From e1c25beacc7ffd617810fb4365edab9ee56af86b Mon Sep 17 00:00:00 2001
From: rseguy <rseguy@71c3de6d-444a-0410-be80-ed276b4c234a>
Date: Fri, 27 Aug 2010 13:36:27 +0000
Subject: [PATCH] [FIXED HUDSON-1871]

git-svn-id: https://hudson.dev.java.net/svn/hudson/trunk/hudson/main@34172 71c3de6d-444a-0410-be80-ed276b4c234a
---
 core/src/main/java/hudson/Functions.java      | 18 +++-
 core/src/main/java/hudson/model/Run.java      |  9 +-
 .../hudson/model/AbstractBuild/index.jelly    |  6 +-
 .../hudson/model/AbstractProject/main.jelly   |  6 +-
 .../hudson/model/ExternalRun/sidepanel.jelly  |  4 +-
 .../hudson/model/Messages.properties          |  6 +-
 .../hudson/model/Run/artifacts-index.jelly    | 30 +++---
 .../resources/lib/hudson/artifactList.jelly   | 94 ++++++++++---------
 .../hudson/maven/MavenModuleSet/index.jelly   |  6 +-
 9 files changed, 108 insertions(+), 71 deletions(-)

diff --git a/core/src/main/java/hudson/Functions.java b/core/src/main/java/hudson/Functions.java
index 87edf95188..4b08a8d92b 100644
--- a/core/src/main/java/hudson/Functions.java
+++ b/core/src/main/java/hudson/Functions.java
@@ -2,7 +2,7 @@
  * The MIT License
  * 
  * Copyright (c) 2004-2010, Sun Microsystems, Inc., Kohsuke Kawaguchi,
- * Yahoo! Inc., Stephen Connolly, Tom Huybrechts, Alan Harder
+ * Yahoo! Inc., Stephen Connolly, Tom Huybrechts, Alan Harder, Romain Seguy
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -1266,4 +1266,20 @@ public class Functions {
     public static boolean getIsUnitTest() {
         return Main.isUnitTest;
     }
+
+    /**
+     * Returns {@code true} if the {@link Run#ARTIFACTS} permission is enabled,
+     * {@code false} otherwise.
+     *
+     * <p>When the {@link Run#ARTIFACTS} permission is not turned on using the
+     * {@code hudson.security.ArtifactsPermission}, this permission must not be
+     * considered to be set to {@code false} for every user. It must rather be
+     * like if the permission doesn't exist at all (which means that every user
+     * has to have an access to the artifacts but the permission can't be
+     * configured in the security screen). Got it?</p>
+     */
+    public static boolean isArtifactsPermissionEnabled() {
+        return Boolean.getBoolean("hudson.security.ArtifactsPermission");
+    }
+
 }
diff --git a/core/src/main/java/hudson/model/Run.java b/core/src/main/java/hudson/model/Run.java
index c92b7880da..e90404c374 100644
--- a/core/src/main/java/hudson/model/Run.java
+++ b/core/src/main/java/hudson/model/Run.java
@@ -2,7 +2,7 @@
  * The MIT License
  * 
  * Copyright (c) 2004-2010, Sun Microsystems, Inc., Kohsuke Kawaguchi,
- * Daniel Dyer, Red Hat, Inc., Tom Huybrechts
+ * Daniel Dyer, Red Hat, Inc., Tom Huybrechts, Romain Seguy
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -24,6 +24,7 @@
  */
 package hudson.model;
 
+import hudson.Functions;
 import hudson.AbortException;
 import hudson.BulkChange;
 import hudson.EnvVars;
@@ -1530,6 +1531,9 @@ public abstract class Run <JobT extends Job<JobT,RunT>,RunT extends Run<JobT,Run
      * Serves the artifacts.
      */
     public DirectoryBrowserSupport doArtifact() {
+        if(Functions.isArtifactsPermissionEnabled()) {
+          checkPermission(ARTIFACTS);
+        }
         return new DirectoryBrowserSupport(this,new FilePath(getArtifactsDir()), project.getDisplayName()+' '+getDisplayName(), "package.gif", true);
     }
 
