Merge remote-tracking branch 'origin/master'

core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java

@@ -75,6 +75,9 @@ import javax.crypto.SecretKeyFactory;
 import javax.crypto.spec.PBEKeySpec;
 import jenkins.model.Jenkins;
 import jenkins.security.FIPS140;
+import jenkins.security.NonePasswordComplexityRule;
+import jenkins.security.PasswordComplexityException;
+import jenkins.security.PasswordComplexityRule;
 import jenkins.security.SecurityListener;
 import jenkins.security.seed.UserSeedProperty;
 import jenkins.util.SystemProperties;

core/src/main/java/jenkins/security/BasicPasswordComplexityRule.java

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  *
- * Copyright (c) 2025, Jenkins project contributors
+ * Copyright (c) 2026, Jenkins project contributors
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -22,21 +22,24 @@
  * THE SOFTWARE.
  */
 
-package hudson.security;
+package jenkins.security;
 
 import edu.umd.cs.findbugs.annotations.NonNull;
 import hudson.Extension;
 import java.util.ArrayList;
 import java.util.List;
 import org.jenkinsci.Symbol;
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.kohsuke.stapler.DataBoundConstructor;
 
 /**
  * Built-in {@link PasswordComplexityRule} that checks minimum length
  * and character type requirements.
  *
- * @since 2.572
+ * @since 2.572 (moved from hudson.security to jenkins.security in 2.TODO)
  */
+@Restricted(NoExternalUse.class)
 public class BasicPasswordComplexityRule extends PasswordComplexityRule {
 
     private final int minimumLength;
@@ -83,26 +86,27 @@ public class BasicPasswordComplexityRule extends PasswordComplexityRule {
     public void validate(@NonNull String password) throws PasswordComplexityException {
         List<String> errors = new ArrayList<>();
         if (minimumLength > 0 && password.length() < minimumLength) {
-            errors.add(Messages.HudsonPrivateSecurityRealm_CreateAccount_PasswordTooShort(minimumLength));
+            errors.add(Messages.BasicPasswordComplexityRule_PasswordTooShort(minimumLength));
         }
         if (requireUppercase && !password.matches(".*[A-Z].*")) {
-            errors.add(Messages.HudsonPrivateSecurityRealm_CreateAccount_PasswordRequiresUppercase());
+            errors.add(Messages.BasicPasswordComplexityRule_PasswordRequiresUppercase());
         }
         if (requireLowercase && !password.matches(".*[a-z].*")) {
-            errors.add(Messages.HudsonPrivateSecurityRealm_CreateAccount_PasswordRequiresLowercase());
+            errors.add(Messages.BasicPasswordComplexityRule_PasswordRequiresLowercase());
         }
         if (requireDigit && !password.matches(".*[0-9].*")) {
-            errors.add(Messages.HudsonPrivateSecurityRealm_CreateAccount_PasswordRequiresDigit());
+            errors.add(Messages.BasicPasswordComplexityRule_PasswordRequiresDigit());
         }
-        if (requireSpecialCharacter && !password.matches(".*[^a-zA-Z0-9].*")) {
-            errors.add(Messages.HudsonPrivateSecurityRealm_CreateAccount_PasswordRequiresSpecialCharacter());
+        if (requireSpecialCharacter && !password.matches(".*\\p{Punct}.*")) {
+            errors.add(Messages.BasicPasswordComplexityRule_PasswordRequiresSpecialCharacter());
         }
         if (!errors.isEmpty()) {
-            throw new PasswordComplexityException(String.join(" ", errors));
+            throw new PasswordComplexityException(errors);
         }
     }
 
-    @Extension @Symbol("basicPasswordComplexity")
+    @Extension
+    @Symbol("basicPasswordComplexity")
     public static final class DescriptorImpl extends PasswordComplexityRuleDescriptor {
         @NonNull
         @Override

core/src/main/java/jenkins/security/NonePasswordComplexityRule.java

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  *
- * Copyright (c) 2025, Jenkins project contributors
+ * Copyright (c) 2026, Jenkins project contributors
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -22,18 +22,21 @@
  * THE SOFTWARE.
  */
 
-package hudson.security;
+package jenkins.security;
 
 import edu.umd.cs.findbugs.annotations.NonNull;
 import hudson.Extension;
 import org.jenkinsci.Symbol;
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.kohsuke.stapler.DataBoundConstructor;
 
 /**
  * A {@link PasswordComplexityRule} that accepts any password.
  *
- * @since 2.572
+ * @since 2.572 (moved from hudson.security to jenkins.security in 2.TODO)
  */
+@Restricted(NoExternalUse.class)
 public class NonePasswordComplexityRule extends PasswordComplexityRule {
 
     @DataBoundConstructor
@@ -42,10 +45,10 @@ public class NonePasswordComplexityRule extends PasswordComplexityRule {
 
     @Override
     public void validate(@NonNull String password) {
-        // No validation — any password is accepted
     }
 
