JENKINS-61205 System read - global security configuration (#4524)

core/src/main/java/hudson/security/GlobalSecurityConfiguration.java

@@ -182,7 +182,7 @@ public class GlobalSecurityConfiguration extends ManagementLink implements Descr
     
     @Override
     public Permission getRequiredPermission() {
-        return Jenkins.ADMINISTER;
+        return Jenkins.SYSTEM_READ;
     }
 
     @Restricted(NoExternalUse.class)

core/src/main/resources/hudson/security/GlobalSecurityConfiguration/index.groovy

@@ -11,12 +11,15 @@ def f=namespace(lib.FormTagLib)
 def l=namespace(lib.LayoutTagLib)
 def st=namespace("jelly:stapler")
 
-l.layout(permission:app.ADMINISTER, title:my.displayName, cssclass:request.getParameter('decorate')) {
+l.layout(permission:app.SYSTEM_READ, title:my.displayName, cssclass:request.getParameter('decorate')) {
     l.main_panel {
         h1 {
             l.icon(class: 'icon-secure icon-xlg')
             text(my.displayName)
         }
+        if (!h.hasPermission(app.ADMINISTER)) {
+            set("readOnlyMode", "true")
+        }
 
         p()
         div(class:"behavior-loading", _("LOADING"))
@@ -101,13 +104,17 @@ l.layout(permission:app.ADMINISTER, title:my.displayName, cssclass:request.getPa
                 }
             }
 
-            f.bottomButtonBar {
-                f.submit(value:_("Save"))
-                f.apply()
+            l.isAdmin() {
+                f.bottomButtonBar {
+                    f.submit(value: _("Save"))
+                    f.apply()
+                }
             }
         }
 
-        st.adjunct(includes: "lib.form.confirm")
+        l.isAdmin() {
+            st.adjunct(includes: "lib.form.confirm")
+        }
     }
 }