Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-23020

Manage->Cancel Shutdown requests POST method and even POST fails due to invalid crumb if CSRF protection is enabled

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Critical Critical
    • core
    • Windows Server 2008R2, 64bit, JDK 7u55

      When trying to cancel shutdown mode via

      Manage->Cancel Shutdown
      or
      Cancel link of Build Queue

      Jenkins shows

      POST is required for jenkins.model.Jenkins.doCancelQuietDown

      together with a Try POSTing button.

      If the Try POSTing button is pressed cancel is working with CSRF protection disabled.

      But with CSRF protection enabled (in Manage->Configure Global Security) after the Try POSTing button Jenkins shows

      Invalid Crumb

      error which effectively means there is currently no way to cancel from shutdown mode if CSRF protection is enabled.

          [JENKINS-23020] Manage->Cancel Shutdown requests POST method and even POST fails due to invalid crumb if CSRF protection is enabled

          Daniel Beck added a comment -

          Daniel Beck added a comment - PR that introduced the POST restriction .

          Jesse Glick added a comment -

          no way to cancel from shutdown mode if CSRF protection is enabled

          You can use the CLI command.

          Jesse Glick added a comment - no way to cancel from shutdown mode if CSRF protection is enabled You can use the CLI command.

          Code changed in jenkins
          User: Daniel Beck
          Path:
          core/src/main/java/hudson/model/ManagementLink.java
          core/src/main/java/jenkins/management/ShutdownLink.java
          core/src/main/resources/jenkins/model/Jenkins/manage.jelly
          core/src/main/resources/lib/form/link.jelly
          core/src/main/resources/lib/form/link/link.js
          core/src/main/resources/lib/hudson/queue.jelly
          http://jenkins-ci.org/commit/jenkins/fda84f456f4be4f48048970a6055399f17761ab0
          Log:
          Merge pull request #1306 from bkmeneguello/post-cancel-shutdown

          [FIXED JENKINS-23020 JENKINS-23942] Convert the queue's cancel shutdown to POST

          Compare: https://github.com/jenkinsci/jenkins/compare/2b6c00db3406...fda84f456f4b

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Daniel Beck Path: core/src/main/java/hudson/model/ManagementLink.java core/src/main/java/jenkins/management/ShutdownLink.java core/src/main/resources/jenkins/model/Jenkins/manage.jelly core/src/main/resources/lib/form/link.jelly core/src/main/resources/lib/form/link/link.js core/src/main/resources/lib/hudson/queue.jelly http://jenkins-ci.org/commit/jenkins/fda84f456f4be4f48048970a6055399f17761ab0 Log: Merge pull request #1306 from bkmeneguello/post-cancel-shutdown [FIXED JENKINS-23020 JENKINS-23942] Convert the queue's cancel shutdown to POST Compare: https://github.com/jenkinsci/jenkins/compare/2b6c00db3406...fda84f456f4b

          Daniel Beck added a comment -

          Fixed in 1.584.

          Daniel Beck added a comment - Fixed in 1.584.

          Code changed in jenkins
          User: Daniel Beck
          Path:
          core/src/main/java/hudson/model/ManagementLink.java
          core/src/main/java/jenkins/management/ShutdownLink.java
          core/src/main/resources/jenkins/model/Jenkins/manage.jelly
          core/src/main/resources/lib/form/link.jelly
          core/src/main/resources/lib/form/link/link.js
          core/src/main/resources/lib/hudson/queue.jelly
          http://jenkins-ci.org/commit/jenkins/b73bb3d0af419dd653b743b4c0b8458c965396e1
          Log:
          Merge pull request #1306 from bkmeneguello/post-cancel-shutdown

          [FIXED JENKINS-23020 JENKINS-23942] Convert the queue's cancel shutdown to POST
          (cherry picked from commit fda84f456f4be4f48048970a6055399f17761ab0)

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Daniel Beck Path: core/src/main/java/hudson/model/ManagementLink.java core/src/main/java/jenkins/management/ShutdownLink.java core/src/main/resources/jenkins/model/Jenkins/manage.jelly core/src/main/resources/lib/form/link.jelly core/src/main/resources/lib/form/link/link.js core/src/main/resources/lib/hudson/queue.jelly http://jenkins-ci.org/commit/jenkins/b73bb3d0af419dd653b743b4c0b8458c965396e1 Log: Merge pull request #1306 from bkmeneguello/post-cancel-shutdown [FIXED JENKINS-23020 JENKINS-23942] Convert the queue's cancel shutdown to POST (cherry picked from commit fda84f456f4be4f48048970a6055399f17761ab0)

            Unassigned Unassigned
            klou Kurt
            Votes:
            4 Vote for this issue
            Watchers:
            9 Start watching this issue

              Created:
              Updated:
              Resolved: