Openfire 3.10.0 on Windows, using external Oracle database and REST API plugin.
If a list of IP Addresses is added to the REST API's AllowedIPs and then saved, a new property 'plugin.restapi.allowedIPs' is created in the database. Later, through the Admin Console, if the same field is cleared it appears as though all IP addresses are allowed. However, after restart of the Openfire service, the original list of IPs will return.
It seems the Admin Console tries to set the 'plugin.restapi.allowedIPs' to 'null'. However, the database schema prevents a null value for this column. So the value is left unchanged. Once the service restarts the original non-null value is used.
java.sql.SQLException: ORA-01407: cannot update ("OPENFIRE"."OFPROPERTY"."PROPVALUE") to NULL
Delete the 'plugin.restapi.allowedIPs' property via the Admin Console's System Properties page.