-
Bug
-
Resolution: Fixed
-
Minor
-
Jenkins: 1.590
Java: 1.7.0_67
Hello,
We have a job with project-based security enabled. The job has to be visible to anonymous users and they should only have read-only permissions. After applying the "Read" permission for the job I tried checking out it out as an anonymous user. The job is displayed to the user, but I found out he can redeploy artifacts by clicking on the last successful/failed build number. This functionality is not desired and probably a bug.
Regards,
Steve
- links to
[JENKINS-25691] Redeploy link is displayed to Anonymous users with read only permissions for a job
Steve Todorov
created issue -
| Component/s | New: maven-plugin [ 16033 ] | |
| Component/s | Original: security [ 15508 ] | |
| Component/s | Original: core [ 15593 ] | |
| Component/s | Original: matrix-auth-plugin [ 18131 ] | |
| Assignee | Original: Jesse Glick [ jglick ] | |
| Labels | New: permission |
Just looked at the code and confirmed that it is checking build permission on the job as expected. So maybe your ACL is simply misconfigured.
It might be a misconfiguration, but I can't seem to figure out what's the problem. I've attached the current global security configuration and the job's configuration as well. If I don't set "Overall - Read" permission to the Anonymous user in the Global Security, anonymous users can't see the job even if I set "Job - Read" permission in the project-based security.
Steve Todorov
added a comment - - edited It might be a misconfiguration, but I can't seem to figure out what's the problem. I've attached the current global security configuration and the job's configuration as well. If I don't set "Overall - Read" permission to the Anonymous user in the Global Security, anonymous users can't see the job even if I set "Job - Read" permission in the project-based security. Steve Todorov
made changes -
| Attachment | New: Configure Global Security ACL.png [ 28036 ] | |
| Attachment | New: job acl.png [ 28037 ] |
Is the job in a folder (Cloudbees Folder plugin) and the permission inherited from that?
@Daniel no, the job is only in a view. We don't use the Cloudbees Folder plugin at all.
Steve Todorov
added a comment - - edited @Daniel no, the job is only in a view. We don't use the Cloudbees Folder plugin at all. | Assignee | New: Daniel Beck [ danielbeck ] |
This is only a cosmetic issue, as clicking the link will require users to authenticate (if anonymous) or tell them they're not allowed (otherwise).
Pull request with fix: https://github.com/jenkinsci/maven-plugin/pull/33
MavenAbstractArtifactRecord is in a plugin.