[JENKINS-61905] Forward Groovy view permission errors to login

core/src/main/java/hudson/security/UnwrapSecurityExceptionFilter.java

@@ -51,7 +51,14 @@ public class UnwrapSecurityExceptionFilter implements Filter {
             chain.doFilter(request,response);
         } catch (ServletException e) {
             Throwable t = e.getRootCause();
-            if (t instanceof JellyTagException) {
+            while (t != null && !(t instanceof JellyTagException)) {
+                if (t instanceof ServletException) {
+                    t = ((ServletException) t).getRootCause();
+                } else {
+                    t = t.getCause();
+                }
+            }
+            if (t != null) {
                 JellyTagException jte = (JellyTagException) t;
                 Throwable cause = jte.getCause();
                 if (cause instanceof AcegiSecurityException) {

test/src/test/java/hudson/security/AccessDeniedException2Test.java

@@ -27,6 +27,10 @@ package hudson.security;
 import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
 import java.net.HttpURLConnection;
 import static org.junit.Assert.*;
+
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import jenkins.model.Jenkins;
+import org.junit.Assert;
 import org.junit.Rule;
 import org.junit.Test;
 import org.jvnet.hudson.test.Issue;
@@ -58,4 +62,21 @@ public class AccessDeniedException2Test {
         }
     }
 
+    @Test
+    @Issue("JENKINS-61905")
+    public void redirectPermissionErrorsToLogin() throws Exception {
+        JenkinsRule.DummySecurityRealm realm = r.createDummySecurityRealm();
+        r.jenkins.setSecurityRealm(realm);
+        r.jenkins.setAuthorizationStrategy(new MockAuthorizationStrategy().grant(Jenkins.READ).everywhere().toEveryone());
+        JenkinsRule.WebClient wc = r.createWebClient();
+        wc.setRedirectEnabled(true);
+        wc.setThrowExceptionOnFailingStatusCode(false);
+        final HtmlPage configure = wc.goTo("configure");
+        Assert.assertTrue(configure.getUrl().getPath().contains("login"));
+        Assert.assertTrue(configure.getUrl().getQuery().startsWith("from"));
+
+        final HtmlPage configureSecurity = wc.goTo("configureSecurity/");
+        Assert.assertTrue(configureSecurity.getUrl().getPath().contains("login"));
+        Assert.assertTrue(configureSecurity.getUrl().getQuery().startsWith("from"));
+    }
 }