[FIXED HUDSON-2324] applied a patch.

I tweaked the patch slightly so that all the background activity gets SYSTEM credential automatically. I think this is less error prone for plugin developers.
This change will be in 1.301.

git-svn-id: https://hudson.dev.java.net/svn/hudson/trunk/hudson/main@17297 71c3de6d-444a-0410-be80-ed276b4c234a

core/src/main/java/hudson/model/Hudson.java

@@ -470,6 +470,9 @@ public final class Hudson extends Node implements ItemGroup<TopLevelItem>, Stapl
     private transient final LogRecorderManager log = new LogRecorderManager();
 
     public Hudson(File root, ServletContext context) throws IOException {
+    	//as hudson is starting, grant this process full controll
+    	SecurityContextHolder.getContext().setAuthentication(ACL.SYSTEM);
+    	
         this.root = root;
         this.servletContext = context;
         computeVersion(context);
@@ -998,7 +1001,18 @@ public final class Hudson extends Node implements ItemGroup<TopLevelItem>, Stapl
      */
     @Exported(name="jobs")
     public List<TopLevelItem> getItems() {
-        return new ArrayList<TopLevelItem>(items.values());
+        List<TopLevelItem> viewableItems = new ArrayList<TopLevelItem>();
+        for (TopLevelItem item : items.values()) {
+            if (item instanceof AccessControlled) {
+            	if (((AccessControlled)item).hasPermission(Item.READ))
+            		viewableItems.add(item);
+            }
+            else {
+            	viewableItems.add(item);
+            }
+        }
+        
+        return viewableItems;
     }
 
     /**
@@ -1017,7 +1031,7 @@ public final class Hudson extends Node implements ItemGroup<TopLevelItem>, Stapl
      */
     public <T> List<T> getItems(Class<T> type) {
         List<T> r = new ArrayList<T>();
-        for (TopLevelItem i : items.values())
+        for (TopLevelItem i : getItems())
             if (type.isInstance(i))
                  r.add(type.cast(i));
         return r;
@@ -1036,8 +1050,15 @@ public final class Hudson extends Node implements ItemGroup<TopLevelItem>, Stapl
         while(!q.isEmpty()) {
             ItemGroup<?> parent = q.pop();
             for (Item i : parent.getItems()) {
-                if(type.isInstance(i))
-                    r.add(type.cast(i));
+                if(type.isInstance(i)) {
+                    if (i instanceof AccessControlled) {
+                    	if (((AccessControlled)i).hasPermission(Item.READ))
+                    		r.add(type.cast(i));
+                    }
+                    else {
+                    	r.add(type.cast(i));
+                    }
+                }
                 if(i instanceof ItemGroup)
                     q.push((ItemGroup)i);
             }
@@ -1646,7 +1667,13 @@ public final class Hudson extends Node implements ItemGroup<TopLevelItem>, Stapl
      * Note that the look up is case-insensitive.
      */
     public TopLevelItem getItem(String name) {
-        return items.get(name);
+    	TopLevelItem item = items.get(name);
+        if (item instanceof AccessControlled) {
+        	if (!((AccessControlled) item).hasPermission(Item.READ)) {
+        		return null;
+        	}
+        }
+        return item;
     }
 
     public File getRootDirFor(TopLevelItem child) {

core/src/main/java/hudson/model/Item.java

@@ -190,6 +190,7 @@ public interface Item extends PersistenceRoot, SearchableModelObject, AccessCont
     public static final Permission CREATE = new Permission(PERMISSIONS,"Create", Permission.CREATE);
     public static final Permission DELETE = new Permission(PERMISSIONS,"Delete", Permission.DELETE);
     public static final Permission CONFIGURE = new Permission(PERMISSIONS,"Configure", Permission.CONFIGURE);
+    public static final Permission READ = new Permission(PERMISSIONS,"Read", Permission.READ);
     public static final Permission BUILD = new Permission(PERMISSIONS, "Build", Messages._AbstractProject_BuildPermission_Description(),  Permission.UPDATE);
     public static final Permission WORKSPACE = new Permission(PERMISSIONS, "Workspace", Messages._AbstractProject_WorkspacePermission_Description(), Permission.READ);
 }

core/src/main/java/hudson/triggers/SafeTimerTask.java

@@ -23,11 +23,15 @@
  */
 package hudson.triggers;
 
+import org.acegisecurity.context.SecurityContextHolder;
+
 import java.util.Timer;
 import java.util.TimerTask;
 import java.util.logging.Logger;
 import java.util.logging.Level;
 
