Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[JENKINS-73061] allow users with Overall/Manage to configure global plugin options #423

Merged
merged 1 commit into from
May 3, 2024

Conversation

mikecirioli
Copy link
Contributor

@mikecirioli mikecirioli commented Apr 24, 2024

https://issues.jenkins.io/browse/JENKINS-73061

Based on JEP-223, this operation does not allow users to escalate permissions and it's not related to security, so it qualifies to be accessible with the Overall/Manage permission.

Testing done

  • Relevant URI related code was reviewed to ensure that file:// uri's were properly caught
  • Installed plugin and manually verified a user with Overall/Manage can configure the feature. Also verified that no information was leaked when attempting to configure dodgy urls like file://etc/passwd, and secrets in JENKINS_HOME

Submitter checklist

Preview Give feedback

@mikecirioli mikecirioli requested a review from jetersen as a code owner April 24, 2024 19:36
@mikecirioli
Copy link
Contributor Author

@jetersen @rsandell @MarkEWaite Could i kindly get a review of this PR please?

@MarkEWaite
Copy link
Contributor

@mikecirioli can you describe the interactive testing that you performed to confirm that it is behaving as expected? The "Testing done" section is the place where that should be described.

Copy link
Contributor

@MarkEWaite MarkEWaite left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

@mikecirioli
Copy link
Contributor Author

@MarkEWaite I've updated the description to include the testing done, let me know if you need anything else

@mikecirioli
Copy link
Contributor Author

@jetersen can i get an additional review when you have the time?

@jetersen jetersen added the enhancement New feature or request label May 3, 2024
@jetersen jetersen merged commit c7f1202 into jenkinsci:master May 3, 2024
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants