From d5686df5c0c075198799b7839d16b168b30c68b6 Mon Sep 17 00:00:00 2001
From: Guus der Kinderen <guus.der.kinderen@gmail.com>
Date: Thu, 4 Aug 2022 14:59:15 +0200
Subject: [PATCH 1/2] fixes #146: Limit URI template match for MUC affiliation

The fix for issue #141 introduces a template to replace four distinct URL patterns:
- `/restapi/v1/chatrooms/{roomName}/owners`
- `/restapi/v1/chatrooms/{roomName}/admins`
- `/restapi/v1/chatrooms/{roomName}/members`
- `/restapi/v1/chatrooms/{roomName}/outcasts`

got replaced by

- `/restapi/v1/chatrooms/{roomName}/{affiliation}`

Sadly, this template matches more than just those four. URLs like these also get caught, making them misbehave:

- `/restapi/v1/chatrooms/{roomName}/chathistory`
- `/restapi/v1/chatrooms/{roomName}/occupants`
- `/restapi/v1/chatrooms/{roomName}/participants`
- `/restapi/v1/chatrooms/{roomName}/invite`

This commit fixes the problem by applying a regular expression to the `{affiliation}` template, requiring it to match one of four distinct options.
---
 changelog.html                                               | 5 +++++
 .../plugin/rest/service/MUCRoomAffiliationsService.java      | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/changelog.html b/changelog.html
index f18d3e870..0ccef6fa0 100644
--- a/changelog.html
+++ b/changelog.html
@@ -44,6 +44,11 @@ <h1>
 REST API Plugin Changelog
 </h1>
 
+<p><b>1.9.1</b> (tbd)</p>
+<ul>
+    <li>[<a href='https://github.com/igniterealtime/openfire-restAPI-plugin/issues/146'>#146</a>] - Chatroom 'affiliation' URL template clash</li>
+</ul>
+
 <p><b>1.9.0</b> August 4, 2022</p>
 <ul>
     <li>[<a href='https://github.com/igniterealtime/openfire-restAPI-plugin/issues/141'>#141</a>] - Remove boilerplate code for managing MUC room affiliations</li>
diff --git a/src/java/org/jivesoftware/openfire/plugin/rest/service/MUCRoomAffiliationsService.java b/src/java/org/jivesoftware/openfire/plugin/rest/service/MUCRoomAffiliationsService.java
index 86d2425c9..340de8443 100644
--- a/src/java/org/jivesoftware/openfire/plugin/rest/service/MUCRoomAffiliationsService.java
+++ b/src/java/org/jivesoftware/openfire/plugin/rest/service/MUCRoomAffiliationsService.java
@@ -39,7 +39,7 @@
 import java.util.List;
 import java.util.stream.Collectors;
 
-@Path("restapi/v1/chatrooms/{roomName}/{affiliation}")
+@Path("restapi/v1/chatrooms/{roomName}/{affiliation: (admins|members|outcasts|owners)}")
 @Tag(name = "Chat room", description = "Managing Multi-User chat rooms.")
 public class MUCRoomAffiliationsService
 {

From b3fd94fe22a1e0406892c2c3848404f852196523 Mon Sep 17 00:00:00 2001
From: Guus der Kinderen <guus.der.kinderen@gmail.com>
Date: Thu, 4 Aug 2022 15:15:19 +0200
Subject: [PATCH 2/2] fixes #148: example of MUC invite contains escaped
 characters.

This was a result of trying to make the same entity usable for the pre-exising 'invite' endpoint (that works with just one JID), as well as for the new 'invite' endpoint (that can use a collection of JIDs). This introduced a list-of-JID field to the entity, which obviously should not be used for the singular-type endpoint.

In this commit, I've introduced distinct entities to be used for each endpoint, to clear up any confusion. The old entity was reverted to its original state. The new entity inherits from the old endpoint, and adds the 'list-of-jids-to-invite' field.
---
 changelog.html                                |  1 +
 .../rest/controller/MUCRoomController.java    |  8 +--
 .../rest/entity/MUCInvitationEntity.java      | 21 --------
 .../rest/entity/MUCInvitationsEntity.java     | 52 +++++++++++++++++++
 .../plugin/rest/service/MUCRoomService.java   | 12 +++--
 5 files changed, 64 insertions(+), 30 deletions(-)
 create mode 100644 src/java/org/jivesoftware/openfire/plugin/rest/entity/MUCInvitationsEntity.java

diff --git a/changelog.html b/changelog.html
index 0ccef6fa0..5f0c02cd7 100644
--- a/changelog.html
+++ b/changelog.html
@@ -46,6 +46,7 @@ <h1>
 
