commiting fix to SECURITY-1058 (#42)

* commiting fix to SECURITY-1058 * Update src/main/java/org/jenkinsci/plugins/nomad/NomadCloud.java Co-Authored-By: aphill70 <aphill70@gmail.com> * updating per code review
jenkinsci · Apr 5, 2019 · 3331d24 · 3331d24
1 parent 6e6406e
commit 3331d24
Showing 1 changed file with 17 additions and 14 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/nomad/NomadCloud.java b/src/main/java/org/jenkinsci/plugins/nomad/NomadCloud.java
@@ -1,27 +1,26 @@
 package org.jenkinsci.plugins.nomad;
 
-import org.kohsuke.stapler.DataBoundConstructor;
-import org.kohsuke.stapler.QueryParameter;
-import hudson.Extension;
-
-import hudson.slaves.*;
-import okhttp3.OkHttpClient;
-import okhttp3.Request;
 import com.google.common.base.Optional;
 import com.google.common.base.Strings;
+import hudson.Extension;
 import hudson.model.Descriptor;
-import hudson.util.FormValidation;
 import hudson.model.Label;
 import hudson.model.Node;
+import hudson.slaves.AbstractCloudImpl;
+import hudson.slaves.NodeProperty;
+import hudson.slaves.NodeProvisioner;
+import hudson.util.FormValidation;
 import jenkins.model.Jenkins;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
+import okhttp3.OkHttpClient;
+import okhttp3.Request;
+import org.kohsuke.stapler.DataBoundConstructor;
+import org.kohsuke.stapler.QueryParameter;
+import org.kohsuke.stapler.interceptor.RequirePOST;
+
+import java.util.*;
 import java.util.concurrent.*;
 import java.util.logging.Level;
 import java.util.logging.Logger;
-
 public class NomadCloud extends AbstractCloudImpl {
 
     private static final Logger LOGGER = Logger.getLogger(NomadCloud.class.getName());
@@ -83,7 +82,7 @@ public Collection<NodeProvisioner.PlannedNode> provision(Label label, int excess
         if (template != null) {
             try {
                 while (excessWorkload > 0) {
-                    
+
                     LOGGER.log(Level.INFO, "Excess workload of " + excessWorkload + ", provisioning new Jenkins slave on Nomad cluster");
 
                     final String slaveName = template.createSlaveName();
@@ -202,7 +201,9 @@ public String getDisplayName() {
             return "Nomad";
         }
 
+        @RequirePOST
         public FormValidation doTestConnection(@QueryParameter("nomadUrl") String nomadUrl) {
+            Objects.requireNonNull(Jenkins.getInstance()).checkPermission(Jenkins.ADMINISTER);
             try {
                 Request request = new Request.Builder()
                         .url(nomadUrl + "/v1/agent/self")
@@ -217,7 +218,9 @@ public FormValidation doTestConnection(@QueryParameter("nomadUrl") String nomadU
             }
         }
 
+        @RequirePOST
         public FormValidation doCheckName(@QueryParameter String name) {
+            Objects.requireNonNull(Jenkins.getInstance()).checkPermission(Jenkins.ADMINISTER);
             if (Strings.isNullOrEmpty(name)) {
                 return FormValidation.error("Name must be set");
             } else {