[JENKINS-31661] Check the root url (Admin monitor + Wizard) #3082

Wadeck · 2017-10-13T15:54:17Z

The problem is that the application has some little issues when there is no rootURL configured. Example: JENKINS-47426.
Normally with the Setup Wizard, this should not be the case. But there are some exceptions like development instance, administrator that disabled the wizard or if the administrator simply clear the root URL in the config.

There was already a PR (#1921) for the issue but as the PR went too far in the correction it was not merged (as I understand). This PR focuses only on the monitor part.

See JENKINS-31661.

Proposed changelog entries

Add administrative monitor to check the configuration of the root URL
Add a new page in the Wizard to let the administrator configure the root URL
Add an additional option in HttpResponses for sending an error.

Submitter checklist

JIRA issue is well described
Changelog entry appropriate for the audience affected by the change (users or developer, depending on the change). Examples
* Use the Internal: prefix if the change has no user-visible impact (API, test frameworks, etc.)
Appropriate autotests or explanation to why this change has no tests

Desired reviewers

@reviewbybees @oleg-nenashev @amuniz

Screenshot

ghost · 2017-10-13T16:00:37Z

This pull request originates from a CloudBees employee. At CloudBees, we require that all pull requests be reviewed by other CloudBees employees before we seek to have the change accepted. If you want to learn more about our process please see this explanation.

oleg-nenashev

🐛 The error messages are inversed in the tests. It should be fixed. The rest is fine IMHO.

oleg-nenashev · 2017-10-15T07:39:37Z

core/src/main/java/jenkins/diagnostics/RootUrlNotSetMonitor.java

+ * Normally this root URL is set during SetupWizard phase, this monitor is there to ensure that behavior.
+ * Potential exceptions are the dev environment, if someone disable the wizard or
+ * the administrator put an empty string on the configuration page.
+ */


@since may be useful here though not strictly required

oleg-nenashev · 2017-10-15T07:40:12Z

core/src/main/resources/jenkins/diagnostics/Messages.properties

@@ -1,3 +1,4 @@
 CompletedInitializationMonitor.DisplayName=Jenkins Initialization Monitor
 SecurityIsOffMonitor.DisplayName=Disabled Security
 URICheckEncodingMonitor.DisplayName=Check URI Encoding
+RootUrlNotSetMonitor.DisplayName=Root URL configured Monitor


"not" is missing somewhere, I'd guess

oleg-nenashev · 2017-10-15T07:42:23Z

test/src/test/java/jenkins/diagnostics/RootUrlNotSetMonitorTest.java

+        assertTrue(StringUtils.isNotBlank(JenkinsLocationConfiguration.get().getUrl()));
+
+        RootUrlNotSetMonitor monitor = j.jenkins.getExtensionList(AdministrativeMonitor.class).get(RootUrlNotSetMonitor.class);
+        assertFalse("Monitor must be activated", monitor.isActivated());


"not be activated"

oleg-nenashev · 2017-10-15T07:42:32Z

test/src/test/java/jenkins/diagnostics/RootUrlNotSetMonitorTest.java

+        JenkinsLocationConfiguration.get().setUrl(null);
+
+        RootUrlNotSetMonitor monitor = j.jenkins.getExtensionList(AdministrativeMonitor.class).get(RootUrlNotSetMonitor.class);
+        assertTrue("Monitor must not be activated", monitor.isActivated());


"must be activated"

oleg-nenashev · 2017-10-15T07:42:59Z

test/src/test/java/jenkins/diagnostics/RootUrlNotSetMonitorTest.java

+    @Test
+    @Issue("JENKINS-31661")
+    public void testWithRootUrl_configured() {
+        assertTrue(StringUtils.isNotBlank(JenkinsLocationConfiguration.get().getUrl()));


The test relies on the default JTH behavior. Maybe it makes sense to mention it

good point :)

oleg-nenashev

🐝

oleg-nenashev · 2017-10-15T11:31:23Z

@reviewbybees not do-ne

edit: to show it in PR list to review

daniel-beck · 2017-10-20T12:38:03Z

I just tried with the PR build: Going through the setup wizard leaves Jenkins without a defined root URL.

