Merge pull request #11 from jglick/Owner-ACL-JENKINS-34281

[JENKINS-34281] More general fix of CpsFlowExecution.suspendAll ACL bug

src/main/java/org/jenkinsci/plugins/workflow/job/WorkflowRun.java

@@ -52,6 +52,7 @@
 import hudson.scm.ChangeLogSet;
 import hudson.scm.SCM;
 import hudson.scm.SCMRevisionState;
+import hudson.security.ACL;
 import hudson.util.Iterators;
 import hudson.util.NullStream;
 import hudson.util.PersistedList;
@@ -83,6 +84,7 @@
 import jenkins.model.lazy.BuildReference;
 import jenkins.model.lazy.LazyBuildMixIn;
 import jenkins.model.queue.AsynchronousExecution;
+import jenkins.security.NotReallyRoleSensitiveCallable;
 import jenkins.util.Timer;
 import org.jenkinsci.plugins.workflow.actions.LogAction;
 import org.jenkinsci.plugins.workflow.actions.ThreadNameAction;
@@ -706,11 +708,15 @@ private String key() {
                 if (candidate != null && candidate.getParent().getFullName().equals(job) && candidate.getId().equals(id)) {
                     run = candidate;
                 } else {
-                    Jenkins jenkins = Jenkins.getInstance();
+                    final Jenkins jenkins = Jenkins.getInstance();
                     if (jenkins == null) {
                         throw new IOException("Jenkins is not running"); // do not use Jenkins.getActiveInstance() as that is an ISE
                     }
-                    WorkflowJob j = jenkins.getItemByFullName(job, WorkflowJob.class);
+                    WorkflowJob j = ACL.impersonate(ACL.SYSTEM, new NotReallyRoleSensitiveCallable<WorkflowJob,IOException>() {
+                        @Override public WorkflowJob call() throws IOException {
+                            return jenkins.getItemByFullName(job, WorkflowJob.class);
+                        }
+                    });
                     if (j == null) {
                         throw new IOException("no such WorkflowJob " + job);
                     }