Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WiP] minor changes for Workflow support #61

Closed
wants to merge 8 commits into from
Closed

[WiP] minor changes for Workflow support #61

wants to merge 8 commits into from

Conversation

ndeloof
Copy link
Contributor

@ndeloof ndeloof commented Mar 3, 2015

Let user rely on snippet generator to use copyartifact build step

@ndeloof ndeloof changed the title minor change for Workflow support [WIP] minor change for Workflow support Mar 3, 2015
@jenkinsadmin
Copy link
Member

Thank you for a pull request! Please check this document for how the Jenkins project handles pull requests

@ndeloof ndeloof changed the title [WIP] minor change for Workflow support minor changes for Workflow support Mar 4, 2015
@ndeloof
Copy link
Contributor Author

ndeloof commented Mar 4, 2015

@reviewbybees

@ndeloof
Copy link
Contributor Author

ndeloof commented Mar 4, 2015

not sure why CI fails a test since https://jenkins.ci.cloudbees.com/job/plugins/job/copyartifact-plugin/151/ as previous build https://jenkins.ci.cloudbees.com/job/plugins/job/copyartifact-plugin/150/ was on same commit (maven release)

@jglick
Copy link
Member

jglick commented Mar 4, 2015

I guess this is intended to follow up #55 and #59?

@@ -493,11 +498,9 @@ private boolean perform(Run src, Run<?,?> dst, String expandedFilter, String exp
public static final class DescriptorImpl extends BuildStepDescriptor<Builder> {

public FormValidation doCheckProjectName(
@AncestorInPath AbstractProject anc, @QueryParameter String value) {
// Require CONFIGURE permission on this project
if (!anc.hasPermission(Item.CONFIGURE)) return FormValidation.ok();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would be a security regression. You need to retain @AncestorInPath Job job so you can still do a permission check on it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This permission check applies to current job configuration, not the path to job the method is going to validate. This doesn't make much sense, can be arbitrary job on jenkins.
I've looked at git history to understand the intent but was imported with first commit.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What you want really do is to make doCheckProjectName applicable to WorkflowJob.
You can do that simply by replacing AbstractProject with Job.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This permission check applies to current job configuration

You misunderstand completely. The intention is to avoid doing potentially sensitive computations unless the user is actually configuring this (downstream) job. Otherwise someone can fake up a …/checkProjectName request in cURL and get some information they should not have access to based on job permissions.

As @ikedam says, just replace AbstractProject with Job.

@jglick
Copy link
Member

jglick commented Mar 4, 2015

Suggestion: if you add

      <dependency>
        <groupId>org.jenkins-ci.plugins.workflow</groupId>
        <artifactId>workflow-step-api</artifactId>
        <version>${workflow.version}</version>
        <classifier>tests</classifier>
        <scope>test</scope>
      </dependency>

then it should be possible to use StepConfigTester on a new CoreStep(new CopyArtifact(…)) to actually reproduce the buildSelector and stableOnly problems and verify the fix (as well as defending against some future regressions).

@jglick
Copy link
Member

jglick commented Mar 4, 2015

Evaluate the CopyArtifactTest.testFieldValidation failure.

There’s no need for CONFIGURE permission on job to validate a relative path to another job, just need to check READ on the target job when identified (which is addressed get getItem)
@ndeloof
Copy link
Contributor Author

ndeloof commented Mar 11, 2015

@reviewbybees ping

@ikedam
Copy link
Member

ikedam commented Mar 14, 2015

Let's make it clear what this request does.

You can test the behavior of the snippet generator in a following way:

  • Create a new workflow project
  • Select "Groovy CPS DSL" in Definition for Workflow
  • Check "Snippet generator"
  • Select "General Build Step" for "Sample Step"
  • Select "Copy artifacts from another project" for "Build Step"
  • Configure copyartifact, and click "Generate Groovy"

Result before this fix:

  • The validation for "Project name" fails with NPE.
  • The generated result is
step <object of type hudson.plugins.copyartifact.CopyArtifact>

Result after this fix:

step([$class: 'CopyArtifact', excludes: '', filter: '**/*', fingerprintArtifacts: true, flatten: false, optional: false, projectName: 'test', selector: [$class: 'StatusBuildSelector', stable: false], target: ''])

What this request does:

  • Makes CopyArtifact.DescriptorImpl#doCheckProjectName work with WorkflowJob which is a sub class not of AbstractProject but of Job.
  • Make getter names match the names of parameters in the constructor (or maybe setters with DataBoundSetter).

@ikedam ikedam mentioned this pull request Apr 25, 2015
@jglick
Copy link
Member

jglick commented May 5, 2015

What is the status of this? It is not currently mergeable.

@jglick jglick changed the title minor changes for Workflow support [WiP] minor changes for Workflow support May 5, 2015
@ikedam
Copy link
Member

ikedam commented May 10, 2015

copyartifact-1.35.1 should work with workflow's snippet generator. (fixed with #62, #63).
It will be available in a day.
Please try that.

@ikedam ikedam closed this May 10, 2015
@jglick
Copy link
Member

jglick commented May 11, 2015

The substitution of AbstractProject with Job in a couple of places is still valid, right?

@@ -132,7 +132,7 @@ public CopyArtifact(String projectName) {
// check the permissions only if we can
StaplerRequest req = Stapler.getCurrentRequest();
if (req!=null) {
AbstractProject<?,?> p = req.findAncestorObject(AbstractProject.class);
Job p = req.findAncestorObject(Job.class);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This (and only this) change isn't applied in 1.35.1 as @jglick points.
JENKINS-28247 may be caused for that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
4 participants