Commit Graph
216 Commits
Author SHA1 Message Date
Jesse Glick 44c4c1cc0c Merge branch 'security-stable-2.7' into security-stable-2.19 2017-04-13 13:58:44 -04:00
Jesse Glick 06eb14efe6 Merge branch 'security-stable-1.651' into security-stable-2.7 2017-04-13 13:50:58 -04:00
Jesse Glick 189f101dcb Merge branch 'security-stable-1.642' into security-stable-1.651 2017-04-13 13:40:56 -04:00
Jesse Glick a18f7432fe Merge branch 'security-stable-1.625' into security-stable-1.642 2017-04-13 13:37:06 -04:00
Daniel Beck 3e1f02b5c3 [SECURITY-413][SECURITY-414] RequirePOST in plugin manager 2017-04-13 13:32:35 -04:00
Oleg Nenashev 37edc1a3b0 [FIXED JENKINS-37332] - Prevent File descriptor leaks when reading manifests from JARs (#2516)
* [JENKINS-37332] - Improve diagnostics of non-closed streams during reading of the manifests in PluginManager

* [JENKINS-37332] - Leakless processing of JarUrlConnection during Manifest parsing

* [JENKINS-37332] - Also implement leak-safe method for retrieving file modification date

* [JENKINS-37332] - Add spotcheck methods for manifest file access + Javadoc

* [JENKINS-37332] - Also test multi-line and empty attributes in the test

(cherry picked from commit 96c97860b0)
2016-09-06 08:31:48 +02:00
Oleg Nenashev 96c97860b0 [FIXED JENKINS-37332] - Prevent File descriptor leaks when reading manifests from JARs (#2516)
* [JENKINS-37332] - Improve diagnostics of non-closed streams during reading of the manifests in PluginManager

* [JENKINS-37332] - Leakless processing of JarUrlConnection during Manifest parsing

* [JENKINS-37332] - Also implement leak-safe method for retrieving file modification date

* [JENKINS-37332] - Add spotcheck methods for manifest file access + Javadoc

* [JENKINS-37332] - Also test multi-line and empty attributes in the test
2016-08-21 00:00:41 +02:00
Stephen Connolly 28ee03724d [JENKINS-37041] Address Code review comments
(cherry picked from commit d92fd4cc63)
2016-08-17 20:00:05 +02:00
Stephen Connolly 6ea7883fed [FIXED JENKINS-37041] Ensure that detached plugins are always at least their minimum version
(cherry picked from commit 2a450e5ac2)
2016-08-17 20:00:05 +02:00
Oleg Nenashev 92a7385f1e Merge commit 'd8cae8221e5b5ef3b5276fb53879547169a02504' into findbugs/JENKINS-36717-cleanup 2016-08-01 18:30:04 +03:00
Vincent Latombe 8e3c9dadc1 [JENKINS-21486] Mention both long name, short name and version in console 2016-07-29 14:33:56 +02:00
Vincent Latombe d8f3bfc8ed [JENKINS-21486] Cycle monitor should display plugin long name and
version
2016-07-29 14:33:56 +02:00
Vincent Latombe 43ddbdfc1c [JENKINS-21486] Fix plugin dependencies resolution
* Check that dependencies are enabled. A disabled optional dependency
  will not prevent a plugin from loading.
* Check versions of dependencies declared by a plugin before loading it.
  If any dependency (even optional) is older than what is required,
  then the plugin isn't loaded.

This should prevent use cases where a plugin is loaded but one of its
dependencies is too old so that :
* its @Extension annotated classes cannot be loaded, causing the full
  Jenkins to blow up with crapload of exceptions which are tedious to
  investigate to understand the root cause.
* NoSuchMethodError and the likes at runtime even though boot has
  completed.

Version check (for setups where version list is manually crafted but yet
works) can be disabled by starting Jenkins with

-Dhudson.PluginWrapper.dependenciesVersionCheck.enabled=true

Minor fixes done while implementing this change :
* Fix version parsing in PluginWrapper.Dependency
* Dynamic plugin load didn't check for disabled flag
2016-07-29 14:31:41 +02:00
Stephen Connolly 86e14ddffc Noting merge of JENKINS-37032, also fixing @since FIXME tags 2016-07-29 13:18:20 +01:00
Stephen Connolly d92fd4cc63 [JENKINS-37041] Address Code review comments 2016-07-28 16:30:17 +01:00
Stephen Connolly 2a450e5ac2 [FIXED JENKINS-37041] Ensure that detached plugins are always at least their minimum version 2016-07-28 16:09:21 +01:00
Jesse Glick 4ed803cea2 [JENKINS-36666] Defend against some fatal startup errors (#2453)
* [JENKINS-36666] Properly report the reason for a failed call to Task.getDisplayName.

