+search.server = ${solr.server}/search
 
 #Char used to ensure that the sidebar facets are case insensitive
 #solr.facets.split.char=\n|||\n

dspace/config/modules/oai.cfg

@@ -18,6 +18,9 @@ bitstream.baseUrl = ${dspace.url}
 # Base Configuration Directory
 config.dir = ${dspace.dir}/config/crosswalks/oai
 
+# Description
+description.file = ${dspace.dir}/config/crosswalks/oai/description.xml
+
 # Cache enabled?
 cache.enabled = true
 

dspace/config/modules/swordv2-server.cfg

@@ -138,7 +138,7 @@ auth-type = Basic
 
 # The location where uploaded files and packages are
 # stored while being processed
-upload.tempdir = /dspace/upload
+upload.tempdir = ${dspace.dir}/upload
 
 # The metadata field in which to store the updated date for
 # items deposited via SWORD.

dspace/modules/additions/pom.xml

@@ -17,7 +17,7 @@
    <parent>
       <groupId>org.dspace</groupId>
       <artifactId>modules</artifactId>
-      <version>4.0-SNAPSHOT</version>
+      <version>3.5</version>
       <relativePath>..</relativePath>
    </parent>
 

dspace/modules/jspui/pom.xml

@@ -12,7 +12,7 @@
     <parent>
         <groupId>org.dspace</groupId>
         <artifactId>modules</artifactId>
-        <version>4.0-SNAPSHOT</version>
+        <version>3.5</version>
         <relativePath>..</relativePath>
     </parent>
 

dspace/modules/lni/pom.xml

@@ -13,7 +13,7 @@
    <parent>
       <groupId>org.dspace</groupId>
       <artifactId>modules</artifactId>
-      <version>4.0-SNAPSHOT</version>
+      <version>3.5</version>
       <relativePath>..</relativePath>
    </parent>
 

dspace/modules/oai/pom.xml

@@ -12,7 +12,7 @@
     <parent>
         <artifactId>modules</artifactId>
         <groupId>org.dspace</groupId>
-        <version>4.0-SNAPSHOT</version>
+        <version>3.5</version>
         <relativePath>..</relativePath>
     </parent>
 

dspace/modules/pom.xml

@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>org.dspace</groupId>
 		<artifactId>dspace-parent</artifactId>
-		<version>4.0-SNAPSHOT</version>
+		<version>3.5</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 

dspace/modules/solr/pom.xml

@@ -2,7 +2,7 @@
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.dspace.modules</groupId>
    <artifactId>solr</artifactId>
-   <version>4.0-SNAPSHOT</version>
+   <version>3.5</version>
    <packaging>war</packaging>
    <name>DSpace SOLR :: Local Customizations</name>
    <description>
@@ -13,7 +13,7 @@
    <parent>
       <groupId>org.dspace</groupId>
       <artifactId>modules</artifactId>
-      <version>4.0-SNAPSHOT</version>
+      <version>3.5</version>
       <relativePath>..</relativePath>
    </parent>
 

dspace/modules/sword/pom.xml

@@ -16,7 +16,7 @@
    <parent>
       <groupId>org.dspace</groupId>
       <artifactId>modules</artifactId>
-      <version>4.0-SNAPSHOT</version>
+      <version>3.5</version>
       <relativePath>..</relativePath>
    </parent>
 

dspace/modules/swordv2/pom.xml

@@ -16,7 +16,7 @@
    <parent>
       <groupId>org.dspace</groupId>
       <artifactId>modules</artifactId>
-      <version>4.0-SNAPSHOT</version>
+      <version>3.5</version>
       <relativePath>..</relativePath>
    </parent>
 

dspace/modules/xmlui/pom.xml

@@ -12,7 +12,7 @@
    <parent>
       <groupId>org.dspace</groupId>
       <artifactId>modules</artifactId>
-      <version>4.0-SNAPSHOT</version>
+      <version>3.5</version>
       <relativePath>..</relativePath>
    </parent>
 

