OpenSource/jenkins
1
0 Fork 0
mirror of https://github.com/jenkinsci/jenkins.git synced 2026-11-10 10:36:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SECURITY-63] Require POST for running Groovy scripts.

Browse Source
This commit is contained in:
Jesse Glick committed 2013-04-24 18:02:49 -04:00
1 parent 64ff047094
commit 3bbb65df3a
4 files changed
+50 -36
Notes: Kohsuke Kawaguchi 2013-05-01 18:59:00 -07:00 
[FIXED SECURITY-63]
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

maven-plugin/src/main/java/hudson/maven/MavenProbeAction.java
+1 -15
View File
@@ -97,21 +97,7 @@ public final class MavenProbeAction implements Action {
}
public void doScript( StaplerRequest req, StaplerResponse rsp ) throws IOException, ServletException {
// ability to run arbitrary script is dangerous,
// so tie it to the admin access
owner.checkPermission(Jenkins.RUN_SCRIPTS);
String text = req.getParameter("script");
if(text!=null) {
try {
req.setAttribute("output",
RemotingDiagnostics.executeGroovy(text,channel));
} catch (InterruptedException e) {
throw new ServletException(e);
}
}
req.getView(this,"_script.jelly").forward(req,rsp);
Jenkins._doScript(req, rsp, req.getView(this, "_script.jelly"), channel, owner.getACL());
}
/**