Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-18633

/me/my-views/editDescription may be used by any user to set global description

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Minor Minor
    • core
    • Windows7 using the integrated webserver using ActiveDirectory authentication and matrix based security.

      I have a user that has only the single right "Job: read", but is still allowed to change the description of the server (main heading) for everyone.

      Could be reproduced:

      This could also be tested by directly opening the URL:
      https://SERVERNAME/me/my-views/editDescription

          [JENKINS-18633] /me/my-views/editDescription may be used by any user to set global description

          edit: fixed markup

          Dominik Schwald added a comment - edit: fixed markup

          Jesse Glick added a comment -

          By the way, in the future please file security-related issues in https://issues.jenkins-ci.org/browse/SECURITY.

          Jesse Glick added a comment - By the way, in the future please file security-related issues in https://issues.jenkins-ci.org/browse/SECURITY .

          Jesse Glick added a comment -

          Reproducible in 1.509.3 using Mock Security Realm and global matrix authorization. Create a user with Overall/Read and Job/Read, log in, and My Views » Edit Description can be used to set global description.

          Attempted fix in https://github.com/jenkinsci/jenkins/pull/906 was closed; need a different fix.

          Jesse Glick added a comment - Reproducible in 1.509.3 using Mock Security Realm and global matrix authorization. Create a user with Overall/Read and Job/Read, log in, and My Views » Edit Description can be used to set global description. Attempted fix in https://github.com/jenkinsci/jenkins/pull/906 was closed; need a different fix.

          Jesse Glick added a comment -

          There is a well-meaning but problematic attempt to make the Jenkins root delegate its description to its primary view, and an inappropriate assumption in AllView of what it is being used for. I am working on simplifying things so that each view has its own description, which the edit link will edit, and independently of that Jenkins has a description (“system message”) which will be shown above any view description. Also working on changes to make all this friendlier to folders.

          Jesse Glick added a comment - There is a well-meaning but problematic attempt to make the Jenkins root delegate its description to its primary view, and an inappropriate assumption in AllView of what it is being used for. I am working on simplifying things so that each view has its own description, which the edit link will edit, and independently of that Jenkins has a description (“system message”) which will be shown above any view description. Also working on changes to make all this friendlier to folders.

          Code changed in jenkins
          User: Jesse Glick
          Path:
          changelog.html
          core/src/main/java/hudson/model/AllView.java
          core/src/main/resources/hudson/model/AbstractModelObject/descriptionForm.jelly
          core/src/main/resources/hudson/model/View/index.jelly
          http://jenkins-ci.org/commit/jenkins/04c8a1efc0f6324868638be9a4cfdb085e17744f
          Log:
          [FIXED JENKINS-18633] Simplified distinction between Jenkins.description and View.description.
          Both are shown if defined. The edit description link only applies to View.description.
          Properly handle a ViewGroup other than Jenkins itself, such as a folder.

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: changelog.html core/src/main/java/hudson/model/AllView.java core/src/main/resources/hudson/model/AbstractModelObject/descriptionForm.jelly core/src/main/resources/hudson/model/View/index.jelly http://jenkins-ci.org/commit/jenkins/04c8a1efc0f6324868638be9a4cfdb085e17744f Log: [FIXED JENKINS-18633] Simplified distinction between Jenkins.description and View.description. Both are shown if defined. The edit description link only applies to View.description. Properly handle a ViewGroup other than Jenkins itself, such as a folder.

          dogfood added a comment -

          Integrated in jenkins_main_trunk #2930
          [FIXED JENKINS-18633] Simplified distinction between Jenkins.description and View.description. (Revision 04c8a1efc0f6324868638be9a4cfdb085e17744f)

          Result = SUCCESS
          Jesse Glick : 04c8a1efc0f6324868638be9a4cfdb085e17744f
          Files :

          • core/src/main/java/hudson/model/AllView.java
          • changelog.html
          • core/src/main/resources/hudson/model/View/index.jelly
          • core/src/main/resources/hudson/model/AbstractModelObject/descriptionForm.jelly

          dogfood added a comment - Integrated in jenkins_main_trunk #2930 [FIXED JENKINS-18633] Simplified distinction between Jenkins.description and View.description. (Revision 04c8a1efc0f6324868638be9a4cfdb085e17744f) Result = SUCCESS Jesse Glick : 04c8a1efc0f6324868638be9a4cfdb085e17744f Files : core/src/main/java/hudson/model/AllView.java changelog.html core/src/main/resources/hudson/model/View/index.jelly core/src/main/resources/hudson/model/AbstractModelObject/descriptionForm.jelly

          Code changed in jenkins
          User: Jesse Glick
          Path:
          core/src/main/java/hudson/model/AllView.java
          core/src/main/resources/hudson/model/AbstractModelObject/descriptionForm.jelly
          core/src/main/resources/hudson/model/View/index.jelly
          http://jenkins-ci.org/commit/jenkins/624395829bfda6a87b3c0210e0a691af90037358
          Log:
          [FIXED JENKINS-18633] Simplified distinction between Jenkins.description and View.description.
          Both are shown if defined. The edit description link only applies to View.description.
          Properly handle a ViewGroup other than Jenkins itself, such as a folder.
          (cherry picked from commit 04c8a1efc0f6324868638be9a4cfdb085e17744f)

          Conflicts:
          changelog.html

          Compare: https://github.com/jenkinsci/jenkins/compare/65158b098327...624395829bfd

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: core/src/main/java/hudson/model/AllView.java core/src/main/resources/hudson/model/AbstractModelObject/descriptionForm.jelly core/src/main/resources/hudson/model/View/index.jelly http://jenkins-ci.org/commit/jenkins/624395829bfda6a87b3c0210e0a691af90037358 Log: [FIXED JENKINS-18633] Simplified distinction between Jenkins.description and View.description. Both are shown if defined. The edit description link only applies to View.description. Properly handle a ViewGroup other than Jenkins itself, such as a folder. (cherry picked from commit 04c8a1efc0f6324868638be9a4cfdb085e17744f) Conflicts: changelog.html Compare: https://github.com/jenkinsci/jenkins/compare/65158b098327...624395829bfd

            jglick Jesse Glick
            dominik_ Dominik Schwald
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: