OpenSource/jenkins
1
0 Fork 0
mirror of https://github.com/jenkinsci/jenkins.git synced 2026-11-13 12:02:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

[JENKINS-73422] Add escape hatch for Authenticated user access to Resource URL (#9644)

Browse Source 
Co-authored-by: Daniel Beck <1831569+daniel-beck@users.noreply.github.com>
This commit is contained in:
Allan BurdajewiczandDaniel Beck authored and GitHub committed 2024-08-30 14:26:27 +01:00
1 parent 15e045f03d
commit 5fe9a44805
2 files changed
+14 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

core/src/main/java/jenkins/security/ResourceDomainRootAction.java
+5 -1
View File
@@ -117,7 +117,7 @@ public class ResourceDomainRootAction implements UnprotectedRootAction {
return null;
}
if (!ACL.isAnonymous2(Jenkins.getAuthentication2())) {
if (!ALLOW_AUTHENTICATED_USER && !ACL.isAnonymous2(Jenkins.getAuthentication2())) {
rsp.sendError(400);
return null;
}
@@ -327,4 +327,8 @@ public class ResourceDomainRootAction implements UnprotectedRootAction {
// Not @Restricted because the entire class is
@SuppressFBWarnings(value = "MS_SHOULD_BE_FINAL", justification = "for script console")
public static /* not final for Groovy */ int VALID_FOR_MINUTES = SystemProperties.getInteger(ResourceDomainRootAction.class.getName() + ".validForMinutes", 30);
/* Escape hatch for a security hardening preventing one of the known ways to elevate arbitrary file read to RCE */
@SuppressFBWarnings(value = "MS_SHOULD_BE_FINAL", justification = "for script console")
public static /* not final for Groovy */ boolean ALLOW_AUTHENTICATED_USER = SystemProperties.getBoolean(ResourceDomainRootAction.class.getName() + ".allowAuthenticatedUser", false);
}