From 7afb488987fbb25771f9008aeaaced47adb4f9c1 Mon Sep 17 00:00:00 2001 From: kohsuke Date: Mon, 20 Apr 2009 17:19:21 +0000 Subject: [PATCH] [FIXED HUDSON-2324] applied a patch. I tweaked the patch slightly so that all the background activity gets SYSTEM credential automatically. I think this is less error prone for plugin developers. This change will be in 1.301. git-svn-id: https://hudson.dev.java.net/svn/hudson/trunk/hudson/main@17297 71c3de6d-444a-0410-be80-ed276b4c234a --- core/src/main/java/hudson/model/Hudson.java | 37 ++++++++++++++--- core/src/main/java/hudson/model/Item.java | 1 + .../java/hudson/triggers/SafeTimerTask.java | 10 +++++ .../main/resources/lib/hudson/executors.jelly | 15 +++++-- .../hudson/project/upstream-downstream.jelly | 41 ++++++++----------- .../src/main/resources/lib/hudson/queue.jelly | 17 +++++--- 6 files changed, 85 insertions(+), 36 deletions(-) diff --git a/core/src/main/java/hudson/model/Hudson.java b/core/src/main/java/hudson/model/Hudson.java index ccd3ddc947..624d33f7d6 100644 --- a/core/src/main/java/hudson/model/Hudson.java +++ b/core/src/main/java/hudson/model/Hudson.java @@ -470,6 +470,9 @@ public final class Hudson extends Node implements ItemGroup, Stapl private transient final LogRecorderManager log = new LogRecorderManager(); public Hudson(File root, ServletContext context) throws IOException { + //as hudson is starting, grant this process full controll + SecurityContextHolder.getContext().setAuthentication(ACL.SYSTEM); + this.root = root; this.servletContext = context; computeVersion(context); @@ -998,7 +1001,18 @@ public final class Hudson extends Node implements ItemGroup, Stapl */ @Exported(name="jobs") public List getItems() { - return new ArrayList(items.values()); + List viewableItems = new ArrayList(); + for (TopLevelItem item : items.values()) { + if (item instanceof AccessControlled) { + if (((AccessControlled)item).hasPermission(Item.READ)) + viewableItems.add(item); + } + else { + viewableItems.add(item); + } + } + + return viewableItems; } /** @@ -1017,7 +1031,7 @@ public final class Hudson extends Node implements ItemGroup, Stapl */ public List getItems(Class type) { List r = new ArrayList(); - for (TopLevelItem i : items.values()) + for (TopLevelItem i : getItems()) if (type.isInstance(i)) r.add(type.cast(i)); return r; @@ -1036,8 +1050,15 @@ public final class Hudson extends Node implements ItemGroup, Stapl while(!q.isEmpty()) { ItemGroup parent = q.pop(); for (Item i : parent.getItems()) { - if(type.isInstance(i)) - r.add(type.cast(i)); + if(type.isInstance(i)) { + if (i instanceof AccessControlled) { + if (((AccessControlled)i).hasPermission(Item.READ)) + r.add(type.cast(i)); + } + else { + r.add(type.cast(i)); + } + } if(i instanceof ItemGroup) q.push((ItemGroup)i); } @@ -1646,7 +1667,13 @@ public final class Hudson extends Node implements ItemGroup, Stapl * Note that the look up is case-insensitive. */ public TopLevelItem getItem(String name) { - return items.get(name); + TopLevelItem item = items.get(name); + if (item instanceof AccessControlled) { + if (!