[SECURITY-915]

daniel-beck · daniel-beck · commit ce7f5f2cb523 · 2018-06-15T14:08:23.000+02:00
diff --git a/src/main/java/com/cloudbees/jenkins/GitHubPushTrigger.java b/src/main/java/com/cloudbees/jenkins/GitHubPushTrigger.java
@@ -403,6 +403,10 @@ private static ThreadFactory threadFactory() {
         public FormValidation doCheckHookRegistered(@AncestorInPath Item item) {
             Preconditions.checkNotNull(item, "Item can't be null if wants to check hook in monitor");
 
+            if (!item.hasPermission(Item.CONFIGURE)) {
+                return FormValidation.ok();
+            }
+
             Collection<GitHubRepositoryName> repos = GitHubRepositoryNameContributor.parseAssociatedNames(item);
 
             for (GitHubRepositoryName repo : repos) {
diff --git a/src/main/java/org/jenkinsci/plugins/github/config/GitHubPluginConfig.java b/src/main/java/org/jenkinsci/plugins/github/config/GitHubPluginConfig.java
@@ -179,7 +179,9 @@ public String getDisplayName() {
     }
 
     @SuppressWarnings("unused")
+    @RequirePOST
     public FormValidation doReRegister() {
+        Jenkins.getActiveInstance().checkPermission(Jenkins.ADMINISTER);
         if (!GitHubPlugin.configuration().isManageHooks()) {
             return FormValidation.warning("Works only when Jenkins manages hooks (one or more creds specified)");
         }
diff --git a/src/main/java/org/jenkinsci/plugins/github/config/GitHubTokenCredentialsCreator.java b/src/main/java/org/jenkinsci/plugins/github/config/GitHubTokenCredentialsCreator.java
@@ -24,6 +24,7 @@
 import org.kohsuke.github.GitHub;
 import org.kohsuke.github.GitHubBuilder;
 import org.kohsuke.stapler.QueryParameter;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -113,10 +114,11 @@ public ListBoxModel doFillCredentialsIdItems(@QueryParameter String apiUrl, @Que
     }
 
     @SuppressWarnings("unused")
+    @RequirePOST
     public FormValidation doCreateTokenByCredentials(
             @QueryParameter String apiUrl,
             @QueryParameter String credentialsId) {
-
+        Jenkins.getActiveInstance().checkPermission(Jenkins.ADMINISTER);
         if (isEmpty(credentialsId)) {
             return FormValidation.error("Please specify credentials to create token");
         }
@@ -156,11 +158,12 @@ public FormValidation doCreateTokenByCredentials(
     }
 
     @SuppressWarnings("unused")
+    @RequirePOST
     public FormValidation doCreateTokenByPassword(
             @QueryParameter String apiUrl,
             @QueryParameter String login,
             @QueryParameter String password) {
-
+        Jenkins.getActiveInstance().checkPermission(Jenkins.ADMINISTER);
         try {
             GHAuthorization token = createToken(login, password, defaultIfBlank(apiUrl, GITHUB_URL));
             StandardCredentials credentials = createCredentials(apiUrl, token.getToken(), login);

Original file line number	Diff line number	Diff line change
`@@ -179,7 +179,9 @@ public String getDisplayName() {`
`179`	`179`	`}`
`180`	`180`
`181`	`181`	`@SuppressWarnings("unused")`
	`182`	`+ @RequirePOST`
`182`	`183`	`public FormValidation doReRegister() {`
	`184`	`+ Jenkins.getActiveInstance().checkPermission(Jenkins.ADMINISTER);`
`183`	`185`	`if (!GitHubPlugin.configuration().isManageHooks()) {`
`184`	`186`	`return FormValidation.warning("Works only when Jenkins manages hooks (one or more creds specified)");`
`185`	`187`	`}`