Issue Type: Bug Bug
Assignee: Jesse Glick
Components: core
Created: 05/Mar/13 8:20 PM
Description:

Create an admin user with full perms, and deny all perms to anonymous; and enable CSRF protection. Now go to the Jenkins root page, click add description, type anything, and click Preview. You are greeted with

<div class="textarea-preview" style="">403 No_valid_crumb_was_included_in_the_request<hr>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Error 403 </title>

<h2>HTTP ERROR: 403</h2><pre>No valid crumb was included in the request</pre>
<p>RequestURI=/markupFormatter/previewDescription</p><p><i><small><a href="" class="code-quote">"http://jetty.mortbay.org/">Powered by Jetty://</a></small></i></p><br>
...
</div>
Environment: 1.446.2 or 1.506-SNAPSHOT
Project: Jenkins
Labels: csrf security
Priority: Major Major
Reporter: Jesse Glick
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators.
For more information on JIRA, see: http://www.atlassian.com/software/jira

--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
 
 

Reply via email to