this involves executing code sent from the remote JVM. Requires protection

git-svn-id: https://hudson.dev.java.net/svn/hudson/trunk/hudson/main@17545 71c3de6d-444a-0410-be80-ed276b4c234a

core/src/main/java/hudson/model/Hudson.java

@@ -2662,6 +2662,7 @@ public final class Hudson extends Node implements ItemGroup<TopLevelItem>, Stapl
      * Handles HTTP requests for duplex channels.
      */
     public void doDuplexChannel(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException, InterruptedException {
+        checkPermission(ADMINISTER);
         requirePOST();
 
         UUID uuid = UUID.fromString(req.getHeader("Session"));