FIX : SECURITY-3122

src/main/java/com/jenkins/testresultsaggregator/TestResultsAggregator.java

@@ -20,6 +20,7 @@
 import org.kohsuke.stapler.DataBoundSetter;
 import org.kohsuke.stapler.QueryParameter;
 import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 import com.google.common.base.Strings;
 import com.jenkins.testresultsaggregator.data.Aggregated;
@@ -49,6 +50,7 @@
 import hudson.util.FormValidation;
 import hudson.util.Secret;
 import hudson.util.VariableResolver;
+import jenkins.model.Jenkins;
 import jenkins.tasks.SimpleBuildStep;
 import net.sf.json.JSONObject;
 
@@ -385,7 +387,10 @@ public FormValidation doCheckOutOfDateResults(@QueryParameter final String outOf
 			}
 		}
 
+		@RequirePOST
 		public FormValidation doTestApiConnection(@QueryParameter final String jenkinsUrl, @QueryParameter final String username, @QueryParameter final Secret password) {
+			// https://www.jenkins.io/doc/developer/security/form-validation/
+			Jenkins.get().checkPermission(Jenkins.ADMINISTER);
 			try {
 				new Collector(null, username, password, jenkinsUrl).getAPIConnection();
 				return FormValidation.ok(LocalMessages.SUCCESS.toString());