-
Bug
-
Resolution: Fixed
-
Major
Formally filing some issues which were previously noted parenthetically in JENKINS-22472:
SetBuildResultCommand checks Item.BUILD; I would have expected Run.UPDATE. And SetBuildParameterCommand does no check at all.
getCurrentlyBuilding does not even check Run.isBuilding, so this could even be used to mangle a completed build's state, such as parameters via SetBuildParameterCommand. (SetBuildResultCommand would not work on a finished build because of checks inside Run.setResult.)
- is related to
-
JENKINS-22472 CommandDuringBuild not automatically authenticated
-
- Resolved
-
Code changed in jenkins
User: Jesse Glick
Path:
changelog.html
core/src/main/java/hudson/cli/CommandDuringBuild.java
core/src/main/java/hudson/cli/SetBuildParameterCommand.java
core/src/main/java/hudson/cli/SetBuildResultCommand.java
test/src/test/groovy/hudson/cli/SetBuildParameterCommandTest.groovy
http://jenkins-ci.org/commit/jenkins/137c90cc612ddb3a51d050be298dcd2e0ae86a4c
Log:
[FIXED JENKINS-24080] Improved security of CommandDuringBuild and its current implementations.
Compare: https://github.com/jenkinsci/jenkins/compare/4f27f4cc2633...137c90cc612d