From 563c0a6fe55744af323e82eaa168e2fc0416626d Mon Sep 17 00:00:00 2001
From: brianbrix <mokandubrian@gmail.com>
Date: Wed, 16 Sep 2026 10:03:47 +0300
Subject: [PATCH 1/4] AMP-31212 : Enhance security by securing cookies and
 ensuring coss-site restrictions

---
 amp/context.xml                                        | 8 +++-----
 amp/docker/server.xml                                  | 4 ++--
 amp/src/main/java/org/digijava/kernel/util/DgUtil.java | 2 ++
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/amp/context.xml b/amp/context.xml
index ac48b2a4f43..6fff5c76335 100644
--- a/amp/context.xml
+++ b/amp/context.xml
@@ -1,14 +1,12 @@
 <?xml version="1.0"?>
  
-<Context path="/" debug="0" reloadable="false" unloadDelay="4000" swallowOutput="true"
+<Context path="/" debug="0" reloadable="false" unloadDelay="4000" swallowOutput="true" useHttpOnly="true"
 allowLinking="true" antiJARLocking="" antiResourceLocking="" clearReferencesStopTimerThreads="true"
 clearReferencesThreadLocals="true" jndiExceptionOnFailedWrite="false" processTlds="false">
   <Environment name="hostname" value="" type="java.lang.String"/> 
 
-  <!-- SameSite=Lax: browser will not send the session cookie on cross-site
-       POST/PUT/DELETE requests, providing CSRF protection for all endpoints
-       including /rest/** without requiring any token in requests. -->
-  <CookieProcessor sameSiteCookies="lax" />
+    <!-- Strict prevents session cookies from being sent in cross-site requests. -->
+    <CookieProcessor sameSiteCookies="strict" />
   <!-- PostgreSQL connection -->
   <Resource factory="org.apache.tomcat.jdbc.pool.DataSourceFactory" 
   	defaultTransactionIsolation="READ_COMMITTED" 
diff --git a/amp/docker/server.xml b/amp/docker/server.xml
index 7a60eb7bcb6..2d07439dd30 100644
--- a/amp/docker/server.xml
+++ b/amp/docker/server.xml
@@ -44,7 +44,7 @@
 
     <Connector port="8080" URIEncoding="UTF-8" protocol="HTTP/1.1"
                connectionTimeout="20000"
-               redirectPort="8443"
+           redirectPort="8443" server="AMP"
                relaxedQueryChars="|{}" />
 
     <Engine name="Catalina" defaultHost="localhost">
@@ -63,7 +63,7 @@
         <!-- Internal proxies regex matches the following ips: 10/8, 192.168/16, 169.254/16, 127/8 and 172.16/12 -->
         <Valve className="org.apache.catalina.valves.RemoteIpValve"
                internalProxies="172\.(?:16|17|18|19|2\d|30|31)\.\d{1,3}\.\d{1,3}|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}"
-               protocolHeader="x-forwarded-proto" />
+               protocolHeader="x-forwarded-proto" portHeader="x-forwarded-port" />
 
       </Host>
     </Engine>
diff --git a/amp/src/main/java/org/digijava/kernel/util/DgUtil.java b/amp/src/main/java/org/digijava/kernel/util/DgUtil.java
index cf6fdd0976b..c8d858abc47 100644
--- a/amp/src/main/java/org/digijava/kernel/util/DgUtil.java
+++ b/amp/src/main/java/org/digijava/kernel/util/DgUtil.java
@@ -265,6 +265,8 @@ private static void setLanguageCookie(Locale language, HttpServletRequest reques
             cookiePath = "/";
         }
         cookie.setPath(cookiePath);
+        cookie.setHttpOnly(true);
+        cookie.setSecure(request.isSecure());
         response.addCookie(cookie);
     }
 

From f258f39fe17a4807c88bc936df406c30e1596640 Mon Sep 17 00:00:00 2001
From: brianbrix <mokandubrian@gmail.com>
Date: Wed, 16 Sep 2026 12:36:49 +0300
Subject: [PATCH 2/4] AMP-31212 : Fixing failing docker build

---
 amp/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/amp/Dockerfile b/amp/Dockerfile
index 903d1a37a87..e83174d1297 100644
--- a/amp/Dockerfile
+++ b/amp/Dockerfile
@@ -233,7 +233,7 @@ RUN --mount=type=cache,target=/root/.m2 \
         && rm -rf target; \
     fi
 
-FROM tomcat:8.5.79-jdk8
+FROM tomcat:8.5-jdk8-temurin
 
 RUN apt-get update \
     && apt-get install -y apt-transport-https ca-certificates curl gnupg --no-install-recommends \

From 9c62ce9aa1f5fe2fea9d2bf126ce7bc0c966cff2 Mon Sep 17 00:00:00 2001
From: brianbrix <mokandubrian@gmail.com>
Date: Wed, 16 Sep 2026 13:17:57 +0300
Subject: [PATCH 3/4] AMP-31212 : Fixing failing docker build

---
 amp/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/amp/Dockerfile b/amp/Dockerfile
index e83174d1297..95ddca69fff 100644
--- a/amp/Dockerfile
+++ b/amp/Dockerfile
@@ -233,7 +233,7 @@ RUN --mount=type=cache,target=/root/.m2 \
         && rm -rf target; \
     fi
 
-FROM tomcat:8.5-jdk8-temurin
+FROM tomcat:8.5.94-jdk8-temurin-focal
 
 RUN apt-get update \
     && apt-get install -y apt-transport-https ca-certificates curl gnupg --no-install-recommends \

From 4d6f010019e105cba7a4ca418bc7217560fc4e3e Mon Sep 17 00:00:00 2001
From: brianbrix <mokandubrian@gmail.com>
Date: Wed, 16 Sep 2026 13:55:12 +0300
Subject: [PATCH 4/4] AMP-31212 : Wrongly formatted patch

---
 .../main/resources/xmlpatches/4.0/Update-Import-Tables-v4.xml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/amp/src/main/resources/xmlpatches/4.0/Update-Import-Tables-v4.xml b/amp/src/main/resources/xmlpatches/4.0/Update-Import-Tables-v4.xml
index 3485a20f517..a3c82f121fd 100644
--- a/amp/src/main/resources/xmlpatches/4.0/Update-Import-Tables-v4.xml
+++ b/amp/src/main/resources/xmlpatches/4.0/Update-Import-Tables-v4.xml
@@ -12,4 +12,4 @@
             </lang>
         </script>
     </apply>
-</tns:patch
\ No newline at end of file
+</tns:patch>
\ No newline at end of file