While I think this admin monitor is a good idea, Jenkins should not be showing warnings (other than "newer Jenkins is available") to someone who just went through the setup wizard.

For that reason, I strongly disagree with merging this change as is. The setup wizard should be extended to allow defining a Jenkins URL (or could perhaps infer one from the URL used to access Jenkins in the setup wizard, similar to how the form field determines its default value?).

Only then would this change make sense.

daniel-beck

See previous comment; this does not make sense if the setup wizard leaves the root URL undefined.

Wadeck · 2017-10-25T15:34:54Z

~~Werk in progress for the modification in the SetupWizard flow. Under the panel which contain the admin user creation form, I added the new field for RootURL.~~

Screenshot of the initial proposed version

Wadeck · 2017-10-26T08:23:52Z

@kzantow do you have time to review those modifications ?
@daniel-beck as requested, the field is proposed during setup, so if you finish the Setup, the root URL will be set.

oleg-nenashev · 2017-10-26T08:25:02Z

@Wadeck After "werk in progress" I rather expected to see a German translation :D

oleg-nenashev · 2017-10-26T08:27:54Z

I am a bit aware about the "Proceed as current admin" hyperlink. If I click this button, will the local URL change be applied?

P.S: I would be happy to remove this button at all. It causes too many issues with unintended clicks

Wadeck · 2017-10-26T13:31:54Z

@oleg-nenashev Yes, I put my "save action" for both the skip and save first user. And as it's a button and not a link, no risk to see anybody doing some ctrl+click or right-click open in a new tab, etc. So normally it should be called all the time.

Predates major changes.

jglick · 2017-10-27T19:30:04Z

core/src/main/java/jenkins/diagnostics/RootUrlNotSetMonitor.java

+    @Override
+    public boolean isActivated() {
+        JenkinsLocationConfiguration loc = JenkinsLocationConfiguration.get();
+        return loc == null || loc.getUrl() == null;


#2935 forces the null check (so #3021 does not save us here), but if it is null, we should just do nothing because Jenkins has not even started up yet anyway. Thus

return loc != null && loc.getUrl() == null;

thank you for the information

jglick · 2017-10-27T19:31:20Z

core/src/main/java/jenkins/install/SetupWizard.java

+        Jenkins j = Jenkins.getInstance();
+        j.checkPermission(Jenkins.ADMINISTER);
+
+        String rootUrl = req.getParameter("rootUrl");


Just replace the current method parameters with

@QueryParameter String rootUrl

nice feature 👍

jglick · 2017-10-27T19:33:50Z

core/src/main/resources/jenkins/install/SetupWizard/setupWizardFirstUser.jelly

@@ -44,6 +51,29 @@
          <script>
            $('username').focus();
          </script>
+       </form>
+       <form action="${rootURL}/setupWizard/configureRootUrl" class="root-url no-json" method="post">


saveRootUrl specifies the URL to post to, so I suspect action and method could just be deleted.

jglick · 2017-10-27T19:34:07Z

core/src/main/resources/jenkins/install/SetupWizard/setupWizardFirstUser.properties

+Create\ First\ Admin\ User=Create First Admin User
+Other\ Configuration=Other Configuration
+Jenkins\ URL=Jenkins URL


trailing newlines please

corrected (also for FR translation)

jglick · 2017-10-27T19:34:43Z

test/src/test/java/jenkins/diagnostics/RootUrlNotSetMonitorTest.java

+    @Test
+    @Issue("JENKINS-31661")
+    public void testWithRootUrl_notConfigured() {
+        JenkinsLocationConfiguration.get().setUrl(null);


Could be merged into the preceding test, save a Jenkins startup.

oleg-nenashev

I do not see any obvious issues in the code

dwnusbaum

Small comments about some of the wording but looks fine to me in general.

