Skip to content

Conversation

mikecirioli
Copy link
Contributor

@mikecirioli mikecirioli commented Apr 24, 2024

https://issues.jenkins.io/browse/JENKINS-73061

Based on JEP-223, this operation does not allow users to escalate permissions and it's not related to security, so it qualifies to be accessible with the Overall/Manage permission.

Testing done

  • Relevant URI related code was reviewed to ensure that file:// uri's were properly caught
  • Installed plugin and manually verified a user with Overall/Manage can configure the feature. Also verified that no information was leaked when attempting to configure dodgy urls like file://etc/passwd, and secrets in JENKINS_HOME
### Submitter checklist
- [x] Make sure you are opening from a **topic/feature/bugfix branch** (right side) and not your main branch!
- [x] Ensure that the pull request title represents the desired changelog entry
- [x] Please describe what you did
- [x] Link to relevant issues in GitHub or Jira
- [x] Link to relevant pull requests, esp. upstream and downstream changes
- [x] Ensure you have provided tests - that demonstrates feature works or fixes the issue

@mikecirioli mikecirioli requested a review from jetersen as a code owner April 24, 2024 19:36
@mikecirioli
Copy link
Contributor Author

@jetersen @rsandell @MarkEWaite Could i kindly get a review of this PR please?

@MarkEWaite
Copy link
Contributor

@mikecirioli can you describe the interactive testing that you performed to confirm that it is behaving as expected? The "Testing done" section is the place where that should be described.

Copy link
Contributor

@MarkEWaite MarkEWaite left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

@mikecirioli
Copy link
Contributor Author

@MarkEWaite I've updated the description to include the testing done, let me know if you need anything else

@mikecirioli
Copy link
Contributor Author

@jetersen can i get an additional review when you have the time?

@jetersen jetersen added the enhancement New feature or request label May 3, 2024
@jetersen jetersen merged commit c7f1202 into jenkinsci:master May 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants