Hi,

looking at hudson.model.Job#doDoRename, I notice
        // rename is essentially delete followed by a create
        checkPermission(CREATE);
        checkPermission(DELETE);


I wonder a user that can't create job but has all other permissions on job,
including CONFIGURE, can't choose a name for his job.
Would it make sense to check CONFIGURE permission on rename, not CREATE +
DELETE, or maybe a combination of them :
    if (!hasPermision(CONFIGURE)) {
        checkPermission(CREATE);
        checkPermission(DELETE);
    }

Reply via email to