* [JENKINS-36666] Even without passing fatal=false to @Initializer, recover gracefully from a LinkageError in a task.

* Comment.
2016-07-20 14:55:42 +03:00
Oleg Nenashev 52f8ba0e5b FindBugs: Suppress DMI_COLLECTION_OF_URLS in PluginManager since it's safe 2016-07-16 02:15:58 +03:00
Stephen Connolly 0203504a2c [FIXED JENKINS-36494] Switch to a try with resources form of impersonation 2016-07-07 11:46:45 +01:00
Keith Zantow 1fef3f4b73 [FIXED JENKINS-34881] - Handle pre-configured security settings for new installs (#2364)
* [FIXED JENKINS-34881] - handle non-default security settings for new installs

* Ensure permissions

* Initial security authentication token should still follow redirects

(cherry picked from commit 723dfca37b)
2016-06-19 22:03:42 +02:00
Keith Zantow 723dfca37b [FIXED JENKINS-34881] - Handle pre-configured security settings for new installs (#2364)
* [FIXED JENKINS-34881] - handle non-default security settings for new installs

* Ensure permissions

* Initial security authentication token should still follow redirects
2016-06-02 19:53:43 +02:00
Oleg Nenashev c6131436f4 [JENKINS-34745] - Prevent CheckUpdates PeriodicWork death if update site cert is missing (#2333)
* [JENKINS-34745] - Prevent CheckUpdates PeriodicWork death in the case of the missing update site signature

* [JENKINS-34745] - Fix typo in the validator

* [JENKINS-34745] - Fix the formatting of the validation message (cc @lanwen)

(cherry picked from commit 1e6afbae3b)
2016-05-25 10:01:25 +02:00
kzantow 89a24abcb0 [FIX JENKINS-33663] - Upgrade wizard
Add Upgrade Wizard
Add 'replace' handlebars method in jenkins.js
Fix state transitions to follow a single basic pattern
Suggested plugins selected by default
Add an install state for INITIAL_SECURITY_SETUP
Removed duplicate setupWizard.js on page [FIX JENKINS-34676]
Exclude plugins which are already installed when determining platform
Change 'snooze' to not look like a 'close' button
Make sure unlock screen doesn't show up after new install
Add compatibility check when offering suggested plugins
More appropriate handling of security token filter
2016-05-20 09:35:16 -04:00
Andres Rodriguez 454642dafe [JENKINS-34681] Allow custom plugin managers when using war (#2323)
* [JENKINS-34681] Allow custom default plugin managers

* [JENKINS-34681] Convert remaining properties to SystemProperties.
2016-05-14 21:32:55 +02:00
Oleg Nenashev 1e6afbae3b [JENKINS-34745] - Prevent CheckUpdates PeriodicWork death if update site cert is missing (#2333)
* [JENKINS-34745] - Prevent CheckUpdates PeriodicWork death in the case of the missing update site signature