dspace/pom.xml

@@ -15,7 +15,7 @@
     <parent>
         <groupId>org.dspace</groupId>
         <artifactId>dspace-parent</artifactId>
-        <version>4.0-SNAPSHOT</version>
+        <version>3.5</version>
         <relativePath>..</relativePath>
     </parent>
 

dspace/src/main/assembly/release.xml

@@ -43,6 +43,23 @@
             <exclude>**/target/**</exclude>
             <exclude>.*</exclude>
          </excludes>
+         <!-- Ensure line endings in all files are Unix (LF) line endings-->
+         <lineEnding>unix</lineEnding>
+      </fileSet>
+      <!-- Ensure the presence of "empty" overlay directories for build
+           steps that need them.
+           By default our ".gitignore" files are excluded by
+           "useDefaultExcludes=true". -->
+      <fileSet>
+         <directory>..</directory>
+         <useDefaultExcludes>false</useDefaultExcludes>
+         <includes>
+            <include>dspace/modules/**/.gitignore</include>
+         </includes>
+         <excludes>
+            <exclude>**/target/**</exclude>
+         </excludes>
+         <lineEnding>unix</lineEnding>
       </fileSet>
    </fileSets>
 

dspace/src/main/assembly/src-release.xml

@@ -13,9 +13,9 @@
     This assembly creates the full source code 'zip/tarball' distribution
     of DSpace which can be made available via SourceForge or similar.
 -->
-<assembly xmlns="http://maven.apache.org/POM/4.0.0"
+<assembly xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/assembly-1.1.0-SNAPSHOT.xsd">
+          xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0 http://maven.apache.org/xsd/assembly-1.1.0.xsd">
    <id>src-release</id>
    <formats>
       <format>zip</format>
@@ -29,12 +29,65 @@
          <!-- Select files from the parent directory (i.e. [dspace-src])-->
          <directory>..</directory>
          <useDefaultExcludes>true</useDefaultExcludes>
-         <!-- Include all files except target directories & dot files -->
+         <!-- Include all files except target directories, dot files,
+	      binaries -->
          <excludes>
             <exclude>**/target/**</exclude>
             <exclude>.*</exclude>
+	    <exclude>**/*.bmp</exclude>
+	    <exclude>**/*.eot</exclude>
+	    <exclude>**/*.gif</exclude>
+	    <exclude>**/*.ico</exclude>
+	    <exclude>**/*.jpg</exclude>
+	    <exclude>**/*.pdf</exclude>
+	    <exclude>**/*.png</exclude>
+	    <exclude>**/*.psd</exclude>
+	    <exclude>**/*.ttf</exclude>
+	    <exclude>**/*.woff</exclude>
+            <exclude>**/*.zip</exclude>
          </excludes>
+         <!-- Ensure line endings in all text files are Unix (LF) line
+	      endings-->
+         <lineEnding>unix</lineEnding>
+      </fileSet>
+      <!-- Do not destroy binary files by changing "line" endings!
+           (e.g. SWORD's example.zip) -->
+      <fileSet>
+         <directory>..</directory>
+         <useDefaultExcludes>true</useDefaultExcludes>
+         <includes>
+	    <include>**/*.bmp</include>
+	    <include>**/*.eot</include>
+	    <include>**/*.gif</include>
+	    <include>**/*.ico</include>
+	    <include>**/*.jpg</include>
+	    <include>**/*.pdf</include>
+	    <include>**/*.png</include>
+	    <include>**/*.psd</include>
+	    <include>**/*.ttf</include>
+	    <include>**/*.woff</include>
+            <include>**/*.zip</include>
+         </includes>
+         <excludes>
+            <exclude>**/target/**</exclude>
+         </excludes>
+	 <lineEnding>keep</lineEnding>
+      </fileSet>
+      <!-- Ensure the presence of "empty" overlay directories for build
+           steps that need them.
+           By default our ".gitignore" files are excluded by
+           "useDefaultExcludes=true". -->
+      <fileSet>
+         <directory>..</directory>
+         <useDefaultExcludes>false</useDefaultExcludes>
+         <includes>
+            <include>dspace/modules/**/.gitignore</include>
+         </includes>
+         <excludes>
+            <exclude>**/target/**</exclude>
+         </excludes>
+         <lineEnding>unix</lineEnding>
       </fileSet>
    </fileSets>
 