+import hudson.security.ACL;
+
 /**
  * {@link Timer} wrapper so that a fatal error in {@link TimerTask}
  * won't terminate the timer.
@@ -42,10 +46,16 @@ import java.util.logging.Level;
  */
 public abstract class SafeTimerTask extends TimerTask {
     public final void run() {
+        // background activity gets system credential,
+        // just like executors get it.
+        SecurityContextHolder.getContext().setAuthentication(ACL.SYSTEM);
+
         try {
             doRun();
         } catch(Throwable t) {
             LOGGER.log(Level.SEVERE, "Timer task "+this+" failed",t);
+        } finally {
+            SecurityContextHolder.clearContext();
         }
     }
 

core/src/main/resources/lib/hudson/executors.jelly

@@ -95,9 +95,18 @@ THE SOFTWARE.
 	          </j:when>
 	          <j:otherwise>
 	            <td class="pane">
-	              <div nowrap="true">${%Building} <a href="${rootURL}/${e.currentExecutable.url}">${e.currentExecutable}</a></div>
-                <t:buildProgressBar build="${e.currentExecutable}"/>
-	            </td>
+                <div nowrap="true">${%Building}
+                  <j:choose>
+                    <j:when test="${h.hasPermission(e.currentExecutable.parent,e.currentExecutable.parent.READ)}">
+                      <a href="${rootURL}/${e.currentExecutable.url}">${e.currentExecutable}</a>
+                      <t:buildProgressBar build="${e.currentExecutable}"/>
+                    </j:when>
+                    <j:otherwise>
+                      <span>${%Unknown Task}</span>
+                    </j:otherwise>
+                  </j:choose>
+                </div>
+              </td>
 	            <td class="pane" align="center" valign="middle">
                 <j:if test="${e.hasStopPermission()}">
                   <a href="${rootURL}/computers/${cloop.index}/executors/${eloop.index}/stop"><img src="${imagesURL}/16x16/stop.gif" alt="${%terminate this build}" /></a>

core/src/main/resources/lib/hudson/project/upstream-downstream.jelly

@@ -35,30 +35,25 @@ THE SOFTWARE.
         </a>
       </j:if>
     </d:tag>
+
+    <d:tag name="list"> <!-- @title and @items -->
+      <j:if test="${!empty(items)}">
+        <h2>${title}</h2>
+        <ul style="list-style-type: none;">
+          <j:forEach var="item" items="${items}">
+          <j:if test="${h.hasPermission(item,item.READ)}">
+            <li>
+              <t:jobLink job="${item}"/>
+              <local:relationship lhs="${item}" rhs="${it}"/>
+            </li>
+            </j:if>
+          </j:forEach>
+        </ul>
+      </j:if>
+    </d:tag>
   </d:taglib>
 
   <j:set var="upstream" value="${it.upstreamProjects}" />
-  <j:if test="${!empty(upstream)}">
-    <h2>${%Upstream Projects}</h2>
-    <ul style="list-style-type: none;">
-      <j:forEach var="item" items="${upstream}">
-        <li>
-          <t:jobLink job="${item}"/>
-          <local:relationship lhs="${item}" rhs="${it}"/>
-        </li>
-      </j:forEach>
-    </ul>
-  </j:if>
-  <j:set var="downstream" value="${it.downstreamProjects}" />
-  <j:if test="${!empty(downstream)}">
-    <h2>${%Downstream Projects}</h2>
-    <ul style="list-style-type: none;">
-      <j:forEach var="item" items="${downstream}">
-        <li>
-          <t:jobLink job="${item}"/>
-          <local:relationship lhs="${it}" rhs="${item}"/>
-        </li>
-      </j:forEach>
-    </ul>
-  </j:if>
+  <local:list title="${%Upstream Projects}" items="${it.upstreamProjects}" />
+  <local:list title="${%Downstream Projects}" items="${it.downstreamProjects}" />
 </j:jelly>
\ No newline at end of file

core/src/main/resources/lib/hudson/queue.jelly

@@ -57,11 +57,18 @@ THE SOFTWARE.
         <j:forEach var="item" items="${items}">
           <tr>
             <td class="pane" width="100%" tooltip="${item.why}" style="white-space: normal;">
-              <j:set var="stuck" value="${item.isStuck()}" />
-              <a href="${rootURL}/${item.task.url}" style="${stuck?'color:#ef2929':null}">
-                ${item.task.fullDisplayName}
-                <j:if test="${stuck}"> (${%appears to be stuck})</j:if>
-              </a>
+              <j:set var="stuck" value="${item.isStuck()}"/>
+              <j:choose>
+                <j:when test="${h.hasPermission(item.task,item.task.READ)}">
+                  <a href="${rootURL}/${item.task.url}" style="${stuck?'color:#ef2929':null}">
+                    ${item.task.fullDisplayName}
+                    <j:if test="${stuck}">(${%appears to be stuck})</j:if>
+                  </a>
+                </j:when>
+                <j:otherwise>
+                  <span>${%Unknown Task}</span>
+                </j:otherwise>
+              </j:choose>
             </td>
             <td class="pane" width="16" align="center" valign="middle">
               <j:if test="${item.hasCancelPermission()}">