@Override
    public void service(HttpServletRequest request, HttpServletResponse response) {
        String pathInfo = request.getPathInfo();
        if (pathInfo == null) {
            response.setStatus(HttpServletResponse.SC_NOT_FOUND);
        }
        else {
            try {
                final PluginMetadata pluginMetadata = getPluginMetadataFromPath(pathInfo);
                if (pluginMetadata.isCsrfProtectionEnabled()) {
                    if (!passesCsrf(request)) {
                        request.getSession().setAttribute(FlashMessageTag.ERROR_MESSAGE_KEY, LocaleUtils.getLocalizedString("global.csrf.failed"));
                        response.sendRedirect(request.getRequestURI());
                        return;
                    }
                }
                // Handle JSP requests.
                if (pathInfo.endsWith(".jsp")) {
                    setCSRF(request);
                    handleJSP(pathInfo, request, response);
                }
                // Handle servlet requests.
                else if (getServlet(pathInfo) != null) {
                    setCSRF(request);
                    handleServlet(pathInfo, request, response);
                }
                // Handle image/other requests.
                else {
                    handleOtherRequest(pathInfo, response);
                }
            }
            catch (Exception e) {
                Log.error(e.getMessage(), e);
                response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
            }
        }
    }
The plugin servlet acts as a proxy for web requests (in the admin console)
to plugins. Since plugins can be dynamically loaded and live in a different place
than normal Openfire admin console files, it's not possible to have them
added to the normal Openfire admin console web app directory.
<p>
The servlet listens for requests in the form {@code /plugins/[pluginName]/[JSP File]}
(e.g. {@code /plugins/foo/example.jsp}). It also listens for non JSP requests in the
form like {@code /plugins/[pluginName]/images/*.png|gif},
{@code /plugins/[pluginName]/scripts/*.js|css} or
{@code /plugins/[pluginName]/styles/*.css} (e.g.
{@code /plugins/foo/images/example.gif}).
</p>
JSP files must be compiled and available via the plugin's class loader. The mapping
between JSP name and servlet class files is defined in [pluginName]/web/web.xml.
Typically, this file is auto-generated by the JSP compiler when packaging the plugin.

@author Matt Tucker
xmppserver/src/main/java/org/jivesoftware/openfire/container/PluginServlet.java