Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-63530

Build Executor Status is shown for nodes where user has no access

    XMLWordPrintable

Details

    • Improvement
    • Status: Open (View Workflow)
    • Minor
    • Resolution: Unresolved
    • core
    • Jenkins 2.235.5, SLES 11.3, role-strategy-plugin 3.0

    Description

      Despite running jobs are filtered out by item roles, Build Executor Status is shown for nodes, which the user has no access via node roles.

      This blows up the Build Executor Status with Build Processors from this nodes.

      Additional an hacker gets information, that these nodes exist and can show some details about it, eg. Labels.

      Attachments

        Activity

          mawinter69 Markus Winter added a comment -

          There is no permission in Jenkins that allows to hide the existence of an agent, similar to what we have for jobs (Job/Discover, and Job/Read). Such a thing needs to be implemented in Jenkins core directly so that also matrix auth would be able to work with this.

          mawinter69 Markus Winter added a comment - There is no permission in Jenkins that allows to hide the existence of an agent, similar to what we have for jobs (Job/Discover, and Job/Read). Such a thing needs to be implemented in Jenkins core directly so that also matrix auth would be able to work with this.

          People

            oleg_nenashev Oleg Nenashev
            tkleiber Torsten Kleiber
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: