[JENKINS-25032] Credentials metadata leak in GraniteCredentialsListBoxModel

GraniteCredentialsListBoxModel.fillItems should probably start with

if (context == null || !context.hasPermission(Item.CONFIGURE)) {
    return new ListBoxModel();
}

lest it expose credentials IDs and descriptions to anonymous users.

This is assuming that there is a context passed in from callers, typically as @AncestorInPath.

Jesse Glick created issue - 2014-10-07 21:22

Jesse Glick made changes - 2014-10-07 21:30

Link

New: This issue is blocking SECURITY-158 [ SECURITY-158 ]

R. Tyler Croy made changes - 2016-07-25 23:51

Workflow

Original: JNJira [ 158932 ]

New: JNJira + In-Review [ 179796 ]

Jenkins