[FIXED JENKINS-3709] Protect JiraSite password using hudson.util.Secret

jenkinsci · Jun 12, 2013 · 7e43cd8 · 7e43cd8
1 parent 4175893
commit 7e43cd8
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/src/main/java/hudson/plugins/jira/JiraSite.java b/src/main/java/hudson/plugins/jira/JiraSite.java
@@ -13,6 +13,7 @@
 import hudson.plugins.jira.soap.RemoteIssueType;
 import hudson.plugins.jira.soap.RemoteVersion;
 import hudson.util.FormValidation;
+import hudson.util.Secret;
 
 import java.io.IOException;
 import java.io.PrintStream;
@@ -81,7 +82,7 @@ public class JiraSite extends AbstractDescribableImpl<JiraSite> {
     /**
      * Password needed to login. Optional.
      */
-    public final String password;
+    public final Secret password;
 
     /**
      * Group visibility to constrain the visibility of the added comment. Optional.
@@ -152,7 +153,7 @@ public JiraSite(URL url, URL alternativeUrl, String userName, String password, b
         this.url = url;
         this.alternativeUrl = alternativeUrl;
         this.userName = Util.fixEmpty(userName);
-        this.password = Util.fixEmpty(password);
+        this.password = Secret.fromString(Util.fixEmpty(password));
         this.supportsWikiStyleComment = supportsWikiStyleComment;
         this.recordScmChanges = recordScmChanges;
         this.userPattern = Util.fixEmpty(userPattern);
@@ -200,7 +201,7 @@ public JiraSession createSession() throws IOException, ServiceException {
 
         JiraSoapService service = jiraSoapServiceGetter.getJirasoapserviceV2(
             new URL(url, "rpc/soap/jirasoapservice-v2"));
-        return new JiraSession(this,service,service.login(userName,password));
+        return new JiraSession(this,service,service.login(userName,password.getPlainText()));
     }
 
     /**