From 17edeb48291a3807b84142bb01f576b8eb2f50a2 Mon Sep 17 00:00:00 2001 From: Daniel Beck Date: Mon, 15 Feb 2016 03:48:25 +0100 Subject: [PATCH 1/2] [FIX SECURITY-250] Restrict access to admin APIs --- core/src/main/java/hudson/PluginManager.java | 1 + core/src/main/java/hudson/PluginWrapper.java | 1 + core/src/main/java/hudson/model/UpdateCenter.java | 1 + 3 files changed, 3 insertions(+) diff --git a/core/src/main/java/hudson/PluginManager.java b/core/src/main/java/hudson/PluginManager.java index b7cb78fedf..e1e02a36a1 100644 --- a/core/src/main/java/hudson/PluginManager.java +++ b/core/src/main/java/hudson/PluginManager.java @@ -211,6 +211,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas } public Api getApi() { + Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER); return new Api(this); } diff --git a/core/src/main/java/hudson/PluginWrapper.java b/core/src/main/java/hudson/PluginWrapper.java index aa683e630f..827872614f 100644 --- a/core/src/main/java/hudson/PluginWrapper.java +++ b/core/src/main/java/hudson/PluginWrapper.java @@ -218,6 +218,7 @@ public class PluginWrapper implements Comparable, ModelObject { } public Api getApi() { + Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER); return new Api(this); } diff --git a/core/src/main/java/hudson/model/UpdateCenter.java b/core/src/main/java/hudson/model/UpdateCenter.java index 60844a3a52..3d15d2fa59 100644 --- a/core/src/main/java/hudson/model/UpdateCenter.java +++ b/core/src/main/java/hudson/model/UpdateCenter.java @@ -175,6 +175,7 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas } public Api getApi() { + Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER); return new Api(this); } From 56be107feb24ab3470efae7603041bbbb9cdf7fb Mon Sep 17 00:00:00 2001 From: Daniel Beck Date: Mon, 25 Apr 2016 21:06:54 +0200 Subject: [PATCH 2/2] [FIX SECURITY-273] Require admin permission to check update sites --- core/src/main/java/hudson/PluginManager.java | 1 + 1 file changed, 1 insertion(+) diff --git a/core/src/main/java/hudson/PluginManager.java b/core/src/main/java/hudson/PluginManager.java index b7cb78fedf..9d89d4acec 100644 --- a/core/src/main/java/hudson/PluginManager.java +++ b/core/src/main/java/hudson/PluginManager.java @@ -889,6 +889,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas @Restricted(NoExternalUse.class) @RequirePOST public HttpResponse doCheckUpdatesServer() throws IOException { + Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER); for (UpdateSite site : Jenkins.getInstance().getUpdateCenter().getSites()) { FormValidation v = site.updateDirectlyNow(DownloadService.signatureCheck); if (v.kind != FormValidation.Kind.OK) {