-    @Extension @Symbol("nonePasswordComplexity")
+    @Extension
+    @Symbol("nonePasswordComplexity")
     public static final class DescriptorImpl extends PasswordComplexityRuleDescriptor {
         @NonNull
         @Override

core/src/main/java/jenkins/security/PasswordComplexityException.java

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  *
- * Copyright (c) 2025, Jenkins project contributors
+ * Copyright (c) 2026, Jenkins project contributors
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -22,16 +22,26 @@
  * THE SOFTWARE.
  */
 
-package hudson.security;
+package jenkins.security;
+
+import java.util.List;
 
 /**
  * Thrown by {@link PasswordComplexityRule#validate(String)} when a password
  * does not meet the configured complexity requirements.
  *
- * @since 2.572
+ * @since 2.572 (moved from hudson.security to jenkins.security in 2.TODO)
  */
 public class PasswordComplexityException extends Exception {
-    public PasswordComplexityException(String message) {
-        super(message);
+
+    private final List<String> violations;
+
+    public PasswordComplexityException(List<String> violations) {
+        super(String.join(" ", violations));
+        this.violations = List.copyOf(violations);
+    }
+
+    public List<String> getViolations() {
+        return violations;
     }
 }

core/src/main/java/jenkins/security/PasswordComplexityRule.java

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  *
- * Copyright (c) 2025, Jenkins project contributors
+ * Copyright (c) 2026, Jenkins project contributors
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -22,13 +22,14 @@
  * THE SOFTWARE.
  */
 
-package hudson.security;
+package jenkins.security;
 
 import edu.umd.cs.findbugs.annotations.NonNull;
 import hudson.DescriptorExtensionList;
 import hudson.ExtensionPoint;
 import hudson.model.Describable;
 import hudson.model.Descriptor;
+import hudson.security.HudsonPrivateSecurityRealm;
 import jenkins.model.Jenkins;
 
 /**
@@ -39,7 +40,7 @@ import jenkins.model.Jenkins;
  * and password changes. Each implementation can have an optional {@code config.jelly}
  * to configure its validation rules.
  *
- * @since 2.572
+ * @since 2.572 (moved from hudson.security to jenkins.security in 2.TODO)
  */
 public abstract class PasswordComplexityRule implements Describable<PasswordComplexityRule>, ExtensionPoint {
 

core/src/main/java/jenkins/security/PasswordComplexityRuleDescriptor.java

@@ -1,7 +1,7 @@
 /*
  * The MIT License
  *
- * Copyright (c) 2025, Jenkins project contributors
+ * Copyright (c) 2026, Jenkins project contributors
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -22,14 +22,14 @@
  * THE SOFTWARE.
  */
 
-package hudson.security;
+package jenkins.security;
 
 import hudson.model.Descriptor;
 
 /**
  * {@link Descriptor} for {@link PasswordComplexityRule}.
  *
- * @since 2.572
+ * @since 2.572 (moved from hudson.security to jenkins.security in 2.TODO)
  */
 public abstract class PasswordComplexityRuleDescriptor extends Descriptor<PasswordComplexityRule> {
 }

core/src/main/java/jenkins/util/HttpSessionListener.java

@@ -61,8 +61,8 @@ public abstract class HttpSessionListener implements ExtensionPoint, jakarta.ser
 
     @Override
     public void sessionDestroyed(HttpSessionEvent httpSessionEvent) {
-        if (Util.isOverridden(HttpSessionListener.class, getClass(), "sessionCreated", javax.servlet.http.HttpSessionEvent.class)) {
-            sessionCreated(HttpSessionEventWrapper.fromJakartaHttpSessionEvent(httpSessionEvent));
+        if (Util.isOverridden(HttpSessionListener.class, getClass(), "sessionDestroyed", javax.servlet.http.HttpSessionEvent.class)) {
+            sessionDestroyed(HttpSessionEventWrapper.fromJakartaHttpSessionEvent(httpSessionEvent));
         }
     }
 

core/src/main/resources/hudson/security/HudsonPrivateSecurityRealm/Details/config.jelly

@@ -25,9 +25,9 @@ THE SOFTWARE.
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:f="/lib/form">
     <f:entry title="${%Password}:">
-      <input class="jenkins-input validated" checkMethod="post" checkUrl="${descriptor.getCheckMethod('password').toStemUrl()}" checkDependsOn="" name="user.password" type="password" value="${instance.protectedPassword}" />
+      <input class="jenkins-input validated" checkUrl="${descriptor.getCheckMethod('password').toStemUrl()}" checkDependsOn="" name="user.password" type="password" value="${instance.protectedPassword}" />
     </f:entry>
     <f:entry title="${%Confirm Password}:">
-      <input class="jenkins-input validated" checkMethod="post" checkUrl="${descriptor.getCheckMethod('password').toStemUrl()}" checkDependsOn="" name="user.password2" type="password" value="${instance.protectedPassword}" />
+      <input class="jenkins-input validated" checkUrl="${descriptor.getCheckMethod('password').toStemUrl()}" checkDependsOn="" name="user.password2" type="password" value="${instance.protectedPassword}" />
     </f:entry>
 </j:jelly>