* [JENKINS-34745] - Fix typo in the validator

* [JENKINS-34745] - Fix the formatting of the validation message (cc @lanwen)
2016-05-14 14:05:35 +02:00
Oleg Nenashev fdabb52503 Merge branch 'master' into JENKINS-34755
Conflicts:
	core/src/main/java/hudson/FilePath.java
2016-05-13 23:00:17 +02:00
Oleg Nenashev ebb84da617 [JENKINS-34748] - Fix handling of dependency trees in PluginManager::addDependencies() (#2334) 2016-05-13 10:39:01 +02:00
Oleg Nenashev ce8922bd74 Merge branch 'master' into JENKINS-34755
Conflicts:
	core/src/main/java/hudson/Util.java
	core/src/main/java/hudson/WebAppMain.java
	core/src/main/java/hudson/model/Item.java
	core/src/main/java/hudson/model/Queue.java
	core/src/main/java/hudson/model/UpdateCenter.java
	core/src/main/java/hudson/security/csrf/DefaultCrumbIssuer.java
	core/src/main/java/hudson/slaves/NodeProvisioner.java
	core/src/main/java/jenkins/model/Jenkins.java
	core/src/main/java/jenkins/slaves/NioChannelSelector.java
	core/src/main/java/jenkins/util/xml/XMLUtils.java
2016-05-12 12:05:24 +02:00
Kohsuke Kawaguchi 75e93bed8a Merge branch 'master' of github.com:jenkinsci/jenkins
Conflicts:
	changelog.html
2016-05-11 11:46:30 -07:00
Jesse Glick c2d0a5778e Merge commit '97a0fa0d036b9d3873c9b269123020a42e7ee3e9' into security-master 2016-05-11 12:07:25 -04:00
Carlos Sanchez 3e1bc969f4 [JENKINS-34683] Do not print stack trace if plugin is missing dependencies (#2048)
[JENKINS-34683] - Do not print stack trace if plugin is missing dependencies
2016-05-09 16:34:26 +02:00
Kohsuke Kawaguchi 92c81e6aee Merge remote-tracking branch 'origin/master' into symbol 2016-05-02 08:50:27 -07:00
Kohsuke Kawaguchi f238ade13e Merge pull request #2177 from jenkinsci/2nd-reactor
Don't go through init sequence twice
2016-05-02 08:49:32 -07:00
kzantow 0c95d25c28 Fix dynamic load for disabled plugins which are enabled as part of
required dependencies; this may still have some issues in unknown cases
such as a plugin disabled, then re-enabled without restarting Jenkins
but it fixes one of the primary cases
2016-04-29 11:58:04 -04:00
Kohsuke Kawaguchi 6af569c4f0 Merge remote-tracking branch 'origin/master' into symbol
Conflicts:
	core/src/main/java/hudson/model/FreeStyleProject.java
	core/src/main/java/jenkins/model/GlobalConfigurationCategory.java
2016-04-26 16:07:09 -07:00
Jesse Glick 39f33b9bfd Merge branch 'security-stable-1.651' into security-master 2016-04-26 15:58:55 -04:00
Jesse Glick d39ccfac86 Merge branch 'security-stable-1.642' into security-stable-1.651 2016-04-26 15:58:33 -04:00
Jesse Glick 93229dfc24 Merge branch 'security-stable-1.625' into security-stable-1.642 2016-04-26 15:57:52 -04:00
Jesse Glick 97a62a9bcc Merge branch 'security-stable-1.609' into security-stable-1.625 2016-04-26 15:57:32 -04:00
Jesse Glick 53dd9046c9 Merge pull request #68 from jenkinsci-cert/SECURITY-273
[FIX SECURITY-273] Require admin permission to check update sites
2016-04-26 15:57:12 -04:00
Daniel Beck 56be107feb [FIX SECURITY-273] Require admin permission to check update sites 2016-04-25 21:06:54 +02:00
kzantow e612f4163a Merge remote-tracking branch 'primary/master' into
JENKINS-34174-plugin-download-timeout

# Conflicts:
#	core/src/main/resources/jenkins/install/pluginSetupWizard.properties
2016-04-22 10:37:18 -04:00
Daniel Beck 20d3d8a529 Merge pull request #2260 from kzantow/JENKINS-33936-links-to-wiki
[JENKINS-33936] [JENKINS-33937] add links to wiki for plugins during setup
2016-04-22 16:03:26 +02:00
kzantow 6974d2b759 JENKINS-33244 / JENKINS-34174 - retry for failed plugins & specify
download timeout
2016-04-21 17:27:36 -04:00
Kohsuke Kawaguchi 8cb24b6c13 Merge branch '2.0'
2.1 will come from the master branch going forward
2016-04-20 20:55:12 -07:00
Daniel Beck 6f8540c347 [FIX JENKINS-34094] Add access control
Also adds some API restrictions for JENKINS-33803.
2016-04-17 16:48:33 +02:00
kzantow 9622bbedbb JENKINS-33936 JENKINS-33937 - add links to wiki for plugins during setup
wizard
2016-04-13 10:55:40 -04:00
Alex Earl fcdebe56c0 Add dependency resolution to manually uploaded plugins. 2016-04-07 10:19:16 -07:00
Daniel Beck 70ee2012e9 Revert "[FIXED JENKINS-21486] Merged #2172: enforce plugin dependencies."
This reverts commit fa39668b81, reversing
changes made to be9bc0dba5.
2016-04-07 00:07:38 +02:00
Daniel Beck 37c00cf2af Merge pull request #2185 from kzantow/JENKINS-33800-initial-password-file-not-found
[JENKINS-33800] - fileNotFound exception / more accurately determine if this is an upgrade
2016-04-05 21:04:35 +02:00