Openfire (master)

• 

  daryl herzmann <akrherz@iastate.edu> 27 Oct 2019 682c661b96ecd11a073f5a30d1656d11f6bc6c67

  Merge pull request #1487 from GregDThomas/webservlet-annotation-support
  OF-1903 Support for @WebServlet annotation
• 

  daryl herzmann <akrherz@iastate.edu> 27 Oct 2019 54376c913bcc13223fdc7e7fb728c3834df1061e

  Merge pull request #1508 from guusdk/OF-1900_pubsub-mutlti-subcrcibe-advertising
  OF-1900: Advertise pubsub#multi-subscribe only when enabled.
• 

  daryl herzmann <akrherz@iastate.edu> 27 Oct 2019 e6a9db94f684056ced0d5e5a4291c89488fbeecc

  Merge pull request #1497 from guusdk/OF-1885_SSRF-guard-favicon
  OF-1885: SSRF guard favicon
• 

  Guus der Kinderen 26 Oct 2019 aaa62f15f237b764dbd22a2096855db07816ffd2 m

  OF-1900: Advertise pubsub#multi-subscribe only when enabled.

  • xmppserver/src/main/java/org/jivesoftware/openfire/pubsub/PubSubModule.java (version aaa62f15f237b764dbd22a2096855db07816ffd2)
• 

  daryl herzmann <akrherz@iastate.edu> 26 Oct 2019 3700451f48dd0c573f765fde254a7c4ce5e9d2b6

  Merge pull request #1503 from GregDThomas/OF-1892
  OF-1892: Make group sorting case insensitive
• 

  daryl herzmann <akrherz@iastate.edu> 26 Oct 2019 4f3c4e2842b90f156fbcf4d40263fb40c2b66e56

  Merge pull request #1483 from GregDThomas/ldap-users-from-groupa
  OF-1866: Identify LDAP Openfire users from Group membership
• 

  daryl herzmann <akrherz@iastate.edu> 26 Oct 2019 5508264445de83d9f952b1077f9ae6d14bbb901e

  Merge pull request #1496 from guusdk/OF-1883_show-detached-sessions
  OF-1883 & OF-1884
• 

  daryl herzmann <akrherz@iastate.edu> 26 Oct 2019 c6b0e446b41c6cbe181bac1a5cd0a4fbb7477152

  Merge pull request #1494 from guusdk/OF-1882_Count-offline-messages
  OF-1882: Optimize counting offline messages.
• 

  Greg Thomas <greg.d.thomas@gmail.com> 13 Oct 2019 bb76d39098ae81fc9b084e96b048fd2360b27d81 m

  OF-1892: Make group sorting case insensitive

  • xmppserver/src/main/webapp/group-summary.jsp (version bb76d39098ae81fc9b084e96b048fd2360b27d81)
• 

  Guus der Kinderen 03 Oct 2019 2dabb16e9ab4a378e33e32b2d4e4bc052d03d3c5 m

  Increate favicon retrieval timeouts
  I've noticed that many favicons are not shown. Increasing retrieval timeouts in the hope that this yields better results.

  • xmppserver/src/main/java/org/jivesoftware/util/FaviconServlet.java (version 2dabb16e9ab4a378e33e32b2d4e4bc052d03d3c5)
• 

  Guus der Kinderen 03 Oct 2019 c2ccb38250910587498597955d0bbee8b58e46df m

  OF-1885: Guard against SSRF by inpecting favicon results
  The Openfire servlet that is supposed to be used to retrieve favicons from remote servers could be used to obtain anything. To prevent unauthorized use, this commit adds a check that verifies if the returned data is an image. If that's not the case, the returned data is ignored.

  • xmppserver/src/main/java/org/jivesoftware/util/FaviconServlet.java (version c2ccb38250910587498597955d0bbee8b58e46df)
  • xmppserver/src/main/java/org/jivesoftware/util/GraphicsUtils.java (version c2ccb38250910587498597955d0bbee8b58e46df)
  • xmppserver/src/test/java/org/jivesoftware/util/GraphicsUtilsTest.java (version c2ccb38250910587498597955d0bbee8b58e46df)
• 

  Guus der Kinderen 01 Oct 2019 ca843ad2c97838e16ac7bb8b7caea83aee0c9635 m

  OF-1884: Stream Management logging issue
  Code should not try to log 'session' instances (using their 'toString' method) as it'll cause nullpointers.

  • xmppserver/src/main/java/org/jivesoftware/openfire/streammanagement/StreamManager.java (version ca843ad2c97838e16ac7bb8b7caea83aee0c9635)
• 

  Guus der Kinderen 01 Oct 2019 582e819215e8b8d52171701878180a769874723d m

  OF-1883: Admin console should list client sessions that are detached.
  OF-590 introduces a connection validity check to the client sessions that are to be listed on the admin console. This check fails for sessions that are detached, which caused them to go unlisted.
  
  This commit removes the check that was introduced in OF-590. I feel confident that the problems that guarded for are fixed by OF-1700.
  
  Additionally, some (debug) log statements were added / enriched with session data.

  • xmppserver/src/main/java/org/jivesoftware/openfire/session/LocalSession.java (version 582e819215e8b8d52171701878180a769874723d)
  • xmppserver/src/main/java/org/jivesoftware/openfire/spi/ClientRoute.java (version 582e819215e8b8d52171701878180a769874723d)
  • xmppserver/src/main/webapp/session-row.jspf (version 582e819215e8b8d52171701878180a769874723d)
  • xmppserver/src/main/webapp/session-summary.jsp (version 582e819215e8b8d52171701878180a769874723d)
• 

  Guus der Kinderen 30 Sep 2019 ed2af7b8a2a590dca65aac2c939932465ba4d9e0 m

  OF-1882: Optimize counting offline messages.
  Instead of retrieving all rows from the database to count them, use a count() SQL query.

  • xmppserver/src/main/java/org/jivesoftware/openfire/OfflineMessageStore.java (version ed2af7b8a2a590dca65aac2c939932465ba4d9e0)
  • xmppserver/src/main/java/org/jivesoftware/openfire/handler/IQOfflineMessagesHandler.java (version ed2af7b8a2a590dca65aac2c939932465ba4d9e0)
• 

  Greg Thomas <greg.d.thomas@gmail.com> 21 Sep 2019 fd7e5fec80636f4f9c137bf92a1ab93f2174ed92 m

  Support for @WebServlet annotation

  • xmppserver/src/main/java/org/jivesoftware/admin/servlet/SystemCacheDetailsServlet.java (version fd7e5fec80636f4f9c137bf92a1ab93f2174ed92)
  • xmppserver/src/main/java/org/jivesoftware/admin/servlet/SystemPropertiesServlet.java (version fd7e5fec80636f4f9c137bf92a1ab93f2174ed92)
  • xmppserver/src/main/java/org/jivesoftware/openfire/container/AdminConsolePlugin.java (version fd7e5fec80636f4f9c137bf92a1ab93f2174ed92)
  • xmppserver/src/main/webapp/WEB-INF/web.xml (version fd7e5fec80636f4f9c137bf92a1ab93f2174ed92)
• 

  Greg Thomas <greg.d.thomas@gmail.com> 16 Sep 2019 078c390b1ce019476b43995e9849eb23a2c413fc m

  Remember that a user can be in more than one group - use a set to de-duplicate

  • xmppserver/src/main/java/org/jivesoftware/openfire/ldap/LdapUserProvider.java (version 078c390b1ce019476b43995e9849eb23a2c413fc)
• 

  Greg Thomas <greg.d.thomas@bt.com> 14 Sep 2019 7193f319553e11f5d2e2fd9d452ddc3361adce86 m

  Improve user caching

  • xmppserver/src/main/java/org/jivesoftware/openfire/ldap/LdapUserProvider.java (version 7193f319553e11f5d2e2fd9d452ddc3361adce86)
• 

  Greg Thomas <greg.d.thomas@bt.com> 14 Sep 2019 9d4f3b9cf0dbdf0cea0daf2100e740d857e22853 m

  Add some Javadoc explaining the setting

  • xmppserver/src/main/java/org/jivesoftware/openfire/ldap/LdapManager.java (version 9d4f3b9cf0dbdf0cea0daf2100e740d857e22853)
• 

  Greg Thomas <greg.d.thomas@bt.com> 14 Sep 2019 0cfce21604859488d25c489594439a97b60f130e m

  Filter out users when searching, fetching explicitly

  • xmppserver/src/main/java/org/jivesoftware/openfire/ldap/LdapUserProvider.java (version 0cfce21604859488d25c489594439a97b60f130e)
• 

  Greg Thomas <greg.d.thomas@bt.com> 14 Sep 2019 e8bd236ba5af39144f29e345ec9e4ba9da49ab28 m

  Not actually  necessary to set client side sorting

  • xmppserver/src/main/java/org/jivesoftware/openfire/ldap/LdapManager.java (version e8bd236ba5af39144f29e345ec9e4ba9da49ab28)
• 

  Greg Thomas <greg.d.thomas@bt.com> 13 Sep 2019 8daa97d6d9bb81c45a4368894980f4c37a4c2915 m

  First stage; allUsers only returns users in groups

  • xmppserver/src/main/java/org/jivesoftware/openfire/ldap/LdapManager.java (version 8daa97d6d9bb81c45a4368894980f4c37a4c2915)
  • xmppserver/src/main/java/org/jivesoftware/openfire/ldap/LdapUserProvider.java (version 8daa97d6d9bb81c45a4368894980f4c37a4c2915)