core/src/main/resources/hudson/security/LegacySecurityRealm/config_es.properties

@@ -1,6 +1,6 @@
 # This file is under the MIT License by authors
 
-Unprotected\ URLs=URLs Desprotegidas
+Unprotected\ URLs=URLs no protegidas
 blurb=\
-    Estas URLs (y las URLs que inician con el prefijo /) no requieren autenticación. \
-    Si es posible, configure su servidor para pasar estas peticiones directamente a Jenkins sin requerir autenticación.
+    Estas URLs (y las URLs que empiecen con estos prefijos seguidos de una barra "/") no deberían requerir autenticación. \
+    Si es posible, configure su contenedor para que estas peticiones se pasen directamente a Jenkins sin necesidad de iniciar sesión.

core/src/main/resources/hudson/security/Messages.properties

@@ -45,14 +45,6 @@ HudsonPrivateSecurityRealm.CreateAccount.UserNameInvalidCharacters=User name mus
 HudsonPrivateSecurityRealm.CreateAccount.UserNameInvalidCharactersCustom=User name must match the following expression: {0}
 HudsonPrivateSecurityRealm.CreateAccount.InvalidEmailAddress=Invalid e-mail address
 HudsonPrivateSecurityRealm.CreateAccount.UserNameAlreadyTaken=User name is already taken
-HudsonPrivateSecurityRealm.CreateAccount.PasswordTooShort=Password must be at least {0} characters long.
-HudsonPrivateSecurityRealm.CreateAccount.PasswordRequiresUppercase=Password must contain at least one uppercase letter (A-Z).
-HudsonPrivateSecurityRealm.CreateAccount.PasswordRequiresLowercase=Password must contain at least one lowercase letter (a-z).
-HudsonPrivateSecurityRealm.CreateAccount.PasswordRequiresDigit=Password must contain at least one digit (0-9).
-HudsonPrivateSecurityRealm.CreateAccount.PasswordRequiresSpecialCharacter=Password must contain at least one special character.
-
-BasicPasswordComplexityRule.DisplayName=Basic password complexity
-NonePasswordComplexityRule.DisplayName=None
 
 FullControlOnceLoggedInAuthorizationStrategy.DisplayName=Logged-in users can do anything
 

core/src/main/resources/jenkins/security/BasicPasswordComplexityRule/config.jelly

@@ -13,6 +13,6 @@
     <f:checkbox default="false" title="${%Require at least one digit (0-9)}" />
   </f:entry>
   <f:entry field="requireSpecialCharacter">
-    <f:checkbox default="false" title="${%Require at least one special character}" />
+    <f:checkbox default="false" title="${%Require at least one special character (e.g. !@#$%^&amp;*)}" />
   </f:entry>
 </j:jelly>

core/src/main/resources/jenkins/security/Messages.properties

@@ -70,3 +70,11 @@ ResourceDomainConfiguration.Invalid=Not a valid URL.
 ResourceDomainConfiguration.SameAsJenkinsRoot=Cannot use the same host name for both Jenkins URL and resource root URL.
 ResourceDomainConfiguration.SameAsCurrent=You are currently accessing Jenkins through a URL similar to the proposed resource root URL. Saving this URL might remove your access to Jenkins.
 
+BasicPasswordComplexityRule.DisplayName=Basic password complexity
+BasicPasswordComplexityRule.PasswordTooShort=Password must be at least {0} characters long.
+BasicPasswordComplexityRule.PasswordRequiresUppercase=Password must contain at least one uppercase letter (A-Z).
+BasicPasswordComplexityRule.PasswordRequiresLowercase=Password must contain at least one lowercase letter (a-z).
+BasicPasswordComplexityRule.PasswordRequiresDigit=Password must contain at least one digit (0-9).
+BasicPasswordComplexityRule.PasswordRequiresSpecialCharacter=Password must contain at least one special character (e.g. !@#$%^&*).
+NonePasswordComplexityRule.DisplayName=None
+

core/src/test/java/jenkins/security/BasicPasswordComplexityRuleTest.java

@@ -1,4 +1,4 @@
-package hudson.security;
+package jenkins.security;
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.allOf;

test/src/test/java/hudson/security/HudsonPrivateSecurityRealmTest.java

@@ -55,6 +55,7 @@ import java.util.Collections;
 import java.util.List;
 import java.util.logging.Level;
 import jenkins.security.ApiTokenProperty;
+import jenkins.security.BasicPasswordComplexityRule;
 import jenkins.security.SecurityListener;
 import jenkins.security.apitoken.ApiTokenPropertyConfiguration;
 import jenkins.security.seed.UserSeedProperty;