From 3e1f02b5c3ff5d8a373f7a6c81d7c024d3a71956 Mon Sep 17 00:00:00 2001
From: Daniel Beck <daniel-beck@users.noreply.github.com>
Date: Sat, 1 Apr 2017 02:31:55 +0200
Subject: [PATCH] [SECURITY-413][SECURITY-414] RequirePOST in plugin manager

---
 core/src/main/java/hudson/PluginManager.java      | 2 ++
 core/src/main/java/hudson/model/UpdateCenter.java | 1 +
 2 files changed, 3 insertions(+)

diff --git a/core/src/main/java/hudson/PluginManager.java b/core/src/main/java/hudson/PluginManager.java
index 999f67dea9..48323f635d 100644
--- a/core/src/main/java/hudson/PluginManager.java
+++ b/core/src/main/java/hudson/PluginManager.java
@@ -745,6 +745,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
         LogFactory.release(uberClassLoader);
     }
 
+    @RequirePOST
     public HttpResponse doUpdateSources(StaplerRequest req) throws IOException {
         Jenkins.getInstance().checkPermission(CONFIGURE_UPDATECENTER);
 
@@ -767,6 +768,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
     /**
      * Performs the installation of the plugins.
      */
+    @RequirePOST
     public void doInstall(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
         boolean dynamicLoad = req.getParameter("dynamicLoad")!=null;
 
diff --git a/core/src/main/java/hudson/model/UpdateCenter.java b/core/src/main/java/hudson/model/UpdateCenter.java
index 016efbe80a..9cebbba78d 100644
--- a/core/src/main/java/hudson/model/UpdateCenter.java
+++ b/core/src/main/java/hudson/model/UpdateCenter.java
@@ -366,6 +366,7 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
      *
      * @since 1.432
      */
+    @RequirePOST
     public HttpResponse doInvalidateData() {
         Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER);
         for (UpdateSite site : sites) {