Merge branch 'security-stable-2.46' into security-master

jenkinsci · Apr 15, 2017 · 745dacc · 745dacc
2 parents 3fc98a9 + 5df63bc
commit 745dacc
Show file tree

Hide file tree

Showing 13 changed files with 21 additions and 3 deletions.
diff --git a/core/src/main/java/hudson/ProxyConfiguration.java b/core/src/main/java/hudson/ProxyConfiguration.java
@@ -62,6 +62,7 @@
 import org.jvnet.robust_http_client.RetryableHttpStream;
 import org.kohsuke.stapler.DataBoundConstructor;
 import org.kohsuke.stapler.QueryParameter;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 /**
  * HTTP proxy configuration.
@@ -334,6 +335,7 @@ public FormValidation doCheckPort(@QueryParameter String value) {
             return FormValidation.ok();
         }
 
+        @RequirePOST
         public FormValidation doValidateProxy(
                 @QueryParameter("testUrl") String testUrl, @QueryParameter("name") String name, @QueryParameter("port") int port,
                 @QueryParameter("userName") String userName, @QueryParameter("password") String password,

diff --git a/core/src/main/java/hudson/lifecycle/WindowsInstallerLink.java b/core/src/main/java/hudson/lifecycle/WindowsInstallerLink.java
@@ -49,6 +49,7 @@
 import org.apache.tools.ant.Project;
 import org.apache.tools.ant.DefaultLogger;
 import org.apache.tools.ant.types.FileSet;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 import javax.servlet.ServletException;
 import java.io.File;
@@ -108,6 +109,7 @@ public boolean isInstalled() {
     /**
      * Performs installation.
      */
+    @RequirePOST
     public void doDoInstall(StaplerRequest req, StaplerResponse rsp, @QueryParameter("dir") String _dir) throws IOException, ServletException {
         if(installationDir!=null) {
             // installation already complete
@@ -169,6 +171,7 @@ private void copy(StaplerRequest req, StaplerResponse rsp, File dir, URL src, St
         }
     }
 
+    @RequirePOST
     public void doRestart(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
         if(installationDir==null) {
             // if the user reloads the page after Hudson has restarted,

diff --git a/core/src/main/java/hudson/logging/LogRecorderManager.java b/core/src/main/java/hudson/logging/LogRecorderManager.java
@@ -130,6 +130,7 @@ public ContextMenu doChildrenContextMenu(StaplerRequest request, StaplerResponse
      * Configure the logging level.
      */
     @edu.umd.cs.findbugs.annotations.SuppressFBWarnings("LG_LOST_LOGGER_DUE_TO_WEAK_REFERENCE")
+    @RequirePOST
     public HttpResponse doConfigLogger(@QueryParameter String name, @QueryParameter String level) {
         Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER);
         Level lv;

diff --git a/core/src/main/java/hudson/model/MyViewsProperty.java b/core/src/main/java/hudson/model/MyViewsProperty.java
@@ -53,6 +53,7 @@
 import org.kohsuke.stapler.StaplerFallback;
 import org.kohsuke.stapler.StaplerRequest;
 import org.kohsuke.stapler.StaplerResponse;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 /**
  * A UserProperty that remembers user-private views.
@@ -152,6 +153,7 @@ public HttpResponse doIndex() {
         return new HttpRedirect("view/" + Util.rawEncode(getPrimaryView().getViewName()) + "/");
     }
 
+    @RequirePOST
     public synchronized void doCreateView(StaplerRequest req, StaplerResponse rsp)
             throws IOException, ServletException, ParseException, FormException {
         checkPermission(View.CREATE);

diff --git a/core/src/main/java/hudson/model/TaskAction.java b/core/src/main/java/hudson/model/TaskAction.java
@@ -35,6 +35,7 @@
 
 import hudson.security.Permission;
 import hudson.security.ACL;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 /**
  * Partial {@link Action} implementation for those who kick some
@@ -137,6 +138,7 @@ public void doProgressiveHtml( StaplerRequest req, StaplerResponse rsp) throws I
     /**
      * Clears the error status.
      */
+    @RequirePOST
     public synchronized void doClearError(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
         getACL().checkPermission(getPermission());
 

diff --git a/core/src/main/java/hudson/model/UpdateSite.java b/core/src/main/java/hudson/model/UpdateSite.java
@@ -193,6 +193,7 @@ public long getDataTimestamp() {
     /**
      * This is the endpoint that receives the update center data file from the browser.
      */
+    @RequirePOST
     public FormValidation doPostBack(StaplerRequest req) throws IOException, GeneralSecurityException {
         DownloadSettings.checkPostBackAccess();
         return updateData(IOUtils.toString(req.getInputStream(),"UTF-8"), true);

