From c9b328d8c71018926dad00dfa83e762c66f0cb8c Mon Sep 17 00:00:00 2001
From: Rob Winch <rwinch@gmail.com>
Date: Thu, 2 Jun 2011 21:19:01 -0500
Subject: [PATCH] SEC-1757: Updated tutorial sample to state that listing of
 accounts is allowed by anyone and to display accounts for the different types
 of access to posting to Accounts

---
 .../tutorial/src/main/webapp/WEB-INF/jsp/listAccounts.jsp | 8 ++++++++
 samples/tutorial/src/main/webapp/index.jsp                | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/samples/tutorial/src/main/webapp/WEB-INF/jsp/listAccounts.jsp b/samples/tutorial/src/main/webapp/WEB-INF/jsp/listAccounts.jsp
index 61d2ce0473..b2200c8507 100644
--- a/samples/tutorial/src/main/webapp/WEB-INF/jsp/listAccounts.jsp
+++ b/samples/tutorial/src/main/webapp/WEB-INF/jsp/listAccounts.jsp
@@ -12,6 +12,14 @@
 <div id="content">
 
 <h1>Accounts</h1>
+<p>
+Anyone can view this page, but posting to an Account requires login and must be authorized. Below are some users to try posting to Accounts with.
+</p>
+<ul>
+<li>rod/koala - can post to any Account</li>
+<li>dianne/emu - can post to Accounts as long as the balance remains above the overdraft amount</li>
+<li>scott/wombat - cannot post to any Accounts</li>
+</ul>
 
 <a href="index.jsp">Home</a><br><br>
 
diff --git a/samples/tutorial/src/main/webapp/index.jsp b/samples/tutorial/src/main/webapp/index.jsp
index efe4989a82..cf102f3111 100644
--- a/samples/tutorial/src/main/webapp/index.jsp
+++ b/samples/tutorial/src/main/webapp/index.jsp
@@ -18,7 +18,7 @@
 Anyone can view this page.
 </p>
 <p>
-If you're logged in, you can <a href="listAccounts.html">list accounts</a>.
+While anyone can also view the <a href="listAccounts.html">list accounts</a> page, you must be authorized to post to an Account from the list accounts page.
 </p>
 <p>
 Your principal object is....: <%= request.getUserPrincipal() %>