Commit Graph
159 Commits
Author SHA1 Message Date
Jesse Glick 189f101dcb Merge branch 'security-stable-1.642' into security-stable-1.651 2017-04-13 13:40:56 -04:00
Jesse Glick a18f7432fe Merge branch 'security-stable-1.625' into security-stable-1.642 2017-04-13 13:37:06 -04:00
Daniel Beck 3e1f02b5c3 [SECURITY-413][SECURITY-414] RequirePOST in plugin manager 2017-04-13 13:32:35 -04:00
Oleg Nenashev c6131436f4 [JENKINS-34745] - Prevent CheckUpdates PeriodicWork death if update site cert is missing (#2333)
* [JENKINS-34745] - Prevent CheckUpdates PeriodicWork death in the case of the missing update site signature

* [JENKINS-34745] - Fix typo in the validator

* [JENKINS-34745] - Fix the formatting of the validation message (cc @lanwen)

(cherry picked from commit 1e6afbae3b)
2016-05-25 10:01:25 +02:00
Jesse Glick d39ccfac86 Merge branch 'security-stable-1.642' into security-stable-1.651 2016-04-26 15:58:33 -04:00
Jesse Glick 93229dfc24 Merge branch 'security-stable-1.625' into security-stable-1.642 2016-04-26 15:57:52 -04:00
Jesse Glick 97a62a9bcc Merge branch 'security-stable-1.609' into security-stable-1.625 2016-04-26 15:57:32 -04:00
Jesse Glick 53dd9046c9 Merge pull request #68 from jenkinsci-cert/SECURITY-273
[FIX SECURITY-273] Require admin permission to check update sites
2016-04-26 15:57:12 -04:00
Daniel Beck 56be107feb [FIX SECURITY-273] Require admin permission to check update sites 2016-04-25 21:06:54 +02:00
Daniel Beck 17edeb4829 [FIX SECURITY-250] Restrict access to admin APIs 2016-02-15 03:48:25 +01:00
Stephen Connolly 566def3bd6 [JENKINS-32765] Fix failing tests 2016-02-04 17:12:10 +00:00
Stephen Connolly bdb3c0c6d5 [JENKINS-32765] As I am not *adding* a new import, I will annotate with @CheckForNull
Of course the import being used is in a package name that is reserved for artifacts produced by a JSR... and the JSR that the dependency is claiming to come from has not actually published anything... thus whoever produced the artifact has broken the JSR policy... and it is also not safe for us to actually use these annotations as we do not know what a JSR may change on the road to actually providing this... but that is a war for a different PR
2016-02-04 15:35:41 +00:00
Stephen Connolly c0cbff7297 [JENKINS-32765] Perhaps it makes more sense to make this a property of the PluginManager rather than the classic strategy
- Also expose via servlet context parameter of same name to allow multiple instances of Jenkins in the same servlet container to have different directories
- As we are no longer a constant, change the system property to camelCase
2016-02-04 14:40:44 +00:00
Jesse Glick 04e522fb03 Merge branch 'security-stable-1.625' into security-master 2015-11-25 15:31:12 -05:00
Jesse Glick 6e50702a05 Merge branch 'security-stable-1.609' into security-stable-1.625 2015-11-25 15:29:30 -05:00
Daniel Beck 40a28999e2 [FIX SECURITY-225] Add RequirePOST annotations 2015-11-15 21:07:06 +01:00
tfennelly a8e83c3c2d Tweaks based on review comments 2015-10-06 09:44:11 +01:00
tfennelly 83a8d54904 Noisy warning if restart is required 2015-10-02 17:53:47 +01:00
tfennelly 3b5424e507 Only allow disable or uninstall when all dependants or dependencies are disabled/enabled 2015-10-01 16:35:05 +01:00
Daniel Beck 2c0d1a1fdb Fix at-since from PR #1788 2015-08-25 00:08:47 +02:00
Sam Van Oort 80abb98640 Merge PR #1788: Make plugin manager pluggable
Squashed commit of the following:

commit f2c6ad272f
Author: Sam Van Oort <samvanoort@gmail.com>
Date:   Thu Aug 20 18:28:09 2015 -0400

