do not automatically add plugins not found in the configuration

fixes #1874

Author: Vladimir Kotal

src/org/opensolaris/opengrok/authorization/AuthorizationFramework.java

@@ -277,36 +277,36 @@ protected void addPlugin(AuthorizationStack stack, AuthorizationEntity entity) {
     }
 
     /**
-     * Add a plugin into the plugin stack. This has the same effect as invoking
+     * Add a plug-in into the plug-in stack. This has the same effect as invoking
      * addPlugin(stack, IAuthorizationPlugin, REQUIRED).
      *
      * @param stack the stack
-     * @param plugin the authorization plugin
+     * @param plugin the authorization plug-in
      */
     public void addPlugin(AuthorizationStack stack, IAuthorizationPlugin plugin) {
         addPlugin(stack, plugin, AuthControlFlag.REQUIRED);
     }
 
     /**
-     * Add a plugin into the plugin array.
+     * Add a plug-in into the plug-in array.
      *
      * <h3>Configured plugin</h3>
-     * For plugin which have an entry in configuration, the new plugin is put in
-     * the place respecting the user-defined order of execution.
+     * For plug-in that has an entry in configuration, the new plug-in is put
+     * in the place respecting the user-defined order of execution.
      *
      * <h3>New plugin</h3>
      * If there is no entry in configuration for this class, the plugin is
      * appended to the end of the plugin stack with flag <code>flag</code>
+     * 
+     * <p><b>The plug-in's load method is NOT invoked at this point</b></p>
      *
-     * <p>
-     * <b>The plugin's load method is NOT invoked at this point</b></p>
-     *
-     * This has the same effect as invoking addPlugin(new
-     * AuthorizationEntity(stack, flag, getClassName(plugin), plugin).
+     * This has the same effect as invoking
+     * {@code addPlugin(new AuthorizationEntity(stack, flag,
+     * getClassName(plugin), plugin)}.
      *
      * @param stack the stack
-     * @param plugin the authorization plugin
-     * @param flag the flag for the new plugin
+     * @param plugin the authorization plug-in
+     * @param flag the flag for the new plug-in
      */
     public void addPlugin(AuthorizationStack stack, IAuthorizationPlugin plugin, AuthControlFlag flag) {
         if (stack != null) {
@@ -452,15 +452,15 @@ protected List<Class> getInterfaces(Class c) {
      */
     private void loadClasses(AuthorizationStack stack, List<File> classfiles, List<File> jarfiles) {
         IAuthorizationPlugin pf;
+        
         for (File file : classfiles) {
             String classname = getClassName(file);
             if (classname.isEmpty()) {
                 continue;
             }
-            // load the class in memory and try to find a configured space for this class
-            if ((pf = handleLoadClass(classname)) != null && !stack.setPlugin(pf)) {
-                // if there is not configured space -> append it to the stack
-                addPlugin(stack, pf);
+            // Load the class in memory and try to find a configured space for this class.
+            if ((pf = handleLoadClass(classname)) != null) {
+                stack.setPlugin(pf);
             }
         }
 
@@ -473,10 +473,9 @@ private void loadClasses(AuthorizationStack stack, List<File> classfiles, List<F
                     if (!entry.getName().endsWith(".class") || classname.isEmpty()) {
                         continue;
                     }
-                    // load the class in memory and try to find a configured space for this class
-                    if ((pf = handleLoadClass(classname)) != null && !stack.setPlugin(pf)) {
-                        // if there is not configured space -> append it to the stack
-                        addPlugin(stack, pf);
+                    // Load the class in memory and try to find a configured space for this class.
+                    if ((pf = handleLoadClass(classname)) != null) {
+                        stack.setPlugin(pf);
                     }
                 }
             } catch (IOException ex) {

src/org/opensolaris/opengrok/web/AuthorizationFilter.java

@@ -61,6 +61,7 @@ public void doFilter(ServletRequest sr, ServletResponse sr1, FilterChain fc) thr
             } else {
                 LOGGER.log(Level.INFO, "Access denied for URI: {0}", httpReq.getRequestURI());
             }
+            
             /**
              * Add the request to the statistics. This is called just once for a
              * single request otherwise the next filter will count the same
@@ -73,10 +74,12 @@ public void doFilter(ServletRequest sr, ServletResponse sr1, FilterChain fc) thr
             config.getEnv().getStatistics().addRequest("requests_forbidden");
             config.getEnv().getStatistics().addRequestTime("requests_forbidden",
                     System.currentTimeMillis() - processTime);
+            
             if (!config.getEnv().getConfiguration().getForbiddenIncludeFileContent().isEmpty()) {
                 sr.getRequestDispatcher("/eforbidden").forward(sr, sr1);
                 return;
             }
+            
             httpRes.sendError(HttpServletResponse.SC_FORBIDDEN, "Access forbidden");
             return;
         }