Alright, I reviewed what's going on.

The security realm has a feature that allows the user who accesses the Jenkins home page ("/" URL) to sign up as admin if no user already exists.

A few problems:

  • The major one: The form redirects to /manage, not /, so there's a login form shown, but there are no valid credentials. Why would anyone click the Jenkins logo to go to the home page to see a signup form?
  • The minor one: If a user record exists, independent of any permissions assigned to that user, the signup isn't shown.

The minor issue is fairly unlikely in regular use IMO, it's just something I stumbled upon when investigating this.

The major one should be fixed though.

Change By: Daniel Beck (12/Jan/15 7:33 PM)
Assignee: Daniel Beck
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators.
For more information on JIRA, see: http://www.atlassian.com/software/jira

--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to