Skip to content
This repository has been archived by the owner on May 28, 2024. It is now read-only.

Add protection from CSRF #291

Merged
merged 2 commits into from
Nov 7, 2023
Merged

Add protection from CSRF #291

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4fa0f3c
Add protection from CSRF
eduard-tita Nov 6, 2023
1de6626
Perform permission check
eduard-tita Nov 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@
<enforcer.skip>true</enforcer.skip> <!-- TODO numerous requireUpperBoundDeps, some probably indicative of real problems -->
<jvnet-localizer-plugin.version>1.23</jvnet-localizer-plugin.version>
<forkCount>1</forkCount>
<nexus-platform-api.version>4.3.1-01</nexus-platform-api.version>
<nexus-platform-api.version>4.3.2-01</nexus-platform-api.version>

<buildsupport.version>36</buildsupport.version>
<buildsupport.license-maven-plugin.version>4.1</buildsupport.license-maven-plugin.version>
Expand Down
9 changes: 9 additions & 0 deletions src/main/java/org/sonatype/nexus/ci/config/NxiqConfiguration.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ import hudson.util.ListBoxModel
import jenkins.model.Jenkins
import org.kohsuke.stapler.DataBoundConstructor
import org.kohsuke.stapler.QueryParameter
import org.kohsuke.stapler.verb.POST

class NxiqConfiguration
implements Describable<NxiqConfiguration>
Expand Down Expand Up @@ -83,7 +84,9 @@ class NxiqConfiguration
Messages.NxiqConfiguration_DisplayName()
}

@POST
FormValidation doCheckDisplayName(@QueryParameter String value, @QueryParameter String internalId) {
Jenkins.get().checkPermission(Jenkins.ADMINISTER)
def globalConfigurations = GlobalNexusConfiguration.globalNexusConfiguration
for (NxiqConfiguration config : globalConfigurations.iqConfigs) {
if (config.internalId != internalId && config.displayName == value) {
Expand All @@ -93,7 +96,9 @@ class NxiqConfiguration
return FormUtil.validateNotEmpty(value, 'Display Name is required')
}

@POST
FormValidation doCheckId(@QueryParameter String value, @QueryParameter String internalId) {
Jenkins.get().checkPermission(Jenkins.ADMINISTER)
def globalConfigurations = GlobalNexusConfiguration.globalNexusConfiguration
for (NxiqConfiguration config : globalConfigurations.iqConfigs) {
if (config.internalId != internalId && config.id == value) {
Expand All @@ -108,7 +113,9 @@ class NxiqConfiguration
}

@SuppressWarnings('unused')
@POST
FormValidation doCheckServerUrl(@QueryParameter String value) {
Jenkins.get().checkPermission(Jenkins.ADMINISTER)
def validation = FormUtil.validateUrl(value)
if (validation.kind == Kind.OK) {
validation = FormUtil.validateNotEmpty(value, Messages.Configuration_ServerUrlRequired())
Expand All @@ -123,10 +130,12 @@ class NxiqConfiguration
}

@SuppressWarnings('unused')
@POST
FormValidation doVerifyCredentials(
@QueryParameter String serverUrl,
@QueryParameter String credentialsId) throws IOException
{
Jenkins.get().checkPermission(Jenkins.ADMINISTER)
return IqUtil.verifyJobCredentials(serverUrl, credentialsId, Jenkins.instance)
}
}
Expand Down
5 changes: 5 additions & 0 deletions src/main/java/org/sonatype/nexus/ci/config/Nxrm2Configuration.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,10 @@ import org.sonatype.nexus.ci.config.NxrmConfiguration.NxrmDescriptor

import hudson.Extension
import hudson.util.FormValidation
import jenkins.model.Jenkins
import org.kohsuke.stapler.DataBoundConstructor
import org.kohsuke.stapler.QueryParameter
import org.kohsuke.stapler.verb.POST

import static hudson.util.FormValidation.error
import static hudson.util.FormValidation.ok
Expand Down Expand Up @@ -58,9 +60,12 @@ class Nxrm2Configuration
}

@Override
@POST
FormValidation doVerifyCredentials(@QueryParameter String serverUrl, @QueryParameter String credentialsId)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on the specification, why would it not be necessary to check permissions for the user such as Jenkins.get().checkPermission(Jenkins.ADMINISTER);?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch! I'll add that too.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See 1de6626

throws IOException
{
Jenkins.get().checkPermission(Jenkins.ADMINISTER)

try {
def repositories = getApplicableRepositories(serverUrl, credentialsId)

Expand Down
5 changes: 5 additions & 0 deletions src/main/java/org/sonatype/nexus/ci/config/Nxrm3Configuration.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,10 @@ import com.sonatype.nexus.api.exception.RepositoryManagerException
import groovy.util.logging.Log
import hudson.Extension
import hudson.util.FormValidation
import jenkins.model.Jenkins
import org.kohsuke.stapler.DataBoundConstructor
import org.kohsuke.stapler.QueryParameter
import org.kohsuke.stapler.verb.POST

import static hudson.util.FormValidation.error
import static hudson.util.FormValidation.ok
Expand Down Expand Up @@ -80,9 +82,12 @@ class Nxrm3Configuration
}

@Override
@POST
FormValidation doVerifyCredentials(@QueryParameter String serverUrl, @QueryParameter String credentialsId)
throws IOException
{
Jenkins.get().checkPermission(Jenkins.ADMINISTER)

def repositories
def badVersionMsg = ''

Expand Down