Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-33770

Setup wizard login trivial to circumvent

XMLWordPrintable

      The /securityRealm/firstUser is accessible and allows creating an account while the setup wizard is active, but nobody has logged in so far.

      Also, really weird UI brokenness since / is still the setup wizard.

          [JENKINS-33770] Setup wizard login trivial to circumvent

          Daniel Beck created issue -

          Keith Zantow added a comment - - edited

          You're still required to enter a security token, yes?

          After entering the security token, you're logged in as an admin user. Navigating away is something we're not restricting, really (recall, it was... until the approach was changed significantly after the initial implementation).

          Keith Zantow added a comment - - edited You're still required to enter a security token, yes? After entering the security token, you're logged in as an admin user. Navigating away is something we're not restricting, really (recall, it was... until the approach was changed significantly after the initial implementation).

          Daniel Beck added a comment -

          You're still required to enter a security token, yes?

          No.

          In fact, I discovered this because some weird forward brought me right from "Jenkins is loading" to that page. Unfortunately I haven't been able to reproduce it since.

          Daniel Beck added a comment - You're still required to enter a security token, yes? No. In fact, I discovered this because some weird forward brought me right from "Jenkins is loading" to that page. Unfortunately I haven't been able to reproduce it since.
          Keith Zantow made changes -
          Status Original: Open [ 1 ] New: In Progress [ 3 ]
          Keith Zantow made changes -
          Assignee New: Keith Zantow [ kzantow ]
          Daniel Beck made changes -
          Epic Link New: JENKINS-33810 [ 169285 ]
          Keith Zantow made changes -
          Remote Link New: This issue links to "PR 2170 (Web Link)" [ 14119 ]
          Daniel Beck made changes -
          Labels Original: 2.0 2.0-beta New: 2.0 2.0-beta 2.0-planned

          gus reiber added a comment -

          I am reproducing this bug testing 33828. Possibly you have a fix on a different branch, but if not, I can repro easily on the 33828 branch.

          gus reiber added a comment - I am reproducing this bug testing 33828. Possibly you have a fix on a different branch, but if not, I can repro easily on the 33828 branch.

          Keith Zantow added a comment -

          gusreiber I have different branches for each of these tickets, the fix for this is on branch: JENKINS-33770-security-token-not-always-required

          Keith Zantow added a comment - gusreiber I have different branches for each of these tickets, the fix for this is on branch: JENKINS-33770 -security-token-not-always-required

            kzantow Keith Zantow
            danielbeck Daniel Beck
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: