Merge branch 'security-stable-1.642' into security-stable-1.651

core/src/main/java/hudson/PluginManager.java

@@ -803,6 +803,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
         LogFactory.release(uberClassLoader);
     }
 
+    @RequirePOST
     public HttpResponse doUpdateSources(StaplerRequest req) throws IOException {
         Jenkins.getInstance().checkPermission(CONFIGURE_UPDATECENTER);
 
@@ -825,6 +826,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
     /**
      * Performs the installation of the plugins.
      */
+    @RequirePOST
     public void doInstall(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
         boolean dynamicLoad = req.getParameter("dynamicLoad")!=null;
         final List<Future<UpdateCenter.UpdateCenterJob>> deployJobs = new ArrayList<>();