diff --git a/core/src/main/java/hudson/slaves/AbstractCloudComputer.java b/core/src/main/java/hudson/slaves/AbstractCloudComputer.java
@@ -27,6 +27,7 @@
 import org.kohsuke.stapler.HttpRedirect;
 import org.kohsuke.stapler.HttpResponse;
 import org.kohsuke.stapler.HttpResponses;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 import java.io.IOException;
 import javax.annotation.CheckForNull;
@@ -53,6 +54,7 @@ public T getNode() {
      * When the agent is deleted, free the node right away.
      */
     @Override
+    @RequirePOST
     public HttpResponse doDoDelete() throws IOException {
         checkPermission(DELETE);
         try {

diff --git a/core/src/main/java/hudson/util/DoubleLaunchChecker.java b/core/src/main/java/hudson/util/DoubleLaunchChecker.java
@@ -30,6 +30,7 @@
 import org.apache.commons.io.FileUtils;
 import org.kohsuke.stapler.StaplerRequest;
 import org.kohsuke.stapler.StaplerResponse;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 import javax.servlet.ServletException;
 import javax.servlet.ServletContext;
@@ -174,6 +175,7 @@ public void doDynamic(StaplerRequest req, StaplerResponse rsp) throws IOExceptio
     /**
      * Ignore the problem and go back to using Hudson.
      */
+    @RequirePOST
     public void doIgnore(StaplerRequest req, StaplerResponse rsp) throws IOException {
         ignore = true;
         Jenkins.getInstance().servletContext.setAttribute("app", Jenkins.getInstance());

diff --git a/core/src/main/java/jenkins/diagnosis/HsErrPidFile.java b/core/src/main/java/jenkins/diagnosis/HsErrPidFile.java
@@ -4,6 +4,7 @@
 import hudson.util.HttpResponses;
 import jenkins.model.Jenkins;
 import org.kohsuke.stapler.HttpResponse;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 import java.io.File;
 import java.io.IOException;
@@ -48,6 +49,7 @@ public HttpResponse doDownload() throws IOException {
         return HttpResponses.staticResource(file);
     }
 
+    @RequirePOST
     public HttpResponse doDelete() throws IOException {
         Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER);
         file.delete();

diff --git a/core/src/main/java/jenkins/install/SetupWizard.java b/core/src/main/java/jenkins/install/SetupWizard.java
@@ -458,6 +458,7 @@ public FilePath getInitialAdminPasswordFile() {
     /**
      * Remove the setupWizard filter, ensure all updates are written to disk, etc
      */
+    @RequirePOST
     public HttpResponse doCompleteInstall() throws IOException, ServletException {
         completeSetup();
         return HttpResponses.okJSON();

diff --git a/core/src/main/resources/hudson/model/TaskAction/log.jelly b/core/src/main/resources/hudson/model/TaskAction/log.jelly
@@ -42,7 +42,7 @@ THE SOFTWARE.
         <st:getOutput var="output" />
         <j:whitespace>${it.obtainLog().writeLogTo(0,output)}</j:whitespace>
       </pre>
-      <form method="get" action="clearError">
+      <form method="post" action="clearError">
         <f:submit value="${%Clear error to retry}" />
       </form>
     </j:otherwise>

diff --git a/core/src/main/resources/hudson/util/DoubleLaunchChecker/index.jelly b/core/src/main/resources/hudson/util/DoubleLaunchChecker/index.jelly
@@ -45,7 +45,7 @@ THE SOFTWARE.
         </tr>
       </table>
       <div>
-        <form action="${rootURL}/ignore">
+        <form method="post" action="${rootURL}/ignore">
           <f:submit value="${%label}" />
         </form>
       </div>

diff --git a/war/src/main/js/api/pluginManager.js b/war/src/main/js/api/pluginManager.js
@@ -177,7 +177,7 @@ exports.incompleteInstallStatus = function(handler, correlationId) {
  * Call this to complete the installation without installing anything
  */
 exports.completeInstall = function(handler) {
-	jenkins.get('/setupWizard/completeInstall', function() {
+	jenkins.post('/setupWizard/completeInstall', {}, function() {
 		handler.call({ isError: false });
 	}, {
 		timeout: pluginManagerErrorTimeoutMillis,