[FIX SECURITY-250] Restrict access to admin APIs

core/src/main/java/hudson/PluginWrapper.java

@@ -218,6 +218,7 @@ public class PluginWrapper implements Comparable<PluginWrapper>, ModelObject {
     }
 
     public Api getApi() {
+        Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER);
         return new Api(this);
     }