[JENKINS-50032] Jobs can be triggered with only Job/Read and Job/Configure

Create a job and assign an Authentication Token under Trigger builds remotely (e.g., from scripts)
Create a user and only assign Job/Read and Job/Configure permission for this job.
Navigate to the job as the newly created user, retrieve the build URL which contains the token.
The user cannot build this job via the UI.
Retrive the user's API token ($JENKINS_URL/users/$USERNAME)
Go to command line and use the following curl command: curl -X POST $JENKINS_URL/job/$JOB_NAME/build?token\=$AUTHENTICATION_TOKEN -u $USER_NAME:$API_TOKEN
The job will be now be built.

Joshua Shinn created issue - 2018-03-09 04:13

Joshua Shinn made changes - 2018-03-09 04:20

Summary

Original: Jobs can be triggered with only Job/Read

New: Jobs can be triggered with only Job/Read and Job/Configure

Joshua Shinn made changes - 2018-03-09 13:52

Environment

Original: Parameterized trigger plugin 2.35.2,
CloudBees Role-Based Access Control Plugin 5.9

New: Parameterized trigger plugin 2.35.2

Jenkins