 <p><b>1.9.1</b> (tbd)</p>
 <ul>
+    <li>[<a href='https://github.com/igniterealtime/openfire-restAPI-plugin/issues/148'>#148</a>] - Example of MUC invite contains escaped characters</li>
     <li>[<a href='https://github.com/igniterealtime/openfire-restAPI-plugin/issues/146'>#146</a>] - Chatroom 'affiliation' URL template clash</li>
 </ul>
 
diff --git a/src/java/org/jivesoftware/openfire/plugin/rest/controller/MUCRoomController.java b/src/java/org/jivesoftware/openfire/plugin/rest/controller/MUCRoomController.java
index 149f8f0b3..2ac5df31b 100644
--- a/src/java/org/jivesoftware/openfire/plugin/rest/controller/MUCRoomController.java
+++ b/src/java/org/jivesoftware/openfire/plugin/rest/controller/MUCRoomController.java
@@ -550,18 +550,18 @@ public MUCRoomMessageEntities getRoomHistory(String roomName, String serviceName
      *            the service name
      * @param roomName
      *            the room name
-     * @param mucInvitationEntity
+     * @param mucInvitationsEntity
      *            the invitation entity containing invitation reason and jids to invite
      * @throws ServiceException
      *             the service exception
      */
-    public void inviteUsersAndOrGroups(String serviceName, String roomName, MUCInvitationEntity mucInvitationEntity)
+    public void inviteUsersAndOrGroups(String serviceName, String roomName, MUCInvitationsEntity mucInvitationsEntity)
             throws ServiceException {
         MUCRoom room = getRoom(serviceName, roomName);
 
         // First determine where to send all the invitations
         Set<JID> targetJIDs = new HashSet<>();
-        for (String jidString : mucInvitationEntity.getJidsToInvite()) {
+        for (String jidString : mucInvitationsEntity.getJidsToInvite()) {
             JID jid = UserUtils.checkAndGetJID(jidString);
             // Is it a group? Then unpack and send to every single group member.
             Group g = UserUtils.getGroupIfIsGroup(jid);
@@ -575,7 +575,7 @@ public void inviteUsersAndOrGroups(String serviceName, String roomName, MUCInvit
         // And now send
         for (JID jid : targetJIDs) {
             try {
-                room.sendInvitation(jid, mucInvitationEntity.getReason(), room.getRole(), null);
+                room.sendInvitation(jid, mucInvitationsEntity.getReason(), room.getRole(), null);
             } catch (ForbiddenException | CannotBeInvitedException e) {
                 throw new ServiceException("Could not invite user", jid.toString(), ExceptionType.NOT_ALLOWED, Response.Status.FORBIDDEN, e);
             }
diff --git a/src/java/org/jivesoftware/openfire/plugin/rest/entity/MUCInvitationEntity.java b/src/java/org/jivesoftware/openfire/plugin/rest/entity/MUCInvitationEntity.java
index 81cb4f4dd..907daa31c 100644
--- a/src/java/org/jivesoftware/openfire/plugin/rest/entity/MUCInvitationEntity.java
+++ b/src/java/org/jivesoftware/openfire/plugin/rest/entity/MUCInvitationEntity.java
@@ -16,22 +16,16 @@
 
 package org.jivesoftware.openfire.plugin.rest.entity;
 
-import com.fasterxml.jackson.annotation.JsonProperty;
 import io.swagger.v3.oas.annotations.media.Schema;
 
 import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlElementWrapper;
 import javax.xml.bind.annotation.XmlRootElement;
-import java.util.ArrayList;
-import java.util.List;
 
 @XmlRootElement(name = "mucInvitation")
 public class MUCInvitationEntity {
 
     String reason;
 
-    private List<String> jidsToInvite;
-
     public MUCInvitationEntity() {
     }
 
