rsp.sendError(HttpURLConnection.HTTP_FORBIDDEN,"primitive XPath result sets forbidden; can use -Dhudson.model.Api.INSECURE=true if you run without security");
rsp.sendError(HttpURLConnection.HTTP_FORBIDDEN,"primitive XPath result sets forbidden; implement jenkins.security.SecureRequester");
}
return;
}
...
...
@@ -188,11 +191,11 @@ public class Api extends AbstractModelObject {
@@ -116,6 +118,7 @@ public class DefaultCrumbIssuerTest extends HudsonTestCase {
wc.assertFails("crumbIssuer/api/xml?xpath=concat(//crumbRequestField,'=',//crumb)",HttpURLConnection.HTTP_FORBIDDEN);// perhaps interpretable as JS number