Bug fixes

webgoat-lessons/client-side-filtering/src/main/java/org/owasp/webgoat/client_side_filtering/Salaries.java

@@ -22,12 +22,12 @@
 
 package org.owasp.webgoat.client_side_filtering;
 
-import lombok.SneakyThrows;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.util.FileCopyUtils;
-import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 import org.xml.sax.InputSource;
@@ -47,6 +47,7 @@
 import java.util.List;
 import java.util.Map;
 
+@RestController
 public class Salaries { // {extends Endpoint {
 
     @Value("${webgoat.user.directory}")
@@ -66,7 +67,7 @@ public void copyFiles() {
         }
     }
 
-    @RequestMapping(produces = {"application/json"})
+    @GetMapping("clientSideFiltering/salaries")
     @ResponseBody
     public List<Map<String, Object>> invoke() throws ServletException, IOException {
         NodeList nodes = null;

webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTRefreshEndpoint.java

@@ -58,7 +58,7 @@ public ResponseEntity follow(@RequestBody(required = false) Map<String, Object>
         String user = (String) json.get("user");
         String password = (String) json.get("password");
 
-        if ("Jerry".equals(user) && PASSWORD.equals(password)) {
+        if ("Jerry".equalsIgnoreCase(user) && PASSWORD.equals(password)) {
             return ok(createNewTokens(user));
         }
         return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();

webgoat-lessons/jwt/src/main/resources/html/JWT.html

@@ -122,6 +122,7 @@ <h3>Vote for your favorite</h3>
     <link rel="stylesheet" type="text/css" th:href="@{/lesson_css/jwt.css}"/>
     <script th:src="@{/lesson_js/bootstrap.min.js}" language="JavaScript"></script>
     <script th:src="@{/lesson_js/jwt-buy.js}" language="JavaScript"></script>
+    <script th:src="@{/lesson_js/jwt-refresh.js}" language="JavaScript"></script>
     <div class="attack-container">
         <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <form class="attack-form" accept-charset="UNKNOWN"

webgoat-lessons/jwt/src/main/resources/js/jwt-voting.js

@@ -76,7 +76,7 @@ function vote(title) {
     } else {
         $.ajax({
             type: 'POST',
-            url: 'JWT/votings/vote/' + title
+            url: 'JWT/votings/' + title
         }).then(
             function () {
                 getVotings();

webgoat-lessons/sol.MD

@@ -1,3 +1,6 @@
+https://github.com/WebGoat/WebGoat/wiki/(Almost)-Fully-Documented-Solution-(en)
+
+
 ### SQLi ###  
 
 Basic