I am somewhat against adding a new dependency but if new URL(input).toURI() is totally inadequate then I am ok with it.

dwnusbaum · 2018-04-02T14:34:00Z

core/src/main/java/jenkins/util/UrlHelper.java

+import java.net.URL;
+
+public class UrlHelper {
+    public static boolean isValid(String url){


If something basic like the following catches most potential errors then I would be inclined to use it instead of adding a new dependency. Either way I think this class should be @Restricted(NoExternalUse.class).

public static String isValidUrl(String url) { try { URL url = new URL(url); url.toURI(); } catch (MalformedURLException | URISyntaxException e) { return e.getMessage(); } return null; }

Since this is really just intended to help the admin so I would err on the side of allowing invalid URLs rather than disallowing valid URLs.

Annotation added.

For the second point, actually only the Wizard and the admin monitors are asking for valid URL. But in case you have a very weird URL that is not considered valid for this helper, you can still use it in the configuration page, no check are done there. You will "just" have to disable the admin monitor.

dwnusbaum · 2018-04-02T14:34:22Z

core/src/main/java/hudson/util/HttpResponses.java

+     *
+     * @since TODO
+     */
+    public static HttpResponse errorJSON(@Nonnull String message, @Nonnull Map<?,?> data) {


nit: Since you are making this public I think it would make sense to go ahead and add methods for the other JSONObjectResponse constructors (JSONObject and JSONArray) for consistency with okJSON. Probably better to handle in another PR though.

Needs corresponding proposed changelog entry.

dwnusbaum · 2018-04-02T14:44:48Z

core/src/main/resources/jenkins/install/Messages.properties

+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+SetupWizard_ConfigureInstance_ValidationErrors=Some data are not valid, please look at the error messages close to the concerned fields


I might reword this from "Some data are not valid, please look at the error messages close the concerned fields" to "Some settings are invalid. See the error messages for details". Then I would get rid of the next message and just reuse this one.

dwnusbaum · 2018-04-02T14:49:20Z

core/src/main/resources/jenkins/install/Messages.properties

+SetupWizard_ConfigureInstance_ValidationErrors=Some data are not valid, please look at the error messages close to the concerned fields
+SetupWizard_ConfigureInstance_ProcessingErrors=Some data were not processed correctly, please look at the error messages close to the concerned fields
+SetupWizard_ConfigureInstance_RootUrl_Empty=The URL cannot be empty
+SetupWizard_ConfigureInstance_RootUrl_Invalid=The URL is invalid, please ensure you are using http:// or http:// with a valid domain.


I think you are missing an s in one of the http:// references.

daniel-beck · 2018-04-04T11:14:53Z

core/pom.xml

+    <dependency>
+      <groupId>commons-validator</groupId>
+      <artifactId>commons-validator</artifactId>
+      <version>1.6</version>


Could we get this without adding a dependency that will be available to dependent plugins? E.g. integrate the relevant class into Jenkins with @Restricted?

To clarify, this really should be addressed.

👍 addressed, 4 classes included with @Restricted

daniel-beck · 2018-04-04T11:15:24Z

core/src/main/java/hudson/util/HttpResponses.java

+     *
+     * @since TODO
+     */
+    public static HttpResponse errorJSON(@Nonnull String message, @Nonnull Map<?,?> data) {


Needs corresponding proposed changelog entry.

daniel-beck · 2018-04-04T11:15:53Z

core/src/main/java/jenkins/install/InstallState.java

+     * Please DO NOT ADD ITEM TO THIS LIST. <p>
+     * If you add an item here, the deserialization process will break 
+     * because it is used for serialized state like "jenkins.install.InstallState$4" 
+     * before the change from anonymous class to named class. If you need to add a new InstallState, you can just add a new inner named class but nothing to change in this list.