-</assembly>
+</assembly>

dspace/src/main/config/build.xml

@@ -142,6 +142,7 @@ Common usage:
         <echo message="load_registries --> Load metadata &amp; file format registries into the " />
         <echo message="                    database" />
         <echo message="" />
+        <echo message="clean_backups  --> Remove .bak directories under install directory" />
         <echo message="clean_database  --> Remove DSpace database tables, destroying data" />
         <echo message="" />
         <echo message="" />

pom.xml

@@ -4,7 +4,7 @@
    <groupId>org.dspace</groupId>
    <artifactId>dspace-parent</artifactId>
    <packaging>pom</packaging>
-   <version>4.0-SNAPSHOT</version>
+   <version>3.5</version>
    <name>DSpace Parent Project</name>
    <url>https://github.com/dspace/DSpace</url>
 
@@ -93,7 +93,7 @@
              </plugin>
              <plugin>
                 <artifactId>maven-assembly-plugin</artifactId>
-                <version>2.2.1</version>
+                <version>2.4.1</version>
              </plugin>
              <plugin>
                 <groupId>com.mycila.maven-license-plugin</groupId>
@@ -108,7 +108,7 @@
       <plugins>
          <plugin>
             <artifactId>maven-release-plugin</artifactId>
-            <version>2.3.2</version>
+            <version>2.5</version>
             <configuration>
                 <!-- During release:perform, enable the "release" profile (see below) -->
                 <releaseProfiles>release</releaseProfiles>
@@ -377,7 +377,7 @@
         </profile>
 
         <!--
-           Builds LNI WAR for DSpace
+           Builds LNI WAR & Client for DSpace
         -->
         <profile>
             <id>dspace-lni</id>
@@ -388,6 +388,7 @@
             </activation>
             <modules>
                 <module>dspace-lni</module>
+                <module>dspace-lni/dspace-lni-client</module>
             </modules>
         </profile>
 
@@ -444,71 +445,71 @@
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-api</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
          </dependency>
          <dependency>
             <groupId>org.dspace.modules</groupId>
             <artifactId>additions</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
          </dependency>
 
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-sword</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>jar</type>
             <classifier>classes</classifier>
          </dependency>
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-sword</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>war</type>
          </dependency>
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-swordv2</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>jar</type>
             <classifier>classes</classifier>
          </dependency>
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-swordv2</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>war</type>
          </dependency>
 
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-jspui</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>jar</type>
             <classifier>classes</classifier>
          </dependency>
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-jspui</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>war</type>
          </dependency>
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-oai</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>jar</type>
             <classifier>classes</classifier>
          </dependency>
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-oai</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>war</type>
          </dependency>
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-lni</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>jar</type>
             <classifier>classes</classifier>
          </dependency>
@@ -520,26 +521,26 @@
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-lni</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>war</type>
          </dependency>
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-xmlui</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>jar</type>
             <classifier>classes</classifier>
          </dependency>
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-xmlui</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
             <type>war</type>
          </dependency>
          <dependency>
             <groupId>org.dspace</groupId>
             <artifactId>dspace-services</artifactId>
-            <version>4.0-SNAPSHOT</version>
+            <version>3.5</version>
          </dependency>
          <!-- DSpace Localization Packages -->
          <dependency>
@@ -1179,7 +1180,7 @@
       <connection>scm:git:git@github.com:DSpace/DSpace.git</connection>
       <developerConnection>scm:git:git@github.com:DSpace/DSpace.git</developerConnection>
       <url>git@github.com:DSpace/DSpace.git</url>
-     <tag>HEAD</tag>
+     <tag>dspace-3.5</tag>
   </scm>
 
     <!--
@@ -1196,8 +1197,8 @@
         <repository>
             <id>sonatype-releases</id>
             <name>Sonatype Releases Repository</name>
-            <url>http://oss.sonatype.org/content/repositories/releases/</url>
+            <url>https://oss.sonatype.org/content/repositories/releases/</url>
         </repository>
     </repositories>
-    
+
 </project>