Skip to content
Permalink
Browse files
Fix [JENKINS-48998] by ensuring admins can always approve
  • Loading branch information
svanoort committed Jan 17, 2018
1 parent 7aea2ab commit 6448d8c8dce70064a0b6792e541c3a7edd099486
@@ -16,6 +16,7 @@
import hudson.model.TaskListener;
import hudson.model.User;
import hudson.security.ACL;
import hudson.security.Permission;
import hudson.util.HttpResponses;
import jenkins.model.Jenkins;
import net.sf.json.JSONArray;
@@ -282,7 +283,7 @@ private void postSettlement() {
}

private boolean canCancel() {
return getRun().getParent().hasPermission(Job.CANCEL);
return !Jenkins.getInstance().isUseSecurity() || getRun().getParent().hasPermission(Job.CANCEL);
}

private boolean canSubmit() {
@@ -297,6 +298,9 @@ private boolean canSettle(Authentication a) {
String submitter = input.getSubmitter();
if (submitter==null)
return getRun().getParent().hasPermission(Job.BUILD);
if (!Jenkins.getInstance().isUseSecurity() || Jenkins.getInstance().hasPermission(Jenkins.ADMINISTER)) {
return true;
}
final Set<String> submitters = Sets.newHashSet(submitter.split(","));
if (submitters.contains(a.getName()))
return true;
@@ -207,14 +207,17 @@ public void test_submitters() throws Exception {
// is listed as the submitter.
grant(Jenkins.READ, Job.READ).everywhere().to("bob").
// Give "charlie" basic privs. That's normally not enough to Job.CANCEL, and isn't listed as submiter.
grant(Jenkins.READ, Job.READ).everywhere().to("charlie"));
grant(Jenkins.READ, Job.READ).everywhere().to("charlie").
// Add an admin user that should be able to approve the job regardless)
grant(Jenkins.ADMINISTER).everywhere().to("admin"));

final WorkflowJob foo = j.jenkins.createProject(WorkflowJob.class, "foo");
foo.setDefinition(new CpsFlowDefinition("input id: 'InputX', message: 'OK?', ok: 'Yes', submitter: 'alice,bob'", true));

runAndAbort(webClient, foo, "alice", true); // alice should work coz she's declared as 'submitter'
runAndAbort(webClient, foo, "bob", true); // bob should work coz he's declared as 'submitter'
runAndAbort(webClient, foo, "charlie", false); // charlie shouldn't work coz he's not declared as 'submitter' and doesn't have Job.CANCEL privs
runAndContinue(webClient, foo, "admin", true); // admin should work because... they can do anything
}

@Test

0 comments on commit 6448d8c

Please sign in to comment.