@Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException
    {
        doCommon(request, response);

        final WebManager webManager = (WebManager) request.getAttribute("webManager"); // set in doCommon()
        final PluginManager pluginManager = (PluginManager) request.getAttribute("pluginManager"); // set in doCommon()
        final boolean uploadEnabled = (boolean) request.getAttribute("uploadEnabled");

        final String deletePlugin = ParamUtils.getParameter(request, "deleteplugin");
        final String reloadPlugin = ParamUtils.getParameter(request, "reloadplugin");
        final boolean uploadPlugin = request.getParameter("uploadplugin") != null;

        final Cookie csrfCookie = CookieUtils.getCookie(request, "csrf");
        final String csrfParam = ParamUtils.getParameter(request, "csrf");

        final boolean csrfError = csrfCookie == null || csrfParam == null || !csrfCookie.getValue().equals(csrfParam);

        // Generate a new CSRF value, to be used when the page is used another time (e.g. to upload a new plugin).
        final String newCsrfParam = StringUtils.randomString(15);
        CookieUtils.setCookie(request, response, "csrf", newCsrfParam, -1);
        request.setAttribute("csrf", newCsrfParam);

        if (csrfError) {
            response.sendRedirect("plugin-admin.jsp?csrfError=true");
            return;
        }

        if (deletePlugin != null) {
            pluginManager.deletePlugin( deletePlugin );
            webManager.logEvent("deleted plugin "+deletePlugin, null);
            response.sendRedirect("plugin-admin.jsp?deletesuccess=true");
            return;
        }

        if (reloadPlugin != null) {
            if ( pluginManager.reloadPlugin(reloadPlugin) ) {
                webManager.logEvent("reloaded plugin "+reloadPlugin, null);
                response.sendRedirect("plugin-admin.jsp?reloadsuccess=true");
                return;
            } else {
                response.sendRedirect( "plugin-admin.jsp?reloadsuccess=false" );
                return;
            }
        }

        if (uploadEnabled && uploadPlugin) {
            boolean installed = false;

            try {
                // Parse the request
                final Part uploadedPlugin = request.getPart("uploadfile");
                final String fileName = uploadedPlugin.getSubmittedFileName();
                final String contentType = uploadedPlugin.getContentType();
                Log.debug("Uploaded plugin '{}' content type: '{}'.", fileName, contentType );
                if (fileName == null) {
                    Log.error( "Ignoring uploaded file: No filename specified for file upload." );
                    response.sendRedirect("plugin-admin.jsp?uploadsuccess=false");
                    return;
                }

                if (CONTENTTYPE_CHECK_ENABLED.getValue() && EXPECTED_CONTENTTYPE.getValue().stream().noneMatch(v -> v.equalsIgnoreCase(contentType))) {
                    Log.error("Ignoring uploaded file: Content type '{}' of uploaded file '{}' does not match any of the expected content types: {}", contentType, fileName, String.join(", ", EXPECTED_CONTENTTYPE.getValue()));
                    response.sendRedirect("plugin-admin.jsp?uploadsuccess=false");
                    return;
                }

                try (final InputStream is = uploadedPlugin.getInputStream()) {
                    installed = XMPPServer.getInstance().getPluginManager().installPlugin(is, fileName);
                    if (!installed) {
                        Log.error("Plugin manager failed to install plugin: " + fileName);
                    } else {
                        webManager.logEvent("uploaded plugin " + fileName, null);
                    }
                } catch (IOException e) {
                    Log.error("Unable to open file stream for uploaded file: " + fileName, e);
                    response.sendRedirect("plugin-admin.jsp?uploadsuccess=false");
                    return;
                }
            }
            catch (Exception e) {
                Log.error("Unable to upload plugin file.", e);
            }
            response.sendRedirect("plugin-admin.jsp?uploadsuccess=" + installed);
        }
    }
Defines the expected content-type of uploaded plugin files.
xmppserver/src/main/java/org/jivesoftware/admin/servlet/PluginServlet.java