[SECURITY-16]

Require POST for various operations.
(cherry picked from commit 36c86243)

Conflicts:

	core/src/main/java/hudson/model/AbstractBuild.java

core/src/main/java/hudson/model/AbstractBuild.java

@@ -88,6 +88,7 @@ import java.util.Set;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 import javax.annotation.CheckForNull;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 /**
  * Base implementation of {@link Run}s that build software.
@@ -1360,6 +1361,7 @@ public abstract class AbstractBuild<P extends AbstractProject<P,R>,R extends Abs
      * 
      * @since 1.489
      */
+    @RequirePOST
     public synchronized HttpResponse doStop() throws IOException, ServletException {
         Executor e = getExecutor();
         if (e==null)

core/src/main/java/hudson/model/AbstractProject.java

@@ -1838,6 +1838,7 @@ public abstract class AbstractProject<P extends AbstractProject<P,R>,R extends A
     /**
      * Cancels a scheduled build.
      */
+    @RequirePOST
     public void doCancelQueue( StaplerRequest req, StaplerResponse rsp ) throws IOException, ServletException {
         checkPermission(ABORT);
 

core/src/main/java/hudson/model/Executor.java

@@ -57,6 +57,7 @@ import java.lang.reflect.Method;
 
 import static hudson.model.queue.Executables.*;
 import static java.util.logging.Level.FINE;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 
 /**
@@ -468,6 +469,7 @@ public class Executor extends Thread implements ModelObject {
      * @deprecated as of 1.489
      *      Use {@link #doStop()}.
      */
+    @RequirePOST
     public void doStop( StaplerRequest req, StaplerResponse rsp ) throws IOException, ServletException {
         doStop().generateResponse(req,rsp,this);
     }

core/src/main/java/hudson/model/Queue.java

@@ -106,6 +106,7 @@ import org.kohsuke.stapler.export.ExportedBean;
 import com.thoughtworks.xstream.XStream;
 import com.thoughtworks.xstream.converters.basic.AbstractSingleValueConverter;
 import org.kohsuke.stapler.QueryParameter;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 /**
  * Build queue.
@@ -612,6 +613,7 @@ public class Queue extends ResourceController implements Saveable {
     /**
      * Called from {@code queue.jelly} and {@code entries.jelly}.
      */
+    @RequirePOST
     public HttpResponse doCancelItem(@QueryParameter int id) throws IOException, ServletException {
         Item item = getItem(id);
         if (item != null) {
@@ -1435,6 +1437,7 @@ public class Queue extends ResourceController implements Saveable {
 
         /** @deprecated Use {@link #doCancelItem} instead. */
         @Deprecated
+        @RequirePOST
         public HttpResponse doCancelQueue() throws IOException, ServletException {
         	Jenkins.getInstance().getQueue().cancel(this);
             return HttpResponses.forwardToPreviousPage();

core/src/main/resources/hudson/widgets/BuildHistoryWidget/entries.jelly

@@ -43,9 +43,7 @@ THE SOFTWARE.
         <td style="white-space:normal;" colspan="2">
           <div style="float:right">
             <j:if test="${item.hasCancelPermission()}">
-              <a href="${rootURL}/queue/cancelItem?id=${item.id}">
-                <img src="${imagesURL}/16x16/stop.png" alt="${%cancel this build}" height="16" width="16"/>
-              </a>
+              <l:stopButton href="${rootURL}/queue/cancelItem?id=${item.id}" alt="${%cancel this build}"/>
             </j:if>
           </div>
           <j:set var="cause" value="${item.getCauseOfBlockage()}"/>

core/src/main/resources/hudson/widgets/HistoryWidget/entry.jelly

@@ -58,7 +58,7 @@ THE SOFTWARE.
         </td><td style="padding:0">
           <!-- Check ABORT permission for Project, Admin permission otherwise -->
           <j:if test="${empty(it.owner.ABORT) ? h.hasPermission(app.ADMINISTER) : it.owner.hasPermission(it.owner.ABORT)}">
-            <a href="${link}stop"><img src="${imagesURL}/16x16/stop.png" alt="[cancel]" height="16" width="16"/></a>
+            <l:stopButton href="${link}stop" alt="[cancel]"/>
           </j:if>
         </td></tr>
       </table>

core/src/main/resources/lib/hudson/buildCaption.jelly

@@ -37,7 +37,7 @@ THE SOFTWARE.
 	          <t:buildProgressBar build="${it}"/>
 	        </td><td>
             <j:if test="${it.parent.hasAbortPermission()}">
-              <a href="stop"><img src="${imagesURL}/16x16/stop.png" alt="[${%cancel}]" height="16" width="16" /></a>
+              <l:stopButton href="stop" alt="[${%cancel}]"/>
             </j:if>
 	        </td>
 	      </tr></table>

core/src/main/resources/lib/hudson/executors.jelly

@@ -91,7 +91,7 @@ THE SOFTWARE.
                 </st:include>
                 <td class="pane" align="center" valign="middle">
                   <j:if test="${e.hasStopPermission()}">
-                    <a href="${rootURL}/${c.url}${url}/stop"><img src="${imagesURL}/16x16/stop.png" alt="${%terminate this build}" height="16" width="16" /></a>
+                    <l:stopButton href="${rootURL}/${c.url}${url}/stop" alt="${%terminate this build}"/>
                   </j:if>
                 </td>
               </j:otherwise>

core/src/main/resources/lib/hudson/queue.jelly

@@ -79,7 +79,7 @@ THE SOFTWARE.
             </td>
             <td class="pane" width="16" align="center" valign="middle">
               <j:if test="${item.hasCancelPermission()}">
-                <a href="${rootURL}/queue/cancelItem?id=${item.id}"><img src="${imagesURL}/16x16/stop.png" alt="cancel this build" height="16" width="16"/></a>
+                <l:stopButton href="${rootURL}/queue/cancelItem?id=${item.id}" alt="cancel this build"/>
               </j:if>
              </td>
           </tr>

core/src/main/resources/lib/layout/stopButton.jelly

+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+The MIT License
+
+Copyright 2013 Jesse Glick.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:i="jelly:fmt">
+    <st:documentation>
+        Creates a clickable “Stop” button.
+        <st:attribute name="href" use="required">
+            Link target. Relative to the current page.
+        </st:attribute>
+        <st:attribute name="alt" use="required">
+            Alt text for image.
+        </st:attribute>
+    </st:documentation>
+    <a href="${href}" onclick="new Ajax.Request(this.href); return false">
+        <img src="${imagesURL}/16x16/stop.png" alt="${alt}" height="16" width="16"/>
+    </a>
+</j:jelly>