@@ -1776,6 +1780,9 @@ public abstract class Run <JobT extends Job<JobT,RunT>,RunT extends Run<JobT,Run
     public static final PermissionGroup PERMISSIONS = new PermissionGroup(Run.class,Messages._Run_Permissions_Title());
     public static final Permission DELETE = new Permission(PERMISSIONS,"Delete",Messages._Run_DeletePermission_Description(),Permission.DELETE);
     public static final Permission UPDATE = new Permission(PERMISSIONS,"Update",Messages._Run_UpdatePermission_Description(),Permission.UPDATE);
+    /** See {@link hudson.Functions#isArtifactsPermissionEnabled} */
+    public static final Permission ARTIFACTS = new Permission(PERMISSIONS,"Artifacts",Messages._Run_ArtifactsPermission_Description(), null,
+                                                              Functions.isArtifactsPermissionEnabled());
 
     private static class DefaultFeedAdapter implements FeedAdapter<Run> {
         public String getEntryTitle(Run entry) {
diff --git a/core/src/main/resources/hudson/model/AbstractBuild/index.jelly b/core/src/main/resources/hudson/model/AbstractBuild/index.jelly
index fe23d62c2b..c66658b7ad 100644
--- a/core/src/main/resources/hudson/model/AbstractBuild/index.jelly
+++ b/core/src/main/resources/hudson/model/AbstractBuild/index.jelly
@@ -1,7 +1,8 @@
 <!--
 The MIT License
 
-Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Matthew R. Harrah, Tom Huybrechts, id:cactusman
+Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Matthew R. Harrah,
+Tom Huybrechts, id:cactusman, Romain Seguy
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -55,7 +56,8 @@ THE SOFTWARE.
       </div>
 
       <table style="margin-top: 1em; margin-left:1em;">
-        <t:artifactList build="${it}" caption="${%Build Artifacts}" />
+        <t:artifactList build="${it}" caption="${%Build Artifacts}"
+          permission="${it.ARTIFACTS}" />
 
         <j:set var="set" value="${it.changeSet}" />
         <t:summary icon="notepad.gif">
diff --git a/core/src/main/resources/hudson/model/AbstractProject/main.jelly b/core/src/main/resources/hudson/model/AbstractProject/main.jelly
index a66e273217..6e4089ea9b 100644
--- a/core/src/main/resources/hudson/model/AbstractProject/main.jelly
+++ b/core/src/main/resources/hudson/model/AbstractProject/main.jelly
@@ -1,7 +1,8 @@
 <!--
 The MIT License
 
-Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Erik Ramfelt, id:cactusman
+Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Erik Ramfelt,
+id:cactusman, Romain Seguy
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -37,7 +38,8 @@ THE SOFTWARE.
     </t:summary>
 
     <t:artifactList caption="${%Last Successful Artifacts}"
-        build="${it.lastSuccessfulBuild}" baseURL="lastSuccessfulBuild/" />
+        build="${it.lastSuccessfulBuild}" baseURL="lastSuccessfulBuild/"
+        permission="${it.lastSuccessfulBuild.ARTIFACTS}"/>
 
     <t:summary icon="notepad.gif" href="changes">
       ${%Recent Changes}
diff --git a/core/src/main/resources/hudson/model/ExternalRun/sidepanel.jelly b/core/src/main/resources/hudson/model/ExternalRun/sidepanel.jelly
index bcf262adfd..2747d2d7a2 100644
--- a/core/src/main/resources/hudson/model/ExternalRun/sidepanel.jelly
+++ b/core/src/main/resources/hudson/model/ExternalRun/sidepanel.jelly
@@ -1,7 +1,7 @@
 <!--
 The MIT License
 
-Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
+Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Romain Seguy
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -31,7 +31,7 @@ THE SOFTWARE.
     <l:tasks>
       <l:task icon="images/24x24/up.gif" href="${rootURL}/${it.parent.url}" title="${%Back to Job}" />
       <l:task icon="images/24x24/terminal.gif" href="." title="${%Console Output}" />
-      <j:if test="${it.hasArtifacts}">
+      <j:if test="${(!h.isArtifactsPermissionEnabled() or h.isArtifactsPermissionEnabled() and h.hasPermission(it,attrs.permission)) and it.hasArtifacts}">
         <l:task icon="images/24x24/package.gif" href="artifacts-index" title="${%Artifacts}" />
       </j:if>
       <st:include page="actions.jelly"/>
diff --git a/core/src/main/resources/hudson/model/Messages.properties b/core/src/main/resources/hudson/model/Messages.properties
index 9afa3e3b89..402828150b 100644
--- a/core/src/main/resources/hudson/model/Messages.properties
+++ b/core/src/main/resources/hudson/model/Messages.properties
@@ -1,7 +1,7 @@
 # The MIT License
 # 
 # Copyright (c) 2004-2010, Sun Microsystems, Inc., Kohsuke Kawaguchi,
-# Eric Lefevre-Ardant, Erik Ramfelt, Seiji Sogabe, id:cactusman
+# Eric Lefevre-Ardant, Erik Ramfelt, Seiji Sogabe, id:cactusman, Romain Seguy
 # 
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the "Software"), to deal
@@ -164,6 +164,10 @@ Run.DeletePermission.Description=\
 Run.UpdatePermission.Description=\
   This permission allows users to update description and other properties of a build, \
   for example to leave notes about the cause of a build failure.
+Run.ArtifactsPermission.Description=\
+  This permission grants the ability to retrieve the artifacts produced by \
+  builds. If you don''t want an user to access the artifacts, you can do so by \
+  revoking this permission.
 Run.InProgressDuration={0} and counting
 
 Run.Summary.Stable=stable
diff --git a/core/src/main/resources/hudson/model/Run/artifacts-index.jelly b/core/src/main/resources/hudson/model/Run/artifacts-index.jelly
index 99c184b719..6baa53e5b9 100644
--- a/core/src/main/resources/hudson/model/Run/artifacts-index.jelly
+++ b/core/src/main/resources/hudson/model/Run/artifacts-index.jelly
@@ -1,7 +1,7 @@
 <!--
 The MIT License
 
-Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
+Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Romain Seguy
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -23,17 +23,19 @@ THE SOFTWARE.
 -->
 
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
-  <l:layout title="${it.parent.displayName} #${it.number} Artifacts">
-		<st:include page="sidepanel.jelly" />
-		<l:main-panel>
-		<t:buildCaption>
-		  ${%Build Artifacts}
-		</t:buildCaption>
-		<ul>
-		  <j:forEach var="f" items="${it.artifacts}">
-		    <li><a href="artifact/${f.href}">${h.xmlEscape(f.displayPath)}</a></li>
-		  </j:forEach>
-		</ul>
-		</l:main-panel>
-	</l:layout>
+  <j:if test="${!h.isArtifactsPermissionEnabled() or h.isArtifactsPermissionEnabled() and h.hasPermission(it.ARTIFACTS)}">
+    <l:layout title="${it.parent.displayName} #${it.number} Artifacts">
+      <st:include page="sidepanel.jelly" />
+      <l:main-panel>
+        <t:buildCaption>
+          ${%Build Artifacts}
+        </t:buildCaption>
+        <ul>
+          <j:forEach var="f" items="${it.artifacts}">
+            <li><a href="artifact/${f.href}">${h.xmlEscape(f.displayPath)}</a></li>
+          </j:forEach>
+        </ul>
+      </l:main-panel>
+    </l:layout>
+  </j:if>
 </j:jelly>
\ No newline at end of file
diff --git a/core/src/main/resources/lib/hudson/artifactList.jelly b/core/src/main/resources/lib/hudson/artifactList.jelly
index 258227448b..9b23cfa241 100644
--- a/core/src/main/resources/lib/hudson/artifactList.jelly
+++ b/core/src/main/resources/lib/hudson/artifactList.jelly
@@ -1,7 +1,7 @@
 <!--
 The MIT License
 
-Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
+Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Romain Seguy
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -37,51 +37,53 @@ THE SOFTWARE.
       If the hyperlink to artifacts are at another URL, specify the prefix.
     </st:attribute>
   </st:documentation>
-  <j:set var="artifacts" value="${build.getArtifactsUpTo(build.TREE_CUTOFF+1)}" />
-  <j:if test="${!build.building and !empty(artifacts)}">
-    <t:summary icon="package.gif">
-      <a href="${baseURL}artifact/">${caption}</a>
-      <j:choose>
-        <j:when test="${size(artifacts) le build.LIST_CUTOFF}">
-          <!-- if not too many, just list them -->
-          <ul>
-            <j:forEach var="f" items="${artifacts}">
-              <li>
-                <a href="${baseURL}artifact/${f.href}">${h.xmlEscape(f.displayPath)}</a>
-                <st:nbsp/>
-                <a href="${baseURL}artifact/${f.href}/*fingerprint*/"><img src="${imagesURL}/16x16/fingerprint.gif" alt="[fingerprint]" /></a>
-              </li>
-            </j:forEach>
-          </ul>
-        </j:when>
-        <j:when test="${size(artifacts) le build.TREE_CUTOFF}">
-            <!-- otherwise (unless way too many) use a tree view -->
-            <l:yui module="treeview"/>
-            <link rel="stylesheet" href="${resURL}/scripts/yui/treeview/assets/skins/sam/treeview.css" type="text/css"/>
-            <link rel="stylesheet" href="${resURL}/scripts/yui/fonts/fonts-min.css" type="text/css"/>
-            <style type="text/css">#artifact-tree td { vertical-align:middle; }</style>
-            <div id="artifact-tree"></div>
-            <script language="javascript">// &lt;![CDATA[
-              YAHOO.util.Event.onContentReady('artifact-tree', function () {
-              var artifactTree = new YAHOO.widget.TreeView('artifact-tree');
-              var artifactRoot = new YAHOO.widget.TextNode('${h.jsStringEscape('%View')}',
-                                                           artifactTree.getRoot(), false);
-              <j:forEach var="e" items="${artifacts.getTree().entrySet()}">
-                <j:set var="f" value="${e.key}"/>
-                var ${f.treeNodeId} = new YAHOO.widget.TextNode(
-                  '${h.jsStringEscape(f.fileName)}', ${e.value?:'artifactRoot'}, false);
-                      <j:if test="${f.href!=null}">
-                        <!-- Assign href property instead of passing to constructor above,
-                             as constructor does urlencoding, but f.href is already encoded -->
-                        ${f.treeNodeId}.href = '${baseURL}artifact/${h.jsStringEscape(f.href)}';
-                      </j:if>
+  <j:if test="${!h.isArtifactsPermissionEnabled() or h.isArtifactsPermissionEnabled() and h.hasPermission(it,attrs.permission)}">
+    <j:set var="artifacts" value="${build.getArtifactsUpTo(build.TREE_CUTOFF+1)}" />
+    <j:if test="${!build.building and !empty(artifacts)}">
+      <t:summary icon="package.gif">
+        <a href="${baseURL}artifact/">${caption}</a>
+        <j:choose>
+          <j:when test="${size(artifacts) le build.LIST_CUTOFF}">
+            <!-- if not too many, just list them -->
+            <ul>
+              <j:forEach var="f" items="${artifacts}">
+                <li>
+                  <a href="${baseURL}artifact/${f.href}">${h.xmlEscape(f.displayPath)}</a>
+                  <st:nbsp/>