((AccessControlled) item).hasPermission(Item.READ)) { + return null; + } + } + return item; } public File getRootDirFor(TopLevelItem child) { diff --git a/core/src/main/java/hudson/model/Item.java b/core/src/main/java/hudson/model/Item.java index 46e2c3cce9..428023226d 100644 --- a/core/src/main/java/hudson/model/Item.java +++ b/core/src/main/java/hudson/model/Item.java @@ -190,6 +190,7 @@ public interface Item extends PersistenceRoot, SearchableModelObject, AccessCont public static final Permission CREATE = new Permission(PERMISSIONS,"Create", Permission.CREATE); public static final Permission DELETE = new Permission(PERMISSIONS,"Delete", Permission.DELETE); public static final Permission CONFIGURE = new Permission(PERMISSIONS,"Configure", Permission.CONFIGURE); + public static final Permission READ = new Permission(PERMISSIONS,"Read", Permission.READ); public static final Permission BUILD = new Permission(PERMISSIONS, "Build", Messages._AbstractProject_BuildPermission_Description(), Permission.UPDATE); public static final Permission WORKSPACE = new Permission(PERMISSIONS, "Workspace", Messages._AbstractProject_WorkspacePermission_Description(), Permission.READ); } diff --git a/core/src/main/java/hudson/triggers/SafeTimerTask.java b/core/src/main/java/hudson/triggers/SafeTimerTask.java index 7435a8b65c..b1f94f09d0 100644 --- a/core/src/main/java/hudson/triggers/SafeTimerTask.java +++ b/core/src/main/java/hudson/triggers/SafeTimerTask.java @@ -23,11 +23,15 @@ */ package hudson.triggers; +import org.acegisecurity.context.SecurityContextHolder; + import java.util.Timer; import java.util.TimerTask; import java.util.logging.Logger; import java.util.logging.Level; +import hudson.security.ACL; + /** * {@link Timer} wrapper so that a fatal error in {@link TimerTask} * won't terminate the timer. @@ -42,10 +46,16 @@ import java.util.logging.Level; */ public abstract class SafeTimerTask extends TimerTask { public final void run() { + // background activity gets system credential, + // just like executors get it. + SecurityContextHolder.getContext().setAuthentication(ACL.SYSTEM); + try { doRun(); } catch(Throwable t) { LOGGER.log(Level.SEVERE, "Timer task "+this+" failed",t); + } finally { + SecurityContextHolder.clearContext(); } } diff --git a/core/src/main/resources/lib/hudson/executors.jelly b/core/src/main/resources/lib/hudson/executors.jelly index 59d990068b..d40166e9a7 100644 --- a/core/src/main/resources/lib/hudson/executors.jelly +++ b/core/src/main/resources/lib/hudson/executors.jelly @@ -95,9 +95,18 @@ THE SOFTWARE. - - - +
${%Building} + + + ${e.currentExecutable} + + + + ${%Unknown Task} + + +
+ ${%terminate this build} diff --git a/core/src/main/resources/lib/hudson/project/upstream-downstream.jelly b/core/src/main/resources/lib/hudson/project/upstream-downstream.jelly index 393217f0f3..2a1c3c4b4b 100644 --- a/core/src/main/resources/lib/hudson/project/upstream-downstream.jelly +++ b/core/src/main/resources/lib/hudson/project/upstream-downstream.jelly @@ -35,30 +35,25 @@ THE SOFTWARE. + + + +

${title}

+
    + + +
  • + + +
    • +     +     +
+ + - -

${%Upstream Projects}

-
    - -
  • - - -
    • -     -
- - - -

${%Downstream Projects}

-
    - -
  • - - -
    • -     -
- + + \ No newline at end of file diff --git a/core/src/main/resources/lib/hudson/queue.jelly b/core/src/main/resources/lib/hudson/queue.jelly index 67f4480aad..e50114408c 100644 --- a/core/src/main/resources/lib/hudson/queue.jelly +++ b/core/src/main/resources/lib/hudson/queue.jelly @@ -57,11 +57,18 @@ THE SOFTWARE. - - - ${item.task.fullDisplayName} - (${%appears to be stuck}) - + + + + + ${item.task.fullDisplayName} + (${%appears to be stuck}) + + + + ${%Unknown Task} + + -- GitLab