Add /DotAjaxDirector to CMSUrlUtil.BACKEND_FILTERED_COLLECTION

Summary

CMSUrlUtil.BACKEND_FILTERED_COLLECTION — the public canonical list of URI prefixes
that belong to the dotCMS backoffice — is missing /DotAjaxDirector, even though the
servlet is exclusively used by the admin console.

Current state

dotCMS/src/main/java/com/dotmarketing/filters/CMSUrlUtil.java:71-74

public static final Set<String> BACKEND_FILTERED_COLLECTION =
    Stream.of("/api", "/webdav", "/dA", "/c/", "/contentAsset", "/DOTSASS", "/DOTLESS",
              "/html", "/dotAdmin", "/custom-elements","/dotcms-webcomponents","/dwr")
        .collect(Collectors.collectingAndThen(toSet(), Collections::unmodifiableSet));

/DotAjaxDirector is served by
com.dotmarketing.servlets.ajax.AjaxDirectorServlet (mapped in
dotCMS/src/main/webapp/WEB-INF/web.xml:487-490) which reflectively dispatches to
AjaxAction subclasses under a class-name path segment. Every caller I could find is
backend-only:

• Legacy admin JSPs under dotCMS/src/main/webapp/html/portlet/ext/** (workflows,
  publishing, site search, cms maintenance, link checker) — 30+ references
• Angular admin services in core-web/libs/data-access/ (push-publish, add-to-bundle,
  rules bundle service)
• Already treated as backend-login-required in
  DefaultBackEndLoginRequiredWebInterceptor.java:32-33

Why it matters

Any consumer of CMSUrlUtil.internalUrl(uri) (vanity URL routing, URL map filtering,
downstream security filters, community plugins) currently treats /DotAjaxDirector/*
requests as if they might be frontend content — even though they cannot be. Community
plugins that gate frontend requests (e.g. the community Basic Auth plugin — see
freshdesk ticket #36882) have to redundantly maintain their own exclusion for
/DotAjaxDirector because they can't rely on the canonical list.

Proposed change

Add /DotAjaxDirector to BACKEND_FILTERED_COLLECTION.

Not included

• /image — deliberately excluded. The only live mapping today is the exact path
  /image/company_logo (Liferay ImageServlet, essentially deprecated — it now
  forwards to /dA/). Adding the /image prefix would coarsely swallow any customer
  frontend URL starting with /image/, which is not worth it for covering one
  deprecated exact-match endpoint. Consumers that need /image/company_logo to be
  treated as backoffice can match it exactly on their side.

Acceptance criteria

• BACKEND_FILTERED_COLLECTION contains /DotAjaxDirector.
• CMSUrlUtil.internalUrl("/DotAjaxDirector/foo/bar") returns true.
• No regression in internalUrl behavior for existing prefixes.

Files

• dotCMS/src/main/java/com/dotmarketing/filters/CMSUrlUtil.java
• unit test coverage under dotCMS/src/test/java/com/dotmarketing/filters/

Affected versions

• Current Evergreen 26.06.30-01.

External Links

https://helpdesk.dotcms.com/a/tickets/36882

Start in dotCMS/src/main/java/com/dotmarketing/filters/CMSUrlUtil.java and inspect the existing internalUrl behavior, then review unit tests under dotCMS/src/test/java/com/dotmarketing/filters/. Add the /DotAjaxDirector prefix and cover the stated path plus existing-prefix behavior. Done means the acceptance criteria pass without regressions.