[FIXED JENKINS-28298] Call XStream2#addCriticalField to reject unau…

…thenticated configurations.
jenkinsci · Mar 19, 2016 · 084778c · 084778c
1 parent ad44c7f
commit 084778c
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/authorizeproject/AuthorizeProjectProperty.java b/src/main/java/org/jenkinsci/plugins/authorizeproject/AuthorizeProjectProperty.java
@@ -40,7 +40,10 @@
 
 import hudson.DescriptorExtensionList;
 import hudson.Extension;
+import hudson.init.InitMilestone;
+import hudson.init.Initializer;
 import hudson.model.DescriptorVisibilityFilter;
+import hudson.model.Items;
 import hudson.model.Job;
 import hudson.model.JobProperty;
 import hudson.model.JobPropertyDescriptor;
@@ -117,6 +120,11 @@ public Authentication authenticate(Queue.Item item) {
         return strategy.authenticate(owner, item);
     }
 
+    @Initializer(after=InitMilestone.PLUGINS_STARTED)
+    public static void setStrategyCritical() {
+        Items.XSTREAM2.addCriticalField(AuthorizeProjectProperty.class, "strategy");
+    }
+
     /**
      * Descriptor for {@link AuthorizeProjectProperty}.
      *