[FIXED JENKINS-25031] don't leak ServerCredentialMapping

jenkinsci · Jul 23, 2015 · ca3c5a4 · ca3c5a4
1 parent 21f6a85
commit ca3c5a4
Showing 1 changed file with 10 additions and 6 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/configfiles/maven/security/ServerCredentialMapping.java b/src/main/java/org/jenkinsci/plugins/configfiles/maven/security/ServerCredentialMapping.java
@@ -1,11 +1,5 @@
 package org.jenkinsci.plugins.configfiles.maven.security;
 
-import hudson.Extension;
-import hudson.model.AbstractDescribableImpl;
-import hudson.model.AbstractProject;
-import hudson.model.Descriptor;
-import hudson.util.ListBoxModel;
-
 import java.util.List;
 
 import org.kohsuke.stapler.AncestorInPath;
@@ -15,6 +9,13 @@
 import com.cloudbees.plugins.credentials.common.StandardUsernameCredentials;
 import com.cloudbees.plugins.credentials.common.StandardUsernameListBoxModel;
 
+import hudson.Extension;
+import hudson.model.AbstractDescribableImpl;
+import hudson.model.AbstractProject;
+import hudson.model.Descriptor;
+import hudson.model.Item;
+import hudson.util.ListBoxModel;
+
 public class ServerCredentialMapping extends AbstractDescribableImpl<ServerCredentialMapping> {
 
     private final String serverId;
@@ -44,6 +45,9 @@ public Descriptor<ServerCredentialMapping> getDescriptor() {
     public static class DescriptorImpl extends Descriptor<ServerCredentialMapping> {
 
         public ListBoxModel doFillCredentialsIdItems(@AncestorInPath AbstractProject<?, ?> context, @QueryParameter String serverId) {
+            if (context == null || !context.hasPermission(Item.CONFIGURE)) {
+                return new ListBoxModel();
+            }
             final List<StandardUsernameCredentials> validCredentials = CredentialsHelper.findValidCredentials(serverId);
             return new StandardUsernameListBoxModel().withEmptySelection().withAll(validCredentials);
         }