    After much discussion, just remove the helper method to let a plugin manager override easily get instance of the PluginManager

commit a96f933d8d
Author: Sam Van Oort <samvanoort@gmail.com>
Date:   Thu Aug 20 16:59:07 2015 -0400

    Add javadocs and restrict access on the PluginManagerStaplerOverride getManager method

commit 7e1facf887
Author: Sam Van Oort <samvanoort@gmail.com>
Date:   Thu Aug 20 12:50:47 2015 -0400

    Simplify plugin manager test using @TestExtension

commit b9f2841f6d
Author: Sam Van Oort <samvanoort@gmail.com>
Date:   Thu Aug 20 10:32:49 2015 -0400

    Modify the Since version for pluginmanager overrides

commit 3af45ce579
Author: Sam Van Oort <samvanoort@gmail.com>
Date:   Thu Aug 20 10:28:14 2015 -0400

    Add test for PluginManagerStaplerOverride

commit 7864094565
Author: Sam Van Oort <samvanoort@gmail.com>
Date:   Mon Aug 17 20:59:33 2015 -0400

    Changes from review, mostly comments and rename of class

commit 1c23f086ec
Author: Sam Van Oort <samvanoort@gmail.com>
Date:   Mon Aug 17 12:58:07 2015 -0400

    Cleanup for PluginManager extensibility/UI overrides

commit e105a13bcf
Author: Sam Van Oort <samvanoort@gmail.com>
Date:   Fri Aug 14 15:23:07 2015 -0400

    Different approach to plugin manager UX pluggability, using Extension and StaplerOverridable

commit 81f21fba08
Author: Sam Van Oort <samvanoort@gmail.com>
Date:   Thu Aug 13 21:32:45 2015 -0400

    Initial round of changes to allow  overriding PluginManager

    This includes renaming the setTarget method to setUIProxy and defining an interface to retain APIs
    Fields have not been mapped through yet as that is still in progress
    Also, an AbstractStaplerUIProxy has been defined to delegate Stapler bound calls to the pluginManager

commit eeef666de7
Author: Sam Van Oort <samvanoort@gmail.com>
Date:   Wed Aug 5 17:40:50 2015 -0400

    Make plugin manager pluggable
2015-08-24 23:39:51 +02:00
David Hoover 1709ed3a2e Add @Deprecated annotations to things documented as @deprecated. 2015-04-19 14:50:12 -07:00
Jesse Glick f60bde00ab Merge branch 'security' into security-rc
Conflicts:
	core/src/main/java/hudson/PluginManager.java
	core/src/test/java/hudson/PluginManagerTest.java
2015-02-27 13:50:21 -05:00
James Nord b8c9841c30 [SECURITY-167] Plugin manager was also vulnerable.
Although the plugiun manager was vulnerable getting information
out of Jenkins was harder - however it would still be possible to
do bad things such as reading from /dev/zero on Linux
2015-02-27 18:18:23 +00:00
Jesse Glick d00f7ab9b6 Removed DownloadSettings.checkSignature; back to using a plain system property for this.
(cherry picked from commit df9c92e461)
2015-01-09 15:16:44 -05:00
Jesse Glick 33d88c015c [FIXED JENKINS-19081] Offer the option of downloading metadata directly from the server.
(cherry picked from commit 1ac77750e9)

