Openfire 3.9.3 removes '-' from domain name in Sever2Sever configuration

Openfire Openfire Dev
1

This is caused by OF-671.The solution was to call the StringUtils.removeXSSCharacters() method from server2server-settings.jsp but a domain name of the form of my-domain.com is still valid. The situation is that now no domains containing dashes “-” can be white or black listed.

A solution would be to write a more relaxed implementation of the StringUtils.removeXSSCharacters().

2

I have tried with the latest 3.11.0 alpha build and i was able to add my-domain.com to a whitelist.

3

Thanks for pointing this out