Index: ssts-web/src/main/resources/spring/applicationContext-acegi-security.xml
===================================================================
diff -u -r12331 -r12335
--- ssts-web/src/main/resources/spring/applicationContext-acegi-security.xml	(.../applicationContext-acegi-security.xml)	(revision 12331)
+++ ssts-web/src/main/resources/spring/applicationContext-acegi-security.xml	(.../applicationContext-acegi-security.xml)	(revision 12335)
@@ -1,93 +1,101 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <beans:beans xmlns="http://www.springframework.org/schema/security"
-    xmlns:beans="http://www.springframework.org/schema/beans" 
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
-                        http://www.springframework.org/schema/security 
-                        http://www.springframework.org/schema/security/spring-security-2.0.4.xsd" default-autowire="byName">
-    <authentication-manager alias="authenticationManager" />
-    <beans:bean id="accessDecisionManager"
-        class="org.springframework.security.vote.AffirmativeBased">
-        <beans:property name="allowIfAllAbstainDecisions"
-            value="false" />
-        <beans:property name="decisionVoters">
-            <beans:list>
-                <beans:bean class="org.springframework.security.vote.RoleVoter" />
-                <beans:bean class="org.springframework.security.vote.AuthenticatedVoter" />
-            </beans:list>
-        </beans:property>
-    </beans:bean>
-    <!--
-        beans:bean id="filterInvocationInterceptor"
-        class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
-        <beans:property name="authenticationManager"
-        ref="authenticationManager" /> <beans:property
-        name="accessDecisionManager" ref="accessDecisionManager" />
-        <beans:property name="objectDefinitionSource"
-        ref="secureResourceFilter" /> </beans:bean> <beans:bean
-        id="secureResourceFilter"
-        class="org.springframework.security.intercept.web.DefaultFilterInvocationDefinitionSource"
-        /
-    -->
-    <http auto-config="true" access-denied-page="/403.jsp">
-        <concurrent-session-control max-sessions="1000"
-            exception-if-maximum-exceeded="false" session-registry-alias="sessionRegistry" />
-        <form-login login-page="/"
-            authentication-failure-url="/logon.jsp?login_error=1" default-target-url="/openSystemMainPage.jsp" />
-        
-        <!-- 登陆界面使用https协议配置 -->    
-        <!-- <port-mappings><port-mapping http="8081" https="443"/></port-mappings>
-	    <intercept-url pattern="/logon**" access="IS_AUTHENTICATED_ANONYMOUSLY" requires-channel="https" />
-	    <intercept-url pattern="/j_spring_security_check" access="IS_AUTHENTICATED_ANONYMOUSLY" requires-channel="https" /> -->
-        
-            
-        <!-- 是否登录，是在web.xml的过滤器中设置，这里暂时不需要，因为没有全体用户角色了
-        <intercept-url pattern="/js/**" access="ROLE_ANONYMOUS_0,ROLE_USER_0" />
-        <intercept-url pattern="/images/**" access="ROLE_ANONYMOUS_0,ROLE_USER_0" />
-        <intercept-url pattern="/logon.jsp" access="ROLE_ANONYMOUS_0,ROLE_USER_0" />
-         -->
-         
-        <!-- <intercept-url pattern="/**" requires-channel="http" />
-    	<remember-me/> -->
-         
-         
-        <x509 subject-principal-regex="CN=(.*)" />
-              
-        <!-- port-mappings>
-            <port-mapping http="8080" https="8443"/>
-        </port-mappings-->
-        
-    </http>
-    <beans:bean id="loggerListener"
-        class="org.springframework.security.event.authentication.LoggerListener" />
+	xmlns:beans="http://www.springframework.org/schema/beans" 
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans
+	http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+	http://www.springframework.org/schema/security
+	http://www.springframework.org/schema/security/spring-security-3.2.xsd">
+	
+	<debug />
     
-    <beans:bean id="daoUserDetail"
-        class="com.forgon.disinfectsystem.security.userdetails.DaoUserDetailSSTSImpl" >
-        <beans:property name="sysUserManager" ref="sysUserManager" />
-        <beans:property name="directoryHelper" ref="directoryHelper" />
-        <beans:property name="roleManager" ref="roleManager" />
-        <beans:property name ="supplyRoomConfigManager" ref="supplyRoomConfigManager" />
-        <beans:property name ="orgUnitManager" ref="orgUnitManager" />
-    </beans:bean>
+    <authentication-manager alias="authenticationManager" >
+        <authentication-provider user-service-ref="daoUserDetail">
+        	<password-encoder hash="md5" />
+    	</authentication-provider>
+    </authentication-manager>
     
