-
Patch
-
Resolution: Fixed
-
Critical
-
None
-
Platform: All, OS: All
I found 8 cases when a field validator in the project configure screen required
admin permission:
1-2) Project to build before/after this one
3-4) Schedule for build times or poll SCM times
5) Subversion remote url check
6-7) FishEye cvs/svn
8) Sventon
My log filled with many long exceptions as soon as I visited a configure page
with a user having all permissions except admin.
I resolved this issue in 3 ways:
a) In items 1-4 the checkURL now includes project=${it.name}. If a valid name
is given for this parameter, the check requires CONFIGURE permission on that
project; otherwise it checks for admin permission.
b) Items 5-7 start with the same check as (a) for some basic checks of the field
syntax.. however, these actually connect to URLs and check the content. This
portion is done only if the user has admin permission, otherwise that part is
just skipped.
c) The Sventon validator had only a retrieve-URL check (no simple validation),
so for that one I simply omitted the checkURL attribute in the jelly file for
non admins.
Patch attached.
- is duplicated by
-
JENKINS-1684 403 errors on project configuration with matrix-based security
- Resolved
-
JENKINS-1855 Form field validation fails even though the user has ADMINISTER permission
- Closed
-
JENKINS-2030 Matrix security configuration - Build scheduler not working for non-administrators
- Closed
-
JENKINS-2434 Misleading "Access Denied" message
- Closed
-
JENKINS-1718 Error 403 when creating new Job
- Closed
-
JENKINS-2168 User with configure build access receives access denied messages on Build Configuration Page
- Closed
-
JENKINS-2629 Getting Access Denied error for non-Administrator user on job creation form
- Closed
-
JENKINS-2703 Hudson security bug
- Closed