From b5ed977bbca76f0ff1cd09ea9767d876e98aa64e Mon Sep 17 00:00:00 2001 From: Wadeck Follonier Date: Thu, 22 Mar 2018 09:13:11 +0100 Subject: [PATCH] [JENKINS-50324] User without READ cannot logout - or even ask who they are --- core/src/main/java/hudson/cli/CLICommand.java | 2 +- .../test/java/hudson/cli/CLIActionTest.java | 26 +++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/hudson/cli/CLICommand.java b/core/src/main/java/hudson/cli/CLICommand.java index 5efbaf3a33..37ddbb0619 100644 --- a/core/src/main/java/hudson/cli/CLICommand.java +++ b/core/src/main/java/hudson/cli/CLICommand.java @@ -273,7 +273,7 @@ public abstract class CLICommand implements ExtensionPoint, Cloneable { if (auth==Jenkins.ANONYMOUS) auth = loadStoredAuthentication(); sc.setAuthentication(auth); // run the CLI with the right credential - if (!(this instanceof LoginCommand || this instanceof HelpCommand)) + if (!(this instanceof LoginCommand || this instanceof LogoutCommand || this instanceof HelpCommand || this instanceof WhoAmICommand)) Jenkins.getActiveInstance().checkPermission(Jenkins.READ); return run(); } catch (CmdLineException e) { diff --git a/test/src/test/java/hudson/cli/CLIActionTest.java b/test/src/test/java/hudson/cli/CLIActionTest.java index 0c29a2d86e..351eb7d26a 100644 --- a/test/src/test/java/hudson/cli/CLIActionTest.java +++ b/test/src/test/java/hudson/cli/CLIActionTest.java @@ -269,6 +269,32 @@ public class CLIActionTest { assertEquals(0, proc.join()); } + @Test + @Issue("JENKINS-50324") + public void userWithoutReadCanLogout() throws Exception { + String userWithRead = "userWithRead"; + String userWithoutRead = "userWithoutRead"; + + File jar = tmp.newFile("jenkins-cli.jar"); + FileUtils.copyURLToFile(j.jenkins.getJnlpJars("jenkins-cli.jar").getURL(), jar); + j.jenkins.setSecurityRealm(j.createDummySecurityRealm()); + j.jenkins.setAuthorizationStrategy(new MockAuthorizationStrategy() + .grant(Jenkins.ADMINISTER).everywhere().to(ADMIN) + .grant(Jenkins.READ).everywhere().to(userWithRead) + // nothing to userWithoutRead + ); + + checkCanLogout(jar, ADMIN); + checkCanLogout(jar, userWithRead); + checkCanLogout(jar, userWithoutRead); + } + + private void checkCanLogout(File cliJar, String userLoginAndPassword) throws Exception { + assertExitCode(0, false, cliJar, "-remoting", "login", "--username", userLoginAndPassword, "--password", userLoginAndPassword); + assertExitCode(0, false, cliJar, "-remoting", "who-am-i"); + assertExitCode(0, false, cliJar, "-remoting", "logout"); + } + @TestExtension("encodingAndLocale") public static class TestDiagnosticCommand extends CLICommand {