CC @jglick for confirmation, looks good but to be sure.

daniel-beck · 2018-04-04T11:18:26Z

core/src/main/resources/jenkins/install/SetupWizard/authenticate-security-token.jelly

+<!--
+The MIT License
+
+Copyright (c) 2018, CloudBees, Inc.


Not actually true?

I think I added the header to the wrong file -.-

daniel-beck · 2018-04-04T11:18:39Z

core/src/main/resources/jenkins/install/SetupWizard/setupWizardConfigureInstance.jelly

@@ -0,0 +1,101 @@
+


Missing license header.

daniel-beck · 2018-04-04T11:21:01Z

Manually tested behavior looks good.

I'm on-holding this for another week though due to the upcoming core security update. I don't think the risk here is huge, but it's still a substantial change.

obsolete

kuisathaverat

LGTM

…r:1.6

dwnusbaum

Looks good to me. Maybe the imported classes could be moved into a different package since jenkins.org.blah is a little weird but I don't feel strongly about it.

Wadeck · 2018-04-09T07:42:32Z

Maybe the imported classes could be moved into a different package...

@dwnusbaum it was based on the same concept as used in hudson/org/apache/tools/tar/TarInputStream.java

Wadeck · 2018-04-12T11:46:53Z

@daniel-beck are we good with this one ?

daniel-beck · 2018-04-17T19:25:20Z

To be merged later this week.

dwnusbaum · 2018-04-19T15:33:43Z

@reviewbybees done

jglick · 2018-06-01T17:42:27Z

core/src/main/resources/jenkins/install/SetupWizard/setupWizardConfigureInstance.jelly

+            $('root-url').focus();
+            (function setInitialRootUrlFieldValue(){
+              var iframeUrl = window.location.href;
+              var iframeRelativeUrl = '/setupWizard/setupWizardConfigureInstance';


Wrong! This strips the trailing slash, which is required. JENKINS-51660

oleg-nenashev · 2018-06-01T17:46:19Z

@jglick a follow-up PR would be much appreciated

Wadeck · 2018-06-01T18:24:19Z

Due to Jenkins:2247 for read and JenkinsLocationConfiguration:123 for write it does not seem to have a real impact.

Related change: #3474

Wadeck self-assigned this Oct 13, 2017

Wadeck added the needs-more-reviews Complex change, which would benefit from more eyes label Oct 13, 2017

oleg-nenashev requested changes Oct 15, 2017

View reviewed changes

oleg-nenashev added needs-comments-resolved Comments in the PR need to be addressed before it can be considered for merging and removed needs-more-reviews Complex change, which would benefit from more eyes labels Oct 15, 2017

oleg-nenashev previously approved these changes Oct 15, 2017

View reviewed changes

oleg-nenashev added needs-more-reviews Complex change, which would benefit from more eyes and removed needs-comments-resolved Comments in the PR need to be addressed before it can be considered for merging labels Oct 15, 2017

daniel-beck self-requested a review October 15, 2017 16:40

oleg-nenashev added ready-for-merge The PR is ready to go, and it will be merged soon if there is no negative feedback and removed needs-more-reviews Complex change, which would benefit from more eyes labels Oct 19, 2017

daniel-beck self-assigned this Oct 19, 2017

daniel-beck previously requested changes Oct 20, 2017

View reviewed changes

Wadeck added work-in-progress The PR is under active development, not ready to the final review and removed ready-for-merge The PR is ready to go, and it will be merged soon if there is no negative feedback labels Oct 20, 2017

Wadeck added needs-more-reviews Complex change, which would benefit from more eyes and removed work-in-progress The PR is under active development, not ready to the final review labels Oct 26, 2017

jglick self-requested a review October 26, 2017 22:23

jglick approved these changes Oct 27, 2017

View reviewed changes

oleg-nenashev previously approved these changes Oct 28, 2017

View reviewed changes

dwnusbaum approved these changes Apr 2, 2018

View reviewed changes

address Devin's comments

f6321dc

Wadeck added a commit to Wadeck/jenkins that referenced this pull request Apr 3, 2018