+                  <a href="${baseURL}artifact/${f.href}/*fingerprint*/"><img src="${imagesURL}/16x16/fingerprint.gif" alt="[fingerprint]" /></a>
+                </li>
               </j:forEach>
-              artifactTree.draw();
-             });
-           // ]]&gt;</script>
-        </j:when>
-        <!-- otherwise just show link to directory browser -->
-      </j:choose>
-    </t:summary>
+            </ul>
+          </j:when>
+          <j:when test="${size(artifacts) le build.TREE_CUTOFF}">
+              <!-- otherwise (unless way too many) use a tree view -->
+              <l:yui module="treeview"/>
+              <link rel="stylesheet" href="${resURL}/scripts/yui/treeview/assets/skins/sam/treeview.css" type="text/css"/>
+              <link rel="stylesheet" href="${resURL}/scripts/yui/fonts/fonts-min.css" type="text/css"/>
+              <style type="text/css">#artifact-tree td { vertical-align:middle; }</style>
+              <div id="artifact-tree"></div>
+              <script language="javascript">// &lt;![CDATA[
+                YAHOO.util.Event.onContentReady('artifact-tree', function () {
+                var artifactTree = new YAHOO.widget.TreeView('artifact-tree');
+                var artifactRoot = new YAHOO.widget.TextNode('${h.jsStringEscape('%View')}',
+                                                             artifactTree.getRoot(), false);
+                <j:forEach var="e" items="${artifacts.getTree().entrySet()}">
+                  <j:set var="f" value="${e.key}"/>
+                  var ${f.treeNodeId} = new YAHOO.widget.TextNode(
+                    '${h.jsStringEscape(f.fileName)}', ${e.value?:'artifactRoot'}, false);
+                        <j:if test="${f.href!=null}">
+                          <!-- Assign href property instead of passing to constructor above,
+                               as constructor does urlencoding, but f.href is already encoded -->
+                          ${f.treeNodeId}.href = '${baseURL}artifact/${h.jsStringEscape(f.href)}';
+                        </j:if>
+                </j:forEach>
+                artifactTree.draw();
+               });
+             // ]]&gt;</script>
+          </j:when>
+          <!-- otherwise just show link to directory browser -->
+        </j:choose>
+      </t:summary>
+    </j:if>
   </j:if>
 </j:jelly>
diff --git a/maven-plugin/src/main/resources/hudson/maven/MavenModuleSet/index.jelly b/maven-plugin/src/main/resources/hudson/maven/MavenModuleSet/index.jelly
index 690b6c181f..c7b04562e2 100644
--- a/maven-plugin/src/main/resources/hudson/maven/MavenModuleSet/index.jelly
+++ b/maven-plugin/src/main/resources/hudson/maven/MavenModuleSet/index.jelly
@@ -1,7 +1,8 @@
 <!--
 The MIT License
 
-Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Eric Lefevre-Ardant, Erik Ramfelt, Stephen Connolly, Tom Huybrechts, id:cactusman
+Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Eric Lefevre-Ardant,
+Erik Ramfelt, Stephen Connolly, Tom Huybrechts, id:cactusman, Romain Seguy
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -54,7 +55,8 @@ THE SOFTWARE.
         </t:summary>
 
         <t:artifactList caption="${%Last Successful Artifacts}"
-            build="${it.lastSuccessfulBuild}" baseURL="lastSuccessfulBuild/" />
+            build="${it.lastSuccessfulBuild}" baseURL="lastSuccessfulBuild/"
+            permission="${it.lastSuccessfulBuild.ARTIFACTS}" />
 
         <t:summary icon="notepad.gif" href="changes">
           ${%Recent Changes}
-- 
GitLab