Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-43722

After cleaning approved script list, the previously approved scripts do not reappear

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • * Jenkins 1.651.3
      * Envinject Plugin 2.0
      * Script Security Plugin 1.27

      Use case:
       

      1. We have a job containing a script that needs to be approved using the In-process Script Approval screen.
      2. We approve the script and we are able to execute the job without further problems.
      3. If we clear the approvals using the Script approval screen and we try to run the job that used it, it will fail (as expected)
      4. But we are not able to see the previously approved script among the pending scripts.
        1. If the job is in the Jenkins root, you can make the script appear again among the pending for approval script list if you go to manage Jenkins and click reload configuration from disk.
        2. If the job is inside a folder, the script will not appear as pending unless you restart Jenkins.

       
      It does not seem an expected behavior.
       
      For the test, we have been using:

      • Jenkins 1.651.3
      • Envinject Plugin 2.0 
      • Script Security Plugin 1.27
      • Used a freestyle job, that includes a boolean parameter defined by a groovy script:

               if (BOOLEAN_PARAM=="false") {
                  def map = [KEY: true]
                  return map
              }
       
      The job then uses the param in a very simple way:
       
          echo "Hello World."
          echo “Parameter Passed = $BOOLEAN_PARAM"
          echo "KEY = $KEY"

          [JENKINS-43722] After cleaning approved script list, the previously approved scripts do not reappear

          Jesse Glick added a comment -

          Can you reproduce without EnvInject? Using a normal plugin, like Groovy Postbuild?

          Jesse Glick added a comment - Can you reproduce without EnvInject? Using a normal plugin, like Groovy Postbuild?

          Oleg Nenashev added a comment -

          Oleg Nenashev added a comment - mcardenasblanco ping

          Sorry for the delay, jglick. No, I have not make the test without using the envinject plugin, will try to perform the test and update the case cc/ oleg_nenashev

          Manuel Cardenas added a comment - Sorry for the delay, jglick . No, I have not make the test without using the envinject plugin, will try to perform the test and update the case cc/ oleg_nenashev

          Oleg Nenashev added a comment -

          Removing the assignee for now

          Oleg Nenashev added a comment - Removing the assignee for now

          Jesse Glick added a comment -

          Sort of as designed, though UX could be improved. Approved scripts and pending approvals are distinct things. Once a script is approved, only the fingerprint is retained, not the full text nor the approval context. So when you clear approved scripts, it would be impossible to return them to a pending state. After jobs are loaded on next Jenkins restart, there is no trace of the previous approval, so it is readded to the queue.

          Jesse Glick added a comment - Sort of as designed, though UX could be improved. Approved scripts and pending approvals are distinct things. Once a script is approved, only the fingerprint is retained, not the full text nor the approval context. So when you clear approved scripts, it would be impossible to return them to a pending state. After jobs are loaded on next Jenkins restart, there is no trace of the previous approval, so it is readded to the queue.

          Joe Harte added a comment - - edited

          I am seeing the same problem. An administrator accidentally cleared our script approvals and we cannot add them back.

          Things brings up a big issue with the UX. There is no "Save" option on the script approvals page, so as soon as the Clear Approvals is selected there is no going back. It would be safer if there was a separate Save button for activating the change. In addition, there is no way to restore previous script approvals using a "Configuration Change History", similar to what one can do with jobs. I haven't been able to find an issue tracking these, so I may open new ones.

          Joe Harte added a comment - - edited I am seeing the same problem. An administrator accidentally cleared our script approvals and we cannot add them back. Things brings up a big issue with the UX. There is no "Save" option on the script approvals page, so as soon as the Clear Approvals is selected there is no going back. It would be safer if there was a separate Save button for activating the change. In addition, there is no way to restore previous script approvals using a "Configuration Change History", similar to what one can do with jobs. I haven't been able to find an issue tracking these, so I may open new ones.

          Jesse Glick added a comment -

          “Clear” buttons ought to have a JavaScript confirmation dialog. There is already a separate long-standing RFE for a generally richer UI.

          Jesse Glick added a comment - “Clear” buttons ought to have a JavaScript confirmation dialog. There is already a separate long-standing RFE for a generally richer UI.

            Unassigned Unassigned
            mcardenasblanco Manuel Cardenas
            Votes:
            3 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated: