[SECURITY-266] Conceal ciphertext from the web UI for a user who has no Item.CONFIGURE permission.

core/src/main/java/hudson/Functions.java

@@ -1715,7 +1715,16 @@ public class Functions {
      */
     public String getPasswordValue(Object o) {
         if (o==null)    return null;
-        if (o instanceof Secret)    return ((Secret)o).getEncryptedValue();
+        if (o instanceof Secret) {
+            StaplerRequest req = Stapler.getCurrentRequest();
+            if (req != null) {
+                Item item = req.findAncestorObject(Item.class);
+                if (item != null && !item.hasPermission(Item.CONFIGURE)) {
+                    return "<some secret>";
+                }
+            }
+            return ((Secret) o).getEncryptedValue();
+        }
         if (getIsUnitTest()) {
             throw new SecurityException("attempted to render plaintext ‘" + o + "’ in password field; use a getter of type Secret instead");
         }