We have an Alfresco CE 4.2.c production system alive now for two years. Several patches has been applied by now, but last week we found the last one: MNT-10938.
Every patch is applied by creating a new Alfresco module named by issue id (alf-mnt-10938) and by including only necessary source code in order to fix the problem. In this case,
SSOAuthenticationFilter java class from Share has to be modified. Obviously, we can include this patch in original Alfresco source code from 4.2.c release, build and deploy it as a new patched version. However, we prefer to maintain original Alfresco release untouched and to add every patch as an independent module.
Alfresco Share source code modified classes must be deployed at
tomcat/webapps/share/classes directory according to Tomcat class loader rules. So, we built an Alfresco module including only the patched
SSOAuthenticationFilter class, identified as
alf-mnt-10938 and mapped to share classes directory. In the future, when Alfresco version is upgraded, we have only to uninstall (or not to install) this module and the system will remain functionally equivalent.