OpenSource/jenkins
1
0 Fork 0
mirror of https://github.com/jenkinsci/jenkins.git synced 2026-11-14 04:22:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

[JEP-223] Deprecate permissions RUN_SCRIPTS, UPLOAD_PLUGINS, an… (#4365)

Browse Source 
Co-authored-by: Jesse Glick <jglick@cloudbees.com>
Co-authored-by: Tim Jacomb <t.jacomb@kainos.com>
Co-authored-by: Daniel Beck <1831569+daniel-beck@users.noreply.github.com>
This commit is contained in:
michael cirioliJesse GlickTim JacombDaniel Beck
 authored and GitHub committed 2020-02-22 15:28:42 +00:00
1 parent 991f379924
commit 9ead76e210
36 files changed
+33 -95
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

core/src/main/java/hudson/PluginManager.java
+9 -4
View File
@@ -1394,7 +1394,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
@RequirePOST
public HttpResponse doUpdateSources(StaplerRequest req) throws IOException {
Jenkins.get().checkPermission(CONFIGURE_UPDATECENTER);
Jenkins.get().checkPermission(Jenkins.ADMINISTER);
if (req.hasParameter("remove")) {
UpdateCenter uc = Jenkins.get().getUpdateCenter();
@@ -1600,7 +1600,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
@RequirePOST
public HttpResponse doSiteConfigure(@QueryParameter String site) throws IOException {
Jenkins hudson = Jenkins.get();
hudson.checkPermission(CONFIGURE_UPDATECENTER);
hudson.checkPermission(Jenkins.ADMINISTER);
UpdateCenter uc = hudson.getUpdateCenter();
PersistedList<UpdateSite> sites = uc.getSites();
for (UpdateSite s : sites) {
@@ -1615,7 +1615,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
@POST
public HttpResponse doProxyConfigure(StaplerRequest req) throws IOException, ServletException {
Jenkins jenkins = Jenkins.get();
jenkins.checkPermission(CONFIGURE_UPDATECENTER);
jenkins.checkPermission(Jenkins.ADMINISTER);
ProxyConfiguration pc = req.bindJSON(ProxyConfiguration.class, req.getSubmittedForm());
if (pc.name==null) {
@@ -1634,7 +1634,7 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
@RequirePOST
public HttpResponse doUploadPlugin(StaplerRequest req) throws IOException, ServletException {
try {
Jenkins.get().checkPermission(UPLOAD_PLUGINS);
Jenkins.get().checkPermission(Jenkins.ADMINISTER);
ServletFileUpload upload = new ServletFileUpload(new DiskFileItemFactory());
@@ -2105,7 +2105,12 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
}
public static boolean FAST_LOOKUP = !SystemProperties.getBoolean(PluginManager.class.getName()+".noFastLookup");
/** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */
@Deprecated
public static final Permission UPLOAD_PLUGINS = new Permission(Jenkins.PERMISSIONS, "UploadPlugins", Messages._PluginManager_UploadPluginsPermission_Description(),Jenkins.ADMINISTER,PermissionScope.JENKINS);
/** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */
@Deprecated
public static final Permission CONFIGURE_UPDATECENTER = new Permission(Jenkins.PERMISSIONS, "ConfigureUpdateCenter", Messages._PluginManager_ConfigureUpdateCenterPermission_Description(),Jenkins.ADMINISTER,PermissionScope.JENKINS);
/**
core/src/main/java/hudson/cli/GroovyCommand.java
+1 -1
View File
@@ -59,7 +59,7 @@ public class GroovyCommand extends CLICommand {
protected int run() throws Exception {
// this allows the caller to manipulate the JVM state, so require the execute script privilege.
Jenkins.get().checkPermission(Jenkins.RUN_SCRIPTS);
Jenkins.get().checkPermission(Jenkins.ADMINISTER);
Binding binding = new Binding();
binding.setProperty("out",new PrintWriter(stdout,true));
core/src/main/java/hudson/cli/GroovyshCommand.java
+1 -1
View File
@@ -60,7 +60,7 @@ public class GroovyshCommand extends CLICommand {
@Override
protected int run() {
// this allows the caller to manipulate the JVM state, so require the admin privilege.
Jenkins.get().checkPermission(Jenkins.RUN_SCRIPTS);