+	<!-- enable use-expressions -->
+	<!--http auto-config="true" use-expressions="true">
+		<intercept-url pattern="/admin**" access="hasRole('ROLE_ADMIN')" /-->
+
+		<!-- access denied page -->
+		<!--access-denied-handler error-page="/403" /-->
+		<!-- form-login 
+		    login-page="/logon22.jsp" 
+		    default-target-url="/openSystemMainPage.jsp"
+			authentication-failure-url="/logon.jsp?login_error=1" 
+			username-parameter="username"
+			password-parameter="password" /-->
+		<!--logout logout-success-url="/login?logout" /-->
+		<!--csrf /-->
+	<!--/http-->    
+    
+    <http auto-config="true"  use-expressions="true">
+			<intercept-url pattern="/login" access="permitAll"></intercept-url>
+			<intercept-url pattern="/logout" access="permitAll"></intercept-url>
+			<intercept-url pattern="/accessdenied" access="permitAll"></intercept-url>
+			<intercept-url pattern="/logon.jsp" access="permitAll"></intercept-url>
+			<intercept-url pattern="/debug/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/disinfectsystem/config/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/disinfectsystem/common/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/disinfectSystem/fileUploadServlet/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/CodeImageServlet/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/fckeditor/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/UserUpLoadFiles/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/openSystemMainPage.jsp" access="permitAll"></intercept-url>
+			<intercept-url pattern="/favicon.ico" access="permitAll"></intercept-url>
+			<intercept-url pattern="/common/taglibs.jsp" access="permitAll"></intercept-url>
+			<intercept-url pattern="/js/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/jquery/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/ext/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/dwr/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/images/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/styles/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/scripts/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/themes/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/services/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/mobileClient/**" access="permitAll"></intercept-url>
+			<intercept-url pattern="/disinfectSystem/sterilization/sterilizationRecordAction!uploadSterilizationRecordPic.do" access="permitAll"></intercept-url>
+
+			<!--  user is not an anonymous or a remember-me user -->
+			<intercept-url pattern="/**" access="isFullyAuthenticated()"></intercept-url>
+			<form-login login-page="/logon.jsp" default-target-url="/openSystemMainPage.jsp" authentication-failure-url="/logon.jsp?login_error=1"></form-login>
+			
+			<access-denied-handler error-page="/logon.jsp"/>
+			<logout logout-success-url="/logon.jsp"></logout>
+			<session-management>
+				<concurrency-control max-sessions="1"
+					session-registry-alias="sessionRegistry" />
+			</session-management>
+	</http>
+ 
+    <beans:bean id="loggerListener"
+        class="org.springframework.security.access.event.LoggerListener" />
+    
+<!--     <beans:bean id="daoUserDetail" -->
+<!--         class="com.forgon.disinfectsystem.security.userdetails.DaoUserDetailSSTSImpl" > -->
+<!--         <beans:property name="userManager" ref="userManager" /> -->
+<!--         <beans:property name="sysUserManager" ref="sysUserManager" /> -->
+<!--         <beans:property name="directoryHelper" ref="directoryHelper" /> -->
+<!--         <beans:property name="roleManager" ref="roleManager" /> -->
+<!--         <beans:property name ="supplyRoomConfigManager" ref="supplyRoomConfigManager" /> -->
+<!--         <beans:property name ="orgUnitManager" ref="orgUnitManager" /> -->
+<!--     </beans:bean> -->
+
     <beans:bean id="logoutFilter"
-    	class="org.springframework.security.ui.logout.LogoutFilter">
-    	<custom-filter before="LOGOUT_FILTER"/>
+    	class="org.springframework.security.web.authentication.logout.LogoutFilter">
     	<!-- 退出后指向的 URL -->
     	<beans:constructor-arg value="/" />
     	<beans:constructor-arg>
     		<beans:list>
     			<beans:bean
-    				class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" />
+    				class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
     			<beans:ref bean="logoutHandler"/>
     		</beans:list>
     	</beans:constructor-arg>
     </beans:bean>
 
-    <authentication-provider user-service-ref="daoUserDetail">
-        <password-encoder hash="md5" />
-    </authentication-provider>
-    
     <!-- 
     <beans:bean id="jdbcUserDetailsManager"
         class="org.springframework.security.userdetails.jdbc.JdbcUserDetailsManager">
@@ -96,5 +104,5 @@
     </beans:bean>
      -->
 
-    <beans:bean id="sessionRegistry" class="org.springframework.security.concurrent.SessionRegistryImpl"/>
+    <beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>
 </beans:beans>
\ No newline at end of file