Description: Fixes CVE-2015-5351: The Manager and Host Manager applications establish
 sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers
 to bypass a CSRF protection mechanism by using a token.
Author: Markus Koschany <apo@debian.org>
Origin: backport, https://svn.apache.org/r1720658
                  https://svn.apache.org/r1720660
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -341,6 +341,13 @@
         Handle the unlikely case where different versions of a web application
         are deployed with different session settings. (markt)
       </fix>
+      <fix>
+        Don't create sessions unnecessarily in the Manager application. (markt)
+      </fix>
+      <fix>
+        Don't create sessions unnecessarily in the Host Manager application.
+        (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="WebSocket">
--- a/webapps/host-manager/WEB-INF/jsp/401.jsp
+++ b/webapps/host-manager/WEB-INF/jsp/401.jsp
@@ -14,6 +14,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 --%>
+<%@ page session="false" trimDirectiveWhitespaces="true" %>
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
 <html>
  <head>
--- a/webapps/host-manager/WEB-INF/jsp/403.jsp
+++ b/webapps/host-manager/WEB-INF/jsp/403.jsp
@@ -14,6 +14,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 --%>
+<%@ page session="false" trimDirectiveWhitespaces="true" %>
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
 <html>
  <head>
--- a/webapps/host-manager/WEB-INF/jsp/404.jsp
+++ b/webapps/host-manager/WEB-INF/jsp/404.jsp
@@ -14,7 +14,8 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 --%>
-<%@ page import="org.apache.catalina.util.RequestUtil" %>
+<%@ page import="org.apache.catalina.util.RequestUtil" session="false"
+         trimDirectiveWhitespaces="true" %>
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
 <html>
  <head>
--- a/webapps/host-manager/index.jsp
+++ b/webapps/host-manager/index.jsp
@@ -14,5 +14,5 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 --%>
-<% response.sendRedirect(response.encodeRedirectURL(request.getContextPath() +
-        "/html")); %>
\ No newline at end of file
+<%@ page session="false" trimDirectiveWhitespaces="true" %>
+<% response.sendRedirect(request.getContextPath() + "/html"); %>
\ No newline at end of file
--- a/webapps/manager/WEB-INF/web.xml
+++ b/webapps/manager/WEB-INF/web.xml
@@ -115,7 +115,6 @@
   <filter-mapping>
     <filter-name>CSRF</filter-name>
     <servlet-name>HTMLManager</servlet-name>
-    <servlet-name>jsp</servlet-name>
   </filter-mapping>
 
   <!-- Define a Security Constraint on this Application -->
--- a/webapps/manager/index.jsp
+++ b/webapps/manager/index.jsp
@@ -14,5 +14,5 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 --%>
-<% response.sendRedirect(response.encodeRedirectURL(request.getContextPath() +
-        "/html")); %>
\ No newline at end of file
+<%@ page session="false" %>
+<% response.sendRedirect(request.getContextPath() + "/html"); %>
\ No newline at end of file
