var owaspCSRFGuardScriptHasLoaded=owaspCSRFGuardScriptHasLoaded||{};if(!0!==owaspCSRFGuardScriptHasLoaded)!function(){if(owaspCSRFGuardScriptHasLoaded=!0,!window.csrfguarded){var e,t={listEvents:e=[],add:function(t,n,s){e.push(arguments)},flush:function(){var t,n;for(t=e.length-1;t>=0;t-=1){if((n=e[t])[0].removeEventListener)n[0].removeEventListener(n[1],n[2],n[3]);if('on'!==n[1].substring(0,2))n[1]='on'+n[1];if(n[0].detachEvent)n[0].detachEvent(n[1],n[2])}}},n='www.iso.org'.split(',');if(d(document.domain,n)){var s='CSRFTOKEN',i='6NPP-J9X1-BJGJ-C8QS-PDJ6-9HVF-AGJW-0W7Y',o={isDomContentLoaded:!1},r={pageTokens:{}};if(a(window,'unload',t.flush),a(window,'DOMContentLoaded',(function(){if(o.isDomContentLoaded=!0,r.pageTokensLoaded)y(s,i,r.pageTokens)})),false)!function(){const e='';if(e)a(window,e,(function(e){T([e.detail],s,i,r.pageTokens)}));else if(MutationObserver){const e=new MutationObserver((function(e,t){for(let t in e){const n=e[t],o=n.addedNodes;if('childList'===n.type&&o.length&&o.length>0)T(o,s,i,r.pageTokens)}}));e.observe(document,{attributes:!1,childList:!0,subtree:!0}),a(window,'unload',e.disconnect)}else a(window,'DOMNodeInserted',(function(e){const t=e.target||e.srcElement;if('DOMNodeInserted'===e.type)T([t],s,i,r.pageTokens)}))}();if(true){if('Microsoft Internet Explorer'===navigator.appName)!function(){var e=window.XMLHttpRequest;function t(){this.base=e?new e:new window.ActiveXObject('Microsoft.XMLHTTP')}function n(){return new t}n.prototype=t.prototype,n.UNSENT=0,n.OPENED=1,n.HEADERS_RECEIVED=2,n.LOADING=3,n.DONE=4,n.prototype.status=0,n.prototype.statusText='',n.prototype.readyState=n.UNSENT,n.prototype.responseText='',n.prototype.responseXML=null,n.prototype.onsend=null,n.url=null,n.onreadystatechange=null,n.prototype.open=function(e,t,n,s,i){var o=this;this.url=t,this.base.onreadystatechange=function(){try{o.status=o.base.status}catch(e){}try{o.statusText=o.base.statusText}catch(e){}try{o.readyState=o.base.readyState}catch(e){}try{o.responseText=o.base.responseText}catch(e){}try{o.responseXML=o.base.responseXML}catch(e){}if(null!==o.onreadystatechange)o.onreadystatechange.apply(this,arguments)},this.base.open(e,t,n,s,i)},n.prototype.send=function(e){if(null!==this.onsend)this.onsend.apply(this,arguments);this.base.send(e)},n.prototype.abort=function(){this.base.abort()},n.prototype.getAllResponseHeaders=function(){return this.base.getAllResponseHeaders()},n.prototype.getResponseHeader=function(e){return this.base.getResponseHeader(e)},n.prototype.setRequestHeader=function(e,t){return this.base.setRequestHeader(e,t)},window.XMLHttpRequest=n}();else XMLHttpRequest.prototype._open=XMLHttpRequest.prototype.open,XMLHttpRequest.prototype.open=function(e,t,n,s,i){this.url=t,this._open.apply(this,arguments)},XMLHttpRequest.prototype._send=XMLHttpRequest.prototype.send,XMLHttpRequest.prototype.send=function(e){if(null!==this.onsend)this.onsend.apply(this,arguments);this._send.apply(this,arguments)};XMLHttpRequest.prototype.onsend=function(e){a(this,'readystatechange',(function(){if(4===this.readyState)if(-1!==this.getAllResponseHeaders().indexOf(s)){let e=this.getResponseHeader(s);try{let t=JSON.parse(e),n=t.masterToken;if(void 0!==n)i=n;let o=t.pageTokens;if(void 0!==o)Object.keys(o).forEach((function(e){return r.pageTokens[e]=o[e]}));y(s,i,r.pageTokens)}catch(e){console.error('Error while updating tokens from response header.')}}}));if(c(this.url)&&f(this.url)){this.setRequestHeader('X-Requested-With','XMLHttpRequest');let e=function(e){var t=function(e,t){let n=e.indexOf(t);return n>0?e.substring(0,n):e};let n=u(e,'/')?e:'/'+e;return n=t(n,'?'),n=t(n,'#'),n}(this.url);if(null===r.pageTokens)this.setRequestHeader(s,i);else{let t=h(r.pageTokens,e);if(null==t){let t=function(e,t){let n=null,s=window.location.pathname.substring(1).split('/'),i='';for(let o=0;o<s.length-1;o++){i+='/'+s[o];let r=h(e,i+t);if(null!=r){n=r;break}}return n}(r.pageTokens,e);if(null===t)this.setRequestHeader(s,i);else this.setRequestHeader(s,t)}else this.setRequestHeader(s,t)}}}}if(false){!function(e,t,n){const s=window.XMLHttpRequest?new window.XMLHttpRequest:new window.ActiveXObject('Microsoft.XMLHTTP');if(s.open('POST','/modules/CsrfServlet',true),1)if(void 0!