Conflicts:
	core/src/main/java/hudson/model/DownloadService.java
	core/src/main/java/hudson/model/UpdateSite.java
2015-01-09 15:15:02 -05:00
Kohsuke Kawaguchi f7389c5b6d report the version number as well 2014-12-16 15:46:51 -08:00
Jesse Glick c94c1716f3 Merge branch 'SECURITY-144' into SECURITY-144-rc
Conflicts:
	core/src/main/java/hudson/FilePath.java
	core/src/main/java/hudson/PluginManager.java
	core/src/main/java/hudson/PluginWrapper.java
2014-10-17 10:59:32 -04:00
Kohsuke Kawaguchi 19f9b63d74 [FIXED JENKINS-24046]
Warn users if the pinning is preventing Jenkins from overwriting older versions with bundled versions.
2014-10-16 18:18:25 -07:00
Jesse Glick cd33cdd8b7 [FIXED JENKINS-24309] Caching class loads and misses from UberClassLoader. 2014-08-18 15:36:56 -04:00
Jesse Glick 4a98beaf64 Using ExtensionList.lookup consistently. 2014-08-04 15:55:22 -04:00
Oleg Nenashev 19f4cbcce1 Merge pull request #1242 from daniel-beck/JENKINS-20031
[FIXED JENKINS-20031] Useful error message when UC not found
2014-06-01 01:27:58 -07:00
Jesse Glick 7f856b5608 [FIXED JENKINS-12753] Added PluginStrategy.getShortName to avoid actually trying to unpack a plugin before throwing RestartRequiredException. 2014-05-20 12:57:47 -04:00
Daniel Beck a4b63d2dc0 [FIXED JENKINS-20031] Useful error message when UC not found 2014-05-19 22:27:39 +02:00
Oliver Gondža f76eca4ee8 [FIXED JENKINS-22553] Do not expose plugin list that can be a subject of modification 2014-04-10 00:33:50 +02:00
Jesse Glick 56b360d6f3 [JENKINS-19976] Touch-ups to PR #1054. 2014-03-24 10:10:52 -04:00
Jesse Glick df8df45c27 [FIXED JENKINS-19976] Merged #1054: fix class loading from dynamically installed optional dependencies. 2014-03-24 09:52:32 -04:00
Jesse Glick df9c92e461 Removed DownloadSettings.checkSignature; back to using a plain system property for this. 2014-03-17 12:48:24 -04:00
Jesse Glick db8d6508aa Merge branch 'master' into DownloadSettings-JENKINS-19081 2014-03-17 12:33:48 -04:00
Stephen Connolly 483181c0a1 [FIXED JENKINS-22080] Braindead logic in author of original fix... corrected by same author 2014-03-07 15:29:21 +00:00
Stephen Connolly f9b0f348d0 [FIXED JENKINS-22080] NPE if trying to install a plugin from the update center and either the update source or the plugin contains a '.' in its name 2014-03-07 15:26:06 +00:00
Jesse Glick 1ac77750e9 [FIXED JENKINS-19081] Offer the option of downloading metadata directly from the server. 2014-02-27 16:31:07 -05:00
Jesse Glick 898f1f76a3 [FIXED JENKINS-12124] Occasionally errors loading plugin classes since it is expected that findClass (and findLoadedClass) are called under synchronization.
The problem was masked by a blind assumption that an InvocationTargetException was in fact wrapping a ClassNotFoundException.
Many thanks to @gotwarlost for demonstrating how to reproduce the problem and diagnosing the cause.
2014-02-21 15:03:16 -05:00
ikedam 87e2a7e8d5 [FIXED JENKINS-19976] Enable plugins to load classes from optionally depending plugins even without restarting after depended ones installed. 2013-12-10 23:53:38 +09:00
Jesse Glick 15ac490af1 Now that we use Java 6, can finally deprecate IOException2. 2013-11-15 08:19:59 -05:00
Kohsuke Kawaguchi 47de54d070 [FIXED JENKINS-18677]
Integrated bytecode-compatibility-transformer that allows core to
do signature changes on properties that plugins might depend on.

The library performs necessary bytecode transformation to achieve this.

The first use of this is to fix plugins that looks for List
AbstractProject.triggers, thereby resolving JENKINS-18677.

For the time being, I'm not loading such compatibility annotations from
plugins, but I did code that in PluginManager. Let's see how this
feature work out for a while in the core, and if it looks stable and
solid, we'll open it up to plugins at that point.
2013-08-02 22:29:21 -07:00
Jesse Glick b1c82f1e30 stephenc asks to use TODO rather than XXX 2013-06-10 11:53:13 -04:00
Jesse Glick 5ecbbefb6d [FIXED JENKINS-16652] Use UpdateSite.Plugin.deploy from PluginManager.doUploadPlugin. 2013-05-14 20:15:07 -04:00
Kohsuke Kawaguchi f1669601e4 [FIXED JENKINS-4543] Identify the short name of the plugin from the manifest. 2013-04-24 11:23:37 -07:00
Kohsuke Kawaguchi 2c97fe227a exposing this code to outside 2012-12-31 08:47:26 -08:00