@@ -44,19 +38,4 @@ public String getReason() {
     public void setReason(String reason) {
         this.reason = reason;
     }
-
-    @XmlElementWrapper(name = "jidsToInvite")
-    @XmlElement(name = "jid")
-    @JsonProperty(value = "jidsToInvite")
-    @Schema(description = "The JIDs and/or names of the users and groups to invite into the room", example = "<jidsToInvite><jid>jane@example.org</jid></jidsToInvite>")
-    public List<String> getJidsToInvite() {
-        if (jidsToInvite == null) {
-            jidsToInvite = new ArrayList<>();
-        }
-        return jidsToInvite;
-    }
-
-    public void setJidsToInvite(List<String> jidsToInvite) {
-        this.jidsToInvite = jidsToInvite;
-    }
 }
diff --git a/src/java/org/jivesoftware/openfire/plugin/rest/entity/MUCInvitationsEntity.java b/src/java/org/jivesoftware/openfire/plugin/rest/entity/MUCInvitationsEntity.java
new file mode 100644
index 000000000..d0d3a7b9e
--- /dev/null
+++ b/src/java/org/jivesoftware/openfire/plugin/rest/entity/MUCInvitationsEntity.java
@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2022.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.jivesoftware.openfire.plugin.rest.entity;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.swagger.v3.oas.annotations.media.Schema;
+
+import javax.xml.bind.annotation.XmlElement;
+import javax.xml.bind.annotation.XmlElementWrapper;
+import javax.xml.bind.annotation.XmlRootElement;
+import java.util.ArrayList;
+import java.util.List;
+
+@XmlRootElement(name = "mucInvitations")
+public class MUCInvitationsEntity extends MUCInvitationEntity
+{
+    public MUCInvitationsEntity() {
+        super();
+    }
+    
+    private List<String> jidsToInvite;
+
+    @XmlElementWrapper(name = "jidsToInvite")
+    @XmlElement(name = "jid")
+    @JsonProperty(value = "jidsToInvite")
+    @Schema(description = "The JIDs and/or names of the users and groups to invite into the room")
+    public List<String> getJidsToInvite() {
+        if (jidsToInvite == null) {
+            jidsToInvite = new ArrayList<>();
+        }
+        return jidsToInvite;
+    }
+
+    public void setJidsToInvite(List<String> jidsToInvite) {
+        this.jidsToInvite = jidsToInvite;
+    }
+
+}
diff --git a/src/java/org/jivesoftware/openfire/plugin/rest/service/MUCRoomService.java b/src/java/org/jivesoftware/openfire/plugin/rest/service/MUCRoomService.java
index 44bd24b3f..b154ec0db 100644
--- a/src/java/org/jivesoftware/openfire/plugin/rest/service/MUCRoomService.java
+++ b/src/java/org/jivesoftware/openfire/plugin/rest/service/MUCRoomService.java
@@ -240,10 +240,12 @@ public Response inviteUserOrGroupToMUCRoom(
             @RequestBody(description = "The invitation message to send and whom to send it to.", required = true) MUCInvitationEntity mucInvitationEntity)
         throws ServiceException
     {
-        if (!mucInvitationEntity.getJidsToInvite().contains(jid)) {
-            mucInvitationEntity.getJidsToInvite().add(jid);
+        final MUCInvitationsEntity multiple = new MUCInvitationsEntity();
+        multiple.setReason(mucInvitationEntity.getReason());
+        if (!multiple.getJidsToInvite().contains(jid)) {
+            multiple.getJidsToInvite().add(jid);
         }
-        MUCRoomController.getInstance().inviteUsersAndOrGroups(serviceName, roomName, mucInvitationEntity);
+        MUCRoomController.getInstance().inviteUsersAndOrGroups(serviceName, roomName, multiple);
         return Response.status(Status.OK).build();
     }
 
@@ -262,10 +264,10 @@ public Response inviteUserOrGroupToMUCRoom(
     public Response inviteUsersAndOrGroupsToMUCRoom(
         @Parameter(description = "The name of the chat room in which to invite a user or group", example = "lobby", required = true) @PathParam("roomName") String roomName,
         @Parameter(description = "The name of the chat room's MUC service.", example = "conference", required = false) @DefaultValue("conference") @QueryParam("servicename") String serviceName,
-        @RequestBody(description = "The invitation message to send and whom to send it to.", required = true) MUCInvitationEntity mucInvitationEntity)
+        @RequestBody(description = "The invitation message to send and whom to send it to.", required = true) MUCInvitationsEntity mucInvitationsEntity)
         throws ServiceException
     {
-        MUCRoomController.getInstance().inviteUsersAndOrGroups(serviceName, roomName, mucInvitationEntity);
+        MUCRoomController.getInstance().inviteUsersAndOrGroups(serviceName, roomName, mucInvitationsEntity);
         return Response.status(Status.OK).build();
     }