Modification after comment from Devin in jenkinsci#3082

0c147b9

Wadeck mentioned this pull request Apr 3, 2018

Developer API: Add new HttpResponses#errorJSON() methods #3379

Merged

dwnusbaum approved these changes Apr 3, 2018

View reviewed changes

daniel-beck reviewed Apr 4, 2018

View reviewed changes

daniel-beck added the on-hold This pull request depends on another event/release, and it cannot be merged right now label Apr 4, 2018

correct header files

494755b

kuisathaverat approved these changes Apr 5, 2018

View reviewed changes

Wadeck added 2 commits April 6, 2018 09:52

include relevant classes for the url validation from commons-validato…

cf6d349

…r:1.6

Move Apache classes in a more standard package

dc2f432

dwnusbaum approved these changes Apr 6, 2018

View reviewed changes

daniel-beck removed the on-hold This pull request depends on another event/release, and it cannot be merged right now label Apr 10, 2018

daniel-beck self-requested a review April 10, 2018 11:49

daniel-beck approved these changes Apr 12, 2018

View reviewed changes

dwnusbaum added ready-for-merge The PR is ready to go, and it will be merged soon if there is no negative feedback and removed needs-more-reviews Complex change, which would benefit from more eyes labels Apr 16, 2018

daniel-beck merged commit 17b94a0 into jenkinsci:master Apr 26, 2018

daniel-beck removed the ready-for-merge The PR is ready to go, and it will be merged soon if there is no negative feedback label Apr 26, 2018

dwnusbaum mentioned this pull request May 4, 2018

[JENKINS-51064] Lenient URL validator for Root URL #3415

Merged

3 tasks

jglick reviewed Jun 1, 2018

View reviewed changes

jglick mentioned this pull request Jan 13, 2020

[JENKINS-60750] Skip CONFIGURE_INSTANCE panel when root URL is set during skipFirstUser #4430

Merged

[JENKINS-31661] Check the root url (Admin monitor + Wizard) #3082

[JENKINS-31661] Check the root url (Admin monitor + Wizard) #3082

Conversation

Wadeck commented Oct 13, 2017 • edited Loading

Proposed changelog entries

Submitter checklist

Desired reviewers

Screenshot

ghost commented Oct 13, 2017

oleg-nenashev left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oleg-nenashev left a comment

Choose a reason for hiding this comment

oleg-nenashev commented Oct 15, 2017 • edited by Wadeck Loading

daniel-beck commented Oct 20, 2017

daniel-beck left a comment

Choose a reason for hiding this comment

Wadeck commented Oct 25, 2017 • edited Loading

Wadeck commented Oct 26, 2017

oleg-nenashev commented Oct 26, 2017

oleg-nenashev commented Oct 26, 2017

Wadeck commented Oct 26, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oleg-nenashev left a comment

Choose a reason for hiding this comment

dwnusbaum left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

daniel-beck commented Apr 4, 2018

kuisathaverat left a comment

Choose a reason for hiding this comment

dwnusbaum left a comment

Choose a reason for hiding this comment

Wadeck commented Apr 9, 2018 • edited Loading

Wadeck commented Apr 12, 2018

daniel-beck commented Apr 17, 2018

dwnusbaum commented Apr 19, 2018

Choose a reason for hiding this comment

oleg-nenashev commented Jun 1, 2018

Wadeck commented Jun 1, 2018 • edited Loading

Wadeck commented Oct 13, 2017 •

edited

Loading

oleg-nenashev commented Oct 15, 2017 •

edited by Wadeck

Loading

Wadeck commented Oct 25, 2017 •

edited

Loading

Wadeck commented Oct 26, 2017 •

edited

Loading

Wadeck commented Apr 9, 2018 •

edited

Loading

Wadeck commented Jun 1, 2018 •

edited

Loading