Skip to content

Commit c577bfa

Browse files
committed
Make AuthCheckFilter's destroy a no-op
This is called when the AdminConsolePlugin restarts (by PluginServlet). It wipes all exclusions that have been registered, requiring plugins to re-register them. This change retains the static list of excludes. Plugins remain responsible for unregistering their excludes, which they should have been doing anyway, rather than relying on an eventual restart of the AdminConsole.
1 parent 941d305 commit c577bfa

File tree

2 files changed

+12
-5
lines changed

2 files changed

+12
-5
lines changed

xmppserver/src/main/java/org/jivesoftware/admin/AuthCheckFilter.java

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2004-2008 Jive Software, 2016-2025 Ignite Realtime Foundation. All rights reserved.
2+
* Copyright (C) 2004-2008 Jive Software, 2016-2026 Ignite Realtime Foundation. All rights reserved.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -316,8 +316,11 @@ private boolean authUserFromRequest(final HttpServletRequest request) {
316316

317317
@Override
318318
public void destroy() {
319-
// reset excludes to an empty set to prevent state carry over
320-
excludes = Collections.newSetFromMap(new ConcurrentHashMap<>());
319+
// Intentionally left empty. The static 'excludes' set is shared across filter instances
320+
// so that plugin-registered excludes survive admin-console restarts. Plugins are
321+
// responsible for calling removeExclude() in their destroyPlugin() lifecycle.
322+
// Web.xml excludes are re-added by init() on each restart (Set semantics prevent duplicates).
323+
// Setup-mode excludes are cleaned up explicitly in AdminConsolePlugin.startup().
321324
}
322325

323326
private String getRedirectURL(HttpServletRequest request, String loginPage,

xmppserver/src/main/java/org/jivesoftware/openfire/container/AdminConsolePlugin.java

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2004-2008 Jive Software, 2016-2025 Ignite Realtime Foundation. All rights reserved.
2+
* Copyright (C) 2004-2008 Jive Software, 2016-2026 Ignite Realtime Foundation. All rights reserved.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -283,8 +283,12 @@ protected void startup() {
283283
try {
284284
adminServer.start(); // excludes initialised
285285

286-
if(XMPPServer.getInstance().isSetupMode()) {
286+
if (XMPPServer.getInstance().isSetupMode()) {
287287
AuthCheckFilter.loadSetupExcludes();
288+
} else {
289+
// Explicitly remove setup-only excludes. If the admin console is restarting
290+
// after setup completion, destroy() no longer clears them automatically.
291+
Arrays.stream(JiveGlobals.setupExcludePaths).forEach(AuthCheckFilter::removeExclude);
288292
}
289293

290294
// Log the ports that the admin server is listening on.

0 commit comments

Comments
 (0)