From 1ff064187b485d39860fdc0eaa201fe90f9155fc Mon Sep 17 00:00:00 2001
From: kohsuke <kohsuke@71c3de6d-444a-0410-be80-ed276b4c234a>
Date: Thu, 19 Jul 2007 21:25:05 +0000
Subject: [PATCH] fixed a security hole.

git-svn-id: https://hudson.dev.java.net/svn/hudson/trunk/hudson/main@3740 71c3de6d-444a-0410-be80-ed276b4c234a
---
 core/src/main/java/hudson/PluginWrapper.java                 | 5 +++++
 .../main/resources/hudson/model/Hudson/managePlugins.jelly   | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/core/src/main/java/hudson/PluginWrapper.java b/core/src/main/java/hudson/PluginWrapper.java
index a8a1754888..08f22b7274 100644
--- a/core/src/main/java/hudson/PluginWrapper.java
+++ b/core/src/main/java/hudson/PluginWrapper.java
@@ -1,6 +1,7 @@
 package hudson;
 
 import hudson.util.IOException2;
+import hudson.model.Hudson;
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.Project;
 import org.apache.tools.ant.taskdefs.Expand;
@@ -434,10 +435,14 @@ public final class PluginWrapper {
 //
 //
     public void doMakeEnabled(StaplerRequest req, StaplerResponse rsp) throws IOException {
+        if(!Hudson.adminCheck(req,rsp))
+            return;
         enable();
         rsp.setStatus(200);
     }
     public void doMakeDisabled(StaplerRequest req, StaplerResponse rsp) throws IOException {
+        if(!Hudson.adminCheck(req,rsp))
+            return;
         disable();
         rsp.setStatus(200);
     }
diff --git a/core/src/main/resources/hudson/model/Hudson/managePlugins.jelly b/core/src/main/resources/hudson/model/Hudson/managePlugins.jelly
index 86ab1eb6f6..a01dbe28af 100644
--- a/core/src/main/resources/hudson/model/Hudson/managePlugins.jelly
+++ b/core/src/main/resources/hudson/model/Hudson/managePlugins.jelly
@@ -2,7 +2,7 @@
   Config page
 -->
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
-<l:layout>
+<l:layout secured="true">
   <st:include page="sidepanel.jelly" />
   <l:main-panel>
     <s:form method="post" action="configSubmit">