[FIX SECURITY-273] Require admin permission to check update sites

core/src/main/java/hudson/PluginManager.java

@@ -889,6 +889,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
 
     @Restricted(NoExternalUse.class)
     @RequirePOST public HttpResponse doCheckUpdatesServer() throws IOException {
+        Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER);
         for (UpdateSite site : Jenkins.getInstance().getUpdateCenter().getSites()) {
             FormValidation v = site.updateDirectlyNow(DownloadService.signatureCheck);
             if (v.kind != FormValidation.Kind.OK) {