KEYCLOAK-2510

saml-core/src/main/java/org/keycloak/saml/common/util/TransformerUtil.java

@@ -113,6 +113,7 @@ public class TransformerUtil {
                     transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
                 } catch (TransformerConfigurationException ignored) {
                     // some platforms don't support this.   For example our testsuite pulls Selenium which requires Xalan 2.7.1
+                    logger.warn("XML External Entity switches are not supported.  You may get XML injection vulnerabilities.");
                 }
                 try {
                     transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
@@ -120,6 +121,7 @@ public class TransformerUtil {
                     transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
                 } catch (Exception ignored) {
                     // some platforms don't support this.   For example our testsuite pulls Selenium which requires Xalan 2.7.1
+                    logger.warn("XML External Entity switches are not supported.  You may get XML injection vulnerabilities.");
                 }
 
             } finally {

themes/src/main/resources/theme/base/admin/resources/js/services.js

@@ -1315,10 +1315,9 @@ module.factory('PasswordPolicy', function() {
         if (!policies || policies.length == 0) {
             return "";
         }
-
         var policyString = "";
 
-        for (var i in policies){
+        for (var i = 0; i < policies.length; i++) {
             policyString += policies[i].name;
             if ( policies[i].value ){
                 policyString += '(' + policies[i].value + ')';

themes/src/main/resources/theme/base/admin/resources/partials/password-policy.html

@@ -34,7 +34,7 @@
                            placeholder="{{:: 'no-value-assigned.placeholder' | translate}}" min="1" required>
                 </td>
                 <td class="kc-action-cell">
-                    <button type="button" class="btn btn-default btn-block btn-sm" ng-click="removePolicy($index)">{{:: 'delete' | translate}}</button>
+                    <button class="btn btn-default btn-block btn-sm" ng-click="removePolicy($index)">{{:: 'delete' | translate}}</button>
                 </td>
             </tr>
             </tbody>