diff --git a/sandbox/heavyduty/src/main/java/heavyduty/web/TestMultiActionController.java b/sandbox/heavyduty/src/main/java/heavyduty/web/TestMultiActionController.java
new file mode 100644
index 0000000000..9315cca8b1
--- /dev/null
+++ b/sandbox/heavyduty/src/main/java/heavyduty/web/TestMultiActionController.java
@@ -0,0 +1,44 @@
+package heavyduty.web;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.web.bind.ServletRequestBindingException;
+import org.springframework.web.servlet.ModelAndView;
+import org.springframework.web.servlet.mvc.multiaction.MultiActionController;
+
+/**
+ * Reproduces SEC-830.
+ */
+public class TestMultiActionController extends MultiActionController {
+ public static final String VIEW_NAME = "multi-action-test";
+
+ public String login(HttpServletRequest request, HttpServletResponse response) {
+ return "login";
+ }
+
+ public void step1(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+ request.getRequestDispatcher("/testMulti.htm?action=step1xtra").forward(request, response);
+ }
+
+ public ModelAndView step1xtra(HttpServletRequest request, HttpServletResponse response) throws ServletRequestBindingException {
+ return createView("step2");
+ }
+
+ public ModelAndView step2(HttpServletRequest request, HttpServletResponse response) throws ServletRequestBindingException {
+ return createView("step1");
+ }
+
+ private ModelAndView createView(String name) {
+ Map model = new HashMap();
+ model.put("nextAction", name);
+ return new ModelAndView(VIEW_NAME, model);
+ }
+
+}
+
diff --git a/sandbox/heavyduty/src/main/java/sample/TestVoter.java b/sandbox/heavyduty/src/main/java/sample/TestVoter.java
new file mode 100644
index 0000000000..df4d20c82f
--- /dev/null
+++ b/sandbox/heavyduty/src/main/java/sample/TestVoter.java
@@ -0,0 +1,30 @@
+package sample;
+
+import java.lang.annotation.Annotation;
+
+import org.aopalliance.intercept.MethodInvocation;
+import org.springframework.security.Authentication;
+import org.springframework.security.ConfigAttribute;
+import org.springframework.security.ConfigAttributeDefinition;
+import org.springframework.security.vote.AccessDecisionVoter;
+
+public class TestVoter implements AccessDecisionVoter {
+
+ public boolean supports(ConfigAttribute attribute) {
+ return true;
+ }
+
+ public boolean supports(Class clazz) {
+ return MethodInvocation.class.isAssignableFrom(clazz);
+ }
+
+ public int vote(Authentication authentication, Object object, ConfigAttributeDefinition config) {
+ MethodInvocation mi = (MethodInvocation) object;
+
+ Annotation[][] annotations = mi.getMethod().getParameterAnnotations();
+
+
+ return ACCESS_GRANTED;
+ }
+
+}
diff --git a/sandbox/heavyduty/src/main/webapp/WEB-INF/freemarker/login.ftl b/sandbox/heavyduty/src/main/webapp/WEB-INF/freemarker/login.ftl
new file mode 100644
index 0000000000..671752513d
--- /dev/null
+++ b/sandbox/heavyduty/src/main/webapp/WEB-INF/freemarker/login.ftl
@@ -0,0 +1,22 @@
+
+
+ Spring Security Login
+
+
+
+ Spring Security Login (Freemarker)
+
+
+
+
+
diff --git a/sandbox/heavyduty/src/main/webapp/WEB-INF/freemarker/multi-action-test.ftl b/sandbox/heavyduty/src/main/webapp/WEB-INF/freemarker/multi-action-test.ftl
new file mode 100644
index 0000000000..bac2503081
--- /dev/null
+++ b/sandbox/heavyduty/src/main/webapp/WEB-INF/freemarker/multi-action-test.ftl
@@ -0,0 +1,13 @@
+
+
+
+ MultiActionController Test
+
+
+
+
+
+
\ No newline at end of file
diff --git a/sandbox/heavyduty/src/main/webapp/context.jsp b/sandbox/heavyduty/src/main/webapp/context.jsp
new file mode 100644
index 0000000000..bcd5c6fe0f
--- /dev/null
+++ b/sandbox/heavyduty/src/main/webapp/context.jsp
@@ -0,0 +1,29 @@
+<%@page import="org.springframework.web.context.support.WebApplicationContextUtils"%>
+<%@page import="org.springframework.security.providers.ldap.LdapAuthenticationProvider"%>
+<%@page import="org.springframework.security.providers.ProviderManager"%>
+
+
+
+Context Information Page
+
+LdapAuthenticationProvider instances:
+
+<%=
+WebApplicationContextUtils.getRequiredWebApplicationContext(
+ session.getServletContext()).getBeansOfType(LdapAuthenticationProvider.class)
+%>
+
+
+
+Providers:
+
+<%=
+((ProviderManager)WebApplicationContextUtils.getRequiredWebApplicationContext(
+ session.getServletContext()).getBean("_authenticationManager")).getProviders() %>
+
+
+
+
+Home
+
+
\ No newline at end of file