Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-23020

Manage->Cancel Shutdown requests POST method and even POST fails due to invalid crumb if CSRF protection is enabled

    XMLWordPrintable

    Details

    • Similar Issues:
    • URL:

      Description

      When trying to cancel shutdown mode via

      Manage->Cancel Shutdown
      or
      Cancel link of Build Queue

      Jenkins shows

      POST is required for jenkins.model.Jenkins.doCancelQuietDown

      together with a Try POSTing button.

      If the Try POSTing button is pressed cancel is working with CSRF protection disabled.

      But with CSRF protection enabled (in Manage->Configure Global Security) after the Try POSTing button Jenkins shows

      Invalid Crumb

      error which effectively means there is currently no way to cancel from shutdown mode if CSRF protection is enabled.

        Attachments

          Activity

          Descending order - Click to sort in ascending order
          Hide
          Permalink
          scm_issue_link SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Daniel Beck
          Path:
          core/src/main/java/hudson/model/ManagementLink.java
          core/src/main/java/jenkins/management/ShutdownLink.java
          core/src/main/resources/jenkins/model/Jenkins/manage.jelly
          core/src/main/resources/lib/form/link.jelly
          core/src/main/resources/lib/form/link/link.js
          core/src/main/resources/lib/hudson/queue.jelly
          http://jenkins-ci.org/commit/jenkins/b73bb3d0af419dd653b743b4c0b8458c965396e1
          Log:
          Merge pull request #1306 from bkmeneguello/post-cancel-shutdown

          [FIXED JENKINS-23020 JENKINS-23942] Convert the queue's cancel shutdown to POST
          (cherry picked from commit fda84f456f4be4f48048970a6055399f17761ab0)

          Show
          scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Daniel Beck Path: core/src/main/java/hudson/model/ManagementLink.java core/src/main/java/jenkins/management/ShutdownLink.java core/src/main/resources/jenkins/model/Jenkins/manage.jelly core/src/main/resources/lib/form/link.jelly core/src/main/resources/lib/form/link/link.js core/src/main/resources/lib/hudson/queue.jelly http://jenkins-ci.org/commit/jenkins/b73bb3d0af419dd653b743b4c0b8458c965396e1 Log: Merge pull request #1306 from bkmeneguello/post-cancel-shutdown [FIXED JENKINS-23020 JENKINS-23942] Convert the queue's cancel shutdown to POST (cherry picked from commit fda84f456f4be4f48048970a6055399f17761ab0)
          Hide
          Permalink
          danielbeck Daniel Beck added a comment -

          Fixed in 1.584.

          Show
          danielbeck Daniel Beck added a comment - Fixed in 1.584.
          Hide
          Permalink
          scm_issue_link SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Daniel Beck
          Path:
          core/src/main/java/hudson/model/ManagementLink.java
          core/src/main/java/jenkins/management/ShutdownLink.java
          core/src/main/resources/jenkins/model/Jenkins/manage.jelly
          core/src/main/resources/lib/form/link.jelly
          core/src/main/resources/lib/form/link/link.js
          core/src/main/resources/lib/hudson/queue.jelly
          http://jenkins-ci.org/commit/jenkins/fda84f456f4be4f48048970a6055399f17761ab0
          Log:
          Merge pull request #1306 from bkmeneguello/post-cancel-shutdown

          [FIXED JENKINS-23020 JENKINS-23942] Convert the queue's cancel shutdown to POST

          Compare: https://github.com/jenkinsci/jenkins/compare/2b6c00db3406...fda84f456f4b

          Show
          scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Daniel Beck Path: core/src/main/java/hudson/model/ManagementLink.java core/src/main/java/jenkins/management/ShutdownLink.java core/src/main/resources/jenkins/model/Jenkins/manage.jelly core/src/main/resources/lib/form/link.jelly core/src/main/resources/lib/form/link/link.js core/src/main/resources/lib/hudson/queue.jelly http://jenkins-ci.org/commit/jenkins/fda84f456f4be4f48048970a6055399f17761ab0 Log: Merge pull request #1306 from bkmeneguello/post-cancel-shutdown [FIXED JENKINS-23020 JENKINS-23942] Convert the queue's cancel shutdown to POST Compare: https://github.com/jenkinsci/jenkins/compare/2b6c00db3406...fda84f456f4b
          Hide
          Permalink
          jglick Jesse Glick added a comment -

          no way to cancel from shutdown mode if CSRF protection is enabled

          You can use the CLI command.

          Show
          jglick Jesse Glick added a comment - no way to cancel from shutdown mode if CSRF protection is enabled You can use the CLI command.
          Hide
          Permalink
          danielbeck Daniel Beck added a comment -

          PR that introduced the POST restriction.

          Show
          danielbeck Daniel Beck added a comment - PR that introduced the POST restriction .

            People

            Assignee:
            Unassigned Unassigned
            Reporter:
            klou Kurt
            Votes:
            4 Vote for this issue
            Watchers:
            9 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: