igniterealtime/openfire-irmaserver-plugin

I Reveal My Attributes to Openfire.

openfire-irmaserver-plugin's Issues

i18n file can't be loaded

When loading the plugin, admin console usage causes exceptions like these to be logged:

2020.06.09 15:33:37 ERROR [Jetty-QTP-AdminConsole-2063]: org.jivesoftware.util.LocaleUtils - Can't find bundle for base name irmaserver_i18n, locale en
java.util.MissingResourceException: Can't find bundle for base name irmaserver_i18n, locale en
        at java.util.ResourceBundle.throwMissingResourceException(ResourceBundle.java:2055) ~[?:?]
        at java.util.ResourceBundle.getBundleImpl(ResourceBundle.java:1689) ~[?:?]
        at java.util.ResourceBundle.getBundleImpl(ResourceBundle.java:1593) ~[?:?]
        at java.util.ResourceBundle.getBundle(ResourceBundle.java:1284) ~[?:?]
        at org.jivesoftware.util.LocaleUtils.getLocalizedString(LocaleUtils.java:522) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.jivesoftware.util.LocaleUtils.getLocalizedString(LocaleUtils.java:473) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.jivesoftware.util.LocaleUtils.getLocalizedString(LocaleUtils.java:457) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.jivesoftware.admin.AdminConsole.getAdminText(AdminConsole.java:202) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.jivesoftware.admin.SubnavTag.doEndTag(SubnavTag.java:183) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.jivesoftware.openfire.admin.decorators.main_jsp._jspx_meth_admin_005fsubnavbar_005f0(main_jsp.java:709) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.jivesoftware.openfire.admin.decorators.main_jsp._jspService(main_jsp.java:299) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) ~[apache-jsp-8.5.49.jar:8.5.49]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) ~[javax.servlet-api-3.1.0.jar:3.1.0]
        at org.eclipse.jetty.servlet.ServletHolder$NotAsyncServlet.service(ServletHolder.java:1411) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]
        at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:763) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]

Admin console page should guard against CSRF

As the admin console is used to change settings, it should guard against CSRF by validating the source of updated settings.

NPE when access admin console page

When trying to access the admin console page that's added by this plugin, a NullPointerException is logged:

2020.06.09 16:05:30 ERROR [Jetty-QTP-AdminConsole-2429]: org.jivesoftware.openfire.container.PluginServlet - null
java.lang.NullPointerException: null
        at org.jivesoftware.openfire.plugin.irmaserver.irma_jsp._jspService(irma_jsp.java:120) ~[?:?]
        at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) ~[apache-jsp-8.5.49.jar:8.5.49]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) ~[javax.servlet-api-3.1.0.jar:3.1.0]
        at org.jivesoftware.openfire.container.PluginServlet.handleJSP(PluginServlet.java:439) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.jivesoftware.openfire.container.PluginServlet.service(PluginServlet.java:129) ~[xmppserver-4.5.2.jar:4.5.2]
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) ~[javax.servlet-api-3.1.0.jar:3.1.0]
        at org.eclipse.jetty.servlet.ServletHolder$NotAsyncServlet.service(ServletHolder.java:1411) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]
        at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:763) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]
        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1631) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]
        at org.jivesoftware.admin.PluginFilter.doFilter(PluginFilter.java:226) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1618) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]
        at org.jivesoftware.admin.AuthCheckFilter.doFilter(AuthCheckFilter.java:234) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1618) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]
        at com.opensymphony.sitemesh.webapp.SiteMeshFilter.obtainContent(SiteMeshFilter.java:129) ~[sitemesh-2.4.2.jar:?]
        at com.opensymphony.sitemesh.webapp.SiteMeshFilter.doFilter(SiteMeshFilter.java:77) ~[sitemesh-2.4.2.jar:?]
        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1618) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]
        at org.jivesoftware.util.LocaleFilter.doFilter(LocaleFilter.java:73) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1618) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]
        at org.jivesoftware.util.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:49) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1618) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]
        at org.jivesoftware.admin.PluginFilter.doFilter(PluginFilter.java:226) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1618) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]
        at org.jivesoftware.admin.AuthCheckFilter.doFilter(AuthCheckFilter.java:234) ~[xmppserver-4.5.2.jar:4.5.2]
        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1610) ~[jetty-servlet-9.4.28.v20200408.jar:9.4.28.v20200408]

Admin console page should escape (user) data

All data displayed on the admin console page should be properly escaped, to prevent injection vulnerabilities.