Jenkins.get().checkPermission(Jenkins.ADMINISTER);
// this being remote means no jline capability is available
System.setProperty("jline.terminal", UnsupportedTerminal.class.getName());
core/src/main/java/hudson/cli/InstallPluginCommand.java
+1 -1
View File
@@ -83,7 +83,7 @@ public class InstallPluginCommand extends CLICommand {
@Override
protected int run() throws Exception {
Jenkins h = Jenkins.get();
h.checkPermission(PluginManager.UPLOAD_PLUGINS);
h.checkPermission(Jenkins.ADMINISTER);
PluginManager pm = h.getPluginManager();
if (name != null) {
core/src/main/java/hudson/util/RemotingDiagnostics.java
+1 -1
View File
@@ -196,7 +196,7 @@ public final class RemotingDiagnostics {
@WebMethod(name="heapdump.hprof")
public void doHeapDump(StaplerRequest req, StaplerResponse rsp) throws IOException, InterruptedException {
owner.checkPermission(Jenkins.RUN_SCRIPTS);
owner.checkPermission(Jenkins.ADMINISTER);
rsp.setContentType("application/octet-stream");
FilePath dump = obtain();
core/src/main/java/jenkins/management/ConsoleLink.java
+1 -1
View File
@@ -57,6 +57,6 @@ public class ConsoleLink extends ManagementLink {
@Override
public Permission getRequiredPermission() {
return Jenkins.RUN_SCRIPTS;
return Jenkins.ADMINISTER;
}
}
core/src/main/java/jenkins/model/Jenkins.java
+4 -2
View File
@@ -4463,7 +4463,7 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
*/
public static void _doScript(StaplerRequest req, StaplerResponse rsp, RequestDispatcher view, VirtualChannel channel, ACL acl) throws IOException, ServletException {
// ability to run arbitrary script is dangerous
acl.checkPermission(RUN_SCRIPTS);
acl.checkPermission(ADMINISTER);
String text = req.getParameter("script");
if (text != null) {
@@ -4493,7 +4493,7 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
*/
@RequirePOST
public void doEval(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
checkPermission(RUN_SCRIPTS);
checkPermission(ADMINISTER);
req.getWebApp().getDispatchValidator().allowDispatch(req, rsp);
try {
MetaClass mc = req.getWebApp().getMetaClass(getClass());
@@ -5282,6 +5282,8 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
new Permission[] { MANAGE, SYSTEM_READ };
public static final Permission READ = new Permission(PERMISSIONS,"Read",Messages._Hudson_ReadPermission_Description(),Permission.READ,PermissionScope.JENKINS);
/** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */
@Deprecated
public static final Permission RUN_SCRIPTS = new Permission(PERMISSIONS, "RunScripts", Messages._Hudson_RunScriptsPermission_Description(),ADMINISTER,PermissionScope.JENKINS);
/**
core/src/main/java/jenkins/security/s2m/AdminWhitelistRule.java
+2 -2
View File
@@ -212,7 +212,7 @@ public class AdminWhitelistRule implements StaplerProxy {
public void setMasterKillSwitch(boolean state) {
final Jenkins jenkins = Jenkins.get();
try {
jenkins.checkPermission(Jenkins.RUN_SCRIPTS);
jenkins.checkPermission(Jenkins.ADMINISTER);
File f = getMasterKillSwitchFile(jenkins);
FileUtils.writeStringToFile(f, Boolean.toString(state), Charset.defaultCharset());
// treat the file as the canonical source of information in case write fails
@@ -227,7 +227,7 @@ public class AdminWhitelistRule implements StaplerProxy {
*/
@Override
public Object getTarget() {
Jenkins.get().checkPermission(Jenkins.RUN_SCRIPTS);
Jenkins.get().checkPermission(Jenkins.ADMINISTER);
return this;
}
core/src/main/java/jenkins/security/s2m/MasterKillSwitchConfiguration.java
+1 -1
View File
@@ -48,7 +48,7 @@ public class MasterKillSwitchConfiguration extends GlobalConfiguration {
* Unless this option is relevant, we don't let users choose this.
*/
public boolean isRelevant() {
return jenkins.hasPermission(Jenkins.RUN_SCRIPTS) && jenkins.isUseSecurity();
return jenkins.hasPermission(Jenkins.ADMINISTER) && jenkins.isUseSecurity();
}
}