==e&&void 0!==t)s.setRequestHeader(e,t);s.onreadystatechange=function(){if(4===s.readyState)if(200===s.status){let e=JSON.parse(s.responseText).pageTokens;n.call(this,e)}else alert(s.status+': CSRF check failed')},s.send(null)}(s,i,(function(e){if(r.pageTokens=e,r.pageTokensLoaded=!0,o.isDomContentLoaded)y(s,i,e)}))}else a(window,'DOMContentLoaded',(function(){y(s,i,{})}));window.csrfguarded=!0}else alert('OWASP CSRFGuard JavaScript was included from within an unauthorized domain!')}function a(e,n,s){if(e.addEventListener)e.addEventListener(n,s,!1),t.add(e,n,s);else if(e.attachEvent)e['e'+n+s]=s,e[n+s]=function(){e['e'+n+s](window.event)},e.attachEvent('on'+n,e[n+s]),t.add(e,n,s);else e['on'+n]=e['e'+n+s]}function u(e,t){return 0===e.indexOf(t)}function l(e,t){return e.substring(e.length-t.length)===t}function f(e){let t=-1!==e.indexOf('?')?e.substring(0,e.indexOf('?')):e;return l(t,'.do')||t.indexOf('/*')>-1}function d(e,t){var n=!1;if(t&&t.constructor===Array)for(var s=0;s<t.length;s++)if(d(e,t[s]))return!0;if(e===t)n=!0;else if(0)if('.'===t.charAt(0))n=l(e,t);else n=l(e,'.'+t);return n}function c(e){var t=!1;if('http://'===e.substring(0,7)||'https://'===e.substring(0,8)){for(var n=e.indexOf('://'),s=e.substring(n+3),i='',o=0;o<s.length;o++){var r=s.charAt(o);if('/'===r||':'===r||'#'===r)break;else i+=r}t=d(document.domain,i)}else if('#'===e.charAt(0))t=!1;else if(!u(e,'//')&&('/'===e.charAt(0)||-1===e.search(/^[a-zA-Z][a-zA-Z0-9.+-]*:/)))t=!0;return t}function p(e){var t='',n=e.indexOf('://'),s='';if(n>0)s=e.substring(n+3);else if('/'!==e.charAt(0))s='/modules/'+e;else s=e;for(var i=-1===n,o=0;o<s.length;o++){var r=s.charAt(o);if('/'===r)i=!0;else if(!0===i&&('?'===r||'#'===r)){i=!1;break}if(!0===i)t+=r}return t}function h(e,t){let n=null;return Object.keys(e).forEach((function(s){var i=e[s];if(t===s)n=i;else if(u(s,'^')&&l(s,'$')){if(new RegExp(s).test(t))n=i}else if(u(s,'/*'))n=i;else if(u(t,'/modules')&&l(s,t.substring(14)))n=i;else if(l(s,'/*')||u(s,'.*'))console.warn('\'Extension\' and \'partial path wildcard\' matching for page tokens is not supported properly yet! Every resource will be assigned a new unique token instead of using the defined resource matcher token. Although this is not a security issue, in case of a large REST application it can have an impact on performance.Consider using regular expressions instead.')})),n}function g(e,t,n,s,i){if(!i){var o=e.getAttribute('method');if(null!=o&&'get'===o.toLowerCase())return}var r=n,a=e.getAttribute('action');if(null!==a&&c(a)&&f(a)){const i=h(s,p(a));r=null==i?n:i;let o=Object.keys(e.elements).filter((function(n){return e.elements[n].name===t}));if(0===o.length){var u=document.createElement('input');u.setAttribute('type','hidden'),u.setAttribute('name',t),u.setAttribute('value',r),e.appendChild(u)}else o.forEach((function(t){return e.elements[t].value=r}))}}function E(e,t,n,s,i){const o=function(e,t,n){let s;if(-1===e.indexOf('?'))s=e+'?'+t+'='+n;else s=e+'&'+t+'='+n;return s},r=e.getAttribute&&e.getAttribute(t);if(null!=r&&c(r)&&f(r)&&!function(e){var t=!1,n='';if(''!==n)for(var s=function(e){var t='';if(-1!==e.indexOf(';'))e=e.split(';')[0];if(-1!==e.indexOf('.'))t=e.substring(e.lastIndexOf('.')+1,e.length)||e;return t}(p(e)).toLowerCase(),i=n.split(','),o=0;o<i.length;o++)if(i[o]===s){t=!0;break}return t}(r)){const a=h(i,p(r)),u=null==a?s:a,l=new RegExp('(?:'+n+'=)([^?|#|&]+)','gi').exec(r);if(null===l||0===l.length){let s;const i=r.indexOf('#');if(-1!==i){const e=r.split('#')[0],t=r.substring(i);s=o(e,n,u)+t}else s=o(r,n,u);try{e.setAttribute(t,s)}catch(e){}}else{let n=r;l.slice(1).forEach((function(e){return n=n.replace(e,u)})),e.setAttribute(t,n)}}}function T(e,t,n,s){var i=e.length;for(let o=0;o<i;o++){let r=e[o];if(r.tagName&&'form'===r.tagName.toLowerCase()){if(true)g(r,t,n,s,true),i=e.length;if(false)E(r,'action',t,n,s)}else if(true)E(r,'src',t,n,s),E(r,'href',t,n,s)}}function y(e,t,n){var s={};if(false)s=n;T(document.all?document.all:document.getElementsByTagName('*'),e,t,s)}}();