From b3f8f5369bcd218013566dbff2212d6113608cf8 Mon Sep 17 00:00:00 2001
From: redsolo <redsolo@71c3de6d-444a-0410-be80-ed276b4c234a>
Date: Thu, 1 May 2008 21:59:49 +0000
Subject: [PATCH] [fixed] Added "View workspace" permission to the matrix based
 security. (issue #434)

git-svn-id: https://hudson.dev.java.net/svn/hudson/trunk/hudson/main@8998 71c3de6d-444a-0410-be80-ed276b4c234a
---
 .../java/hudson/model/AbstractProject.java    |  2 ++
 .../hudson/maven/MavenModuleSet/index.jelly   |  2 +-
 .../hudson/model/AbstractProject/main.jelly   |  2 +-
 .../model/AbstractProject/sidepanel.jelly     |  2 +-
 .../main/resources/lib/hudson/summary.jelly   | 32 +++++++++++--------
 5 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/core/src/main/java/hudson/model/AbstractProject.java b/core/src/main/java/hudson/model/AbstractProject.java
index b5bfed309e..dc6d774a30 100644
--- a/core/src/main/java/hudson/model/AbstractProject.java
+++ b/core/src/main/java/hudson/model/AbstractProject.java
@@ -922,6 +922,7 @@ public abstract class AbstractProject<P extends AbstractProject<P,R>,R extends A
      * Serves the workspace files.
      */
     public void doWs( StaplerRequest req, StaplerResponse rsp ) throws IOException, ServletException, InterruptedException {
+        checkPermission(AbstractProject.WORKSPACE);
         FilePath ws = getWorkspace();
         if(!ws.exists()) {
             // if there's no workspace, report a nice error message
@@ -1009,6 +1010,7 @@ public abstract class AbstractProject<P extends AbstractProject<P,R>,R extends A
     private static final Logger LOGGER = Logger.getLogger(AbstractProject.class.getName());
 
     public static final Permission BUILD = new Permission(PERMISSIONS, "Build", Permission.UPDATE);
+    public static final Permission WORKSPACE = new Permission(PERMISSIONS, "Workspace", Permission.READ);
     /**
      * Permission to abort a build. For now, let's make it the same as {@link #BUILD}
      */
diff --git a/core/src/main/resources/hudson/maven/MavenModuleSet/index.jelly b/core/src/main/resources/hudson/maven/MavenModuleSet/index.jelly
index 84fba8cbef..e0ae6b45e8 100644
--- a/core/src/main/resources/hudson/maven/MavenModuleSet/index.jelly
+++ b/core/src/main/resources/hudson/maven/MavenModuleSet/index.jelly
@@ -14,7 +14,7 @@
             ${act.displayName}
           </t:summary>
         </j:forEach>
-        <t:summary icon="folder.gif" href="ws/">
+        <t:summary icon="folder.gif" href="ws/" permission="${it.WORKSPACE}">
           ${%Workspace}
         </t:summary>
 
diff --git a/core/src/main/resources/hudson/model/AbstractProject/main.jelly b/core/src/main/resources/hudson/model/AbstractProject/main.jelly
index def74dd4da..0ef916a14f 100644
--- a/core/src/main/resources/hudson/model/AbstractProject/main.jelly
+++ b/core/src/main/resources/hudson/model/AbstractProject/main.jelly
@@ -8,7 +8,7 @@
         ${act.displayName}
       </t:summary>
     </j:forEach>
-    <t:summary icon="folder.gif" href="ws/">
+    <t:summary icon="folder.gif" href="ws/" permission="${it.WORKSPACE}">
       ${%Workspace}
     </t:summary>
 
diff --git a/core/src/main/resources/hudson/model/AbstractProject/sidepanel.jelly b/core/src/main/resources/hudson/model/AbstractProject/sidepanel.jelly
index 99548671f4..3797dcee96 100644
--- a/core/src/main/resources/hudson/model/AbstractProject/sidepanel.jelly
+++ b/core/src/main/resources/hudson/model/AbstractProject/sidepanel.jelly
@@ -13,7 +13,7 @@
       <l:task icon="images/24x24/up.gif" href="${rootURL}/" title="${%Back to Dashboard}" />
       <l:task icon="images/24x24/search.gif"  href="${url}/" title="${%Status}" />
       <l:task icon="images/24x24/notepad.gif" href="${url}/changes" title="${%Changes}" />
-      <l:task icon="images/24x24/folder.gif"  href="${url}/ws/" title="${%Workspace}" />
+      <l:task icon="images/24x24/folder.gif"  href="${url}/ws/" title="${%Workspace}" permission="${it.WORKSPACE}" />
       <j:if test="${it.configurable}">
         <j:if test="${!it.disabled}">
           <l:task icon="images/24x24/clock.gif" href="${url}/build?delay=0sec" title="${%Build Now}" onclick="return build(this)" permission="${it.BUILD}" />
diff --git a/core/src/main/resources/lib/hudson/summary.jelly b/core/src/main/resources/lib/hudson/summary.jelly
index 7d2cd2dee3..193c67a3e5 100644
--- a/core/src/main/resources/lib/hudson/summary.jelly
+++ b/core/src/main/resources/lib/hudson/summary.jelly
@@ -9,21 +9,25 @@ Attributes:
     where the summary icon links to.
   iconOnly (optional)
     if true, hyperlink will only cover the icon, not the body.
+  permission (optional) 
+  	permission object. If specified, the link will be displayed only if you have a permission
 -->
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
-  <j:if test="${attrs.icon!=null}">
-    <tr>
-      <td>
-        <a href="${attrs.href}">
-          <img src="${h.ifThenElse(icon.startsWith('/'), rootURL+icon, imagesURL+'/48x48/'+icon)}"
-               width="48" height="48" style="margin-right:1em" />
-        </a>
-      </td>
-      <td style="vertical-align:middle">
-        <a href="${h.ifThenElse(attrs.iconOnly==null,attrs.href,null)}">
-          <d:invokeBody />
-        </a>
-      </td>
-    </tr>
+  <j:if test="${h.hasPermission(attrs.permission)}">
+    <j:if test="${attrs.icon!=null}">
+      <tr>
+        <td>
+          <a href="${attrs.href}">
+            <img src="${h.ifThenElse(icon.startsWith('/'), rootURL+icon, imagesURL+'/48x48/'+icon)}"
+                 width="48" height="48" style="margin-right:1em" />
+          </a>
+        </td>
+        <td style="vertical-align:middle">
+          <a href="${h.ifThenElse(attrs.iconOnly==null,attrs.href,null)}">
+            <d:invokeBody />
+          </a>
+        </td>
+      </tr>
+    </j:if>
   </j:if>
 </j:jelly>
\ No newline at end of file
-- 
GitLab