Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[JENKINS-62183] Allow user with Jenkins.MANAGE to access global config #896

Merged
merged 4 commits into from
May 26, 2020
Merged

[JENKINS-62183] Allow user with Jenkins.MANAGE to access global config #896

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9485774
Allow user with Jenkins.MANAGE permission to access global config
mikecirioli May 18, 2020
7684bc0
Use spotbugs annotations
MarkEWaite May 18, 2020
8ee221d
use isEmpty()
mikecirioli May 19, 2020
072e6e7
revert back to using older jenkins baseline and modify permission checks
mikecirioli May 19, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
<changelist>-SNAPSHOT</changelist>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<argLine>-Dfile.encoding=${project.build.sourceEncoding}</argLine>
<jenkins.version>2.204.1</jenkins.version>
<jenkins.version>2.222.1</jenkins.version>
mikecirioli marked this conversation as resolved.
Show resolved Hide resolved
<java.level>8</java.level>
<no-test-jar>false</no-test-jar>
<useBeta>true</useBeta>
Expand Down
8 changes: 8 additions & 0 deletions src/main/java/hudson/plugins/git/GitSCM.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@
import hudson.scm.SCMDescriptor;
import hudson.scm.SCMRevisionState;
import hudson.security.ACL;
import hudson.security.Permission;
import hudson.tasks.Builder;
import hudson.tasks.Publisher;
import hudson.triggers.SCMTrigger;
Expand Down Expand Up @@ -79,6 +80,7 @@
import org.kohsuke.stapler.StaplerRequest;
import org.kohsuke.stapler.export.Exported;

import javax.annotation.Nonnull;
MarkEWaite marked this conversation as resolved.
Show resolved Hide resolved
import javax.servlet.ServletException;

import java.io.File;
Expand Down Expand Up @@ -1480,6 +1482,12 @@ public DescriptorImpl() {
load();
}

@Nonnull
MarkEWaite marked this conversation as resolved.
Show resolved Hide resolved
@Override
public Permission getRequiredGlobalConfigPagePermission() {
return Jenkins.MANAGE;
}

public boolean isShowEntireCommitSummaryInChanges() {
return showEntireCommitSummaryInChanges;
}
Expand Down
30 changes: 30 additions & 0 deletions src/test/java/hudson/plugins/git/GitSCMTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@

import hudson.EnvVars;
import hudson.FilePath;
import hudson.Functions;
import hudson.Launcher;
import hudson.matrix.Axis;
import hudson.matrix.AxisList;
Expand All @@ -41,6 +42,8 @@
import hudson.scm.PollingResult;
import hudson.scm.PollingResult.Change;
import hudson.scm.SCMRevisionState;
import hudson.security.ACL;
import hudson.security.ACLContext;
import hudson.slaves.DumbSlave;
import hudson.slaves.EnvironmentVariablesNodeProperty.Entry;
import hudson.tools.ToolLocationNodeProperty;
Expand All @@ -63,6 +66,7 @@
import org.junit.Ignore;
import org.junit.Rule;
import org.junit.Test;
import org.jvnet.hudson.test.MockAuthorizationStrategy;
import org.jvnet.hudson.test.TestExtension;

import java.io.File;
Expand Down Expand Up @@ -148,6 +152,32 @@ private StandardCredentials getInvalidCredential() {
return new UsernamePasswordCredentialsImpl(scope, id, "desc: " + id, username, password);
}

@Test
public void manageShouldAccessGlobalConfig() {
final String USER = "user";
final String MANAGER = "manager";
rule.jenkins.setSecurityRealm(rule.createDummySecurityRealm());
rule.jenkins.setAuthorizationStrategy(new MockAuthorizationStrategy()
// Read access
.grant(Jenkins.READ).everywhere().to(USER)

// Read and Manage
.grant(Jenkins.READ).everywhere().to(MANAGER)
.grant(Jenkins.MANAGE).everywhere().to(MANAGER)
);

try (ACLContext c = ACL.as(User.getById(USER, true))) {
Collection<Descriptor> descriptors = Functions.getSortedDescriptorsForGlobalConfigUnclassified();
assertTrue("Global configuration should not be accessible to READ users", descriptors.size() == 0);
mikecirioli marked this conversation as resolved.
Show resolved Hide resolved
}
try (ACLContext c = ACL.as(User.getById(MANAGER, true))) {
Collection<Descriptor> descriptors = Functions.getSortedDescriptorsForGlobalConfigUnclassified();
Optional<Descriptor> found =
descriptors.stream().filter(descriptor -> descriptor instanceof GitSCM.DescriptorImpl).findFirst();
assertTrue("Global configuration should be accessible to MANAGE users", found.isPresent());
MarkEWaite marked this conversation as resolved.
Show resolved Hide resolved
}
}

@Test
public void trackCredentials() throws Exception {
StandardCredentials credential = getInvalidCredential();
Expand Down