[JENKINS-21327] replace RUN_SCRIPTS with a new Scritpler RUN permission

jenkinsci · May 15, 2017 · 71054a6 · 71054a6
1 parent cbafe3c
commit 71054a6
Show file tree

Hide file tree

Showing 6 changed files with 28 additions and 20 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/scriptler/ScriptlerManagement.java b/src/main/java/org/jenkinsci/plugins/scriptler/ScriptlerManagement.java
@@ -28,6 +28,8 @@
 import hudson.Util;
 import hudson.model.*;
 import hudson.security.Permission;
+import hudson.security.PermissionGroup;
+import hudson.security.PermissionScope;
 import jenkins.model.Jenkins;
 import org.apache.commons.fileupload.FileItem;
 import org.apache.commons.lang.StringUtils;
@@ -40,6 +42,7 @@
 import org.jenkinsci.plugins.scriptler.share.ScriptInfoCatalog;
 import org.jenkinsci.plugins.scriptler.util.ScriptHelper;
 import org.jenkinsci.plugins.scriptler.util.UIHelper;
+import org.jvnet.localizer.Localizable;
 import org.kohsuke.stapler.*;
 import org.kohsuke.stapler.interceptor.RequirePOST;
 
@@ -65,6 +68,9 @@ public class ScriptlerManagement extends ManagementLink implements RootAction {
     private final static String ALL = "(all)";
     private final static String ALL_SLAVES = "(all slaves)";
 
+    public static final PermissionGroup SCRITPLER_PERMISSONS = new PermissionGroup(ScriptlerManagement.class, Messages._permissons_title());
+    public static final Permission RUN = new Permission(SCRITPLER_PERMISSONS, "Run", Messages._permissons_run_description(), Jenkins.ADMINISTER, PermissionScope.JENKINS);
+
     private boolean isRunScriptPermissionEnabled() {
         return getConfiguration().isAllowRunScriptPermission();
     }
@@ -128,8 +134,8 @@ public ScriptlerConfiguration getConfiguration() {
     }
 
     public String getPluginResourcePath() {
-        PluginWrapper wrapper = Hudson.getInstance().getPluginManager().getPlugin(ScriptlerPluginImpl.class);
-        return Hudson.getInstance().getRootUrl() + "plugin/" + wrapper.getShortName() + "/";
+        PluginWrapper wrapper = Jenkins.getInstance().getPluginManager().getPlugin(ScriptlerPluginImpl.class);
+        return Jenkins.getInstance().getRootUrl() + "plugin/" + wrapper.getShortName() + "/";
     }
 
     /**
@@ -146,7 +152,7 @@ public String getPluginResourcePath() {
     @RequirePOST
     public HttpResponse doScriptlerSettings(StaplerRequest res, StaplerResponse rsp, @QueryParameter("disableRemoteCatalog") boolean disableRemoteCatalog, @QueryParameter("allowRunScriptPermission") boolean allowRunScriptPermission,
             @QueryParameter("allowRunScriptEdit") boolean allowRunScriptEdit) throws IOException {
-        checkPermission(Hudson.ADMINISTER);
+        checkPermission(Jenkins.ADMINISTER);
 
         ScriptlerConfiguration cfg = getConfiguration();
         cfg.setDisbableRemoteCatalog(disableRemoteCatalog);
@@ -174,7 +180,7 @@ public HttpResponse doScriptlerSettings(StaplerRequest res, StaplerResponse rsp,
      */
     @RequirePOST
     public HttpResponse doDownloadScript(StaplerRequest req, StaplerResponse rsp, @QueryParameter("id") String id, @QueryParameter("catalog") String catalogName) throws IOException, ServletException {
-        checkPermission(Hudson.ADMINISTER);
+        checkPermission(Jenkins.ADMINISTER);
 
         ScriptlerConfiguration c = getConfiguration();
         if (c.isDisbableRemoteCatalog()) {
@@ -233,7 +239,7 @@ public HttpResponse doDownloadScript(StaplerRequest req, StaplerResponse rsp, @Q
     public HttpResponse doScriptAdd(StaplerRequest req, StaplerResponse rsp, @QueryParameter("id") String id, @QueryParameter("name") String name, @QueryParameter("comment") String comment, @QueryParameter("script") String script,
             @QueryParameter("nonAdministerUsing") boolean nonAdministerUsing, @QueryParameter("onlyMaster") boolean onlyMaster, String originCatalogName, String originId) throws IOException, ServletException {
 
-        checkPermission(Hudson.ADMINISTER);
+        checkPermission(Jenkins.ADMINISTER);
 
         Parameter[] parameters = UIHelper.extractParameters(req.getSubmittedForm());
 
@@ -304,7 +310,7 @@ private GitScriptlerRepository getGitRepo() {
      * @throws IOException
      */
     public HttpResponse doHardResetGit() throws IOException {
-        checkPermission(Hudson.ADMINISTER);
+        checkPermission(Jenkins.ADMINISTER);
         getGitRepo().hardReset();
         return new HttpRedirect("/scriptler.git");
     }
@@ -323,7 +329,7 @@ public HttpResponse doHardResetGit() throws IOException {
      */
     @RequirePOST
     public HttpResponse doRemoveScript(StaplerRequest res, StaplerResponse rsp, @QueryParameter("id") String id) throws IOException {
-        checkPermission(Hudson.ADMINISTER);
+        checkPermission(Jenkins.ADMINISTER);
 
         // remove the file
         File oldScript = new File(getScriptDirectory(), id);
@@ -357,7 +363,7 @@ public HttpResponse doRemoveScript(StaplerRequest res, StaplerResponse rsp, @Que
      */
     @RequirePOST
     public HttpResponse doUploadScript(StaplerRequest req) throws IOException, ServletException {
-        checkPermission(Hudson.ADMINISTER);
+        checkPermission(Jenkins.ADMINISTER);
         try {
 
 
@@ -588,7 +594,7 @@ private String[] resolveSlaveNames(String nameAlias) {
      * @throws ServletException
      */
     public void doShowScript(StaplerRequest req, StaplerResponse rsp, @QueryParameter("id") String id) throws IOException, ServletException {
-        checkPermission(Hudson.RUN_SCRIPTS);
+        checkPermission(ScriptlerManagement.RUN);
 
         Script script = ScriptHelper.getScript(id, true);
         req.setAttribute("script", script);
@@ -608,7 +614,7 @@ public void doShowScript(StaplerRequest req, StaplerResponse rsp, @QueryParamete
      * @throws ServletException
      */
     public void doEditScript(StaplerRequest req, StaplerResponse rsp, @QueryParameter("id") String id) throws IOException, ServletException {
-        checkPermission(Hudson.ADMINISTER);
+        checkPermission(Jenkins.ADMINISTER);
 
         Script script = ScriptHelper.getScript(id, true);
         req.setAttribute("script", script);
@@ -696,11 +702,11 @@ public static File getScriptDirectory() {
     }
 
     public static File getScriptlerHomeDirectory() {
-        return new File(Hudson.getInstance().getRootDir(), "scriptler");
+        return new File(Jenkins.getInstance().getRootDir(), "scriptler");
     }
 
     private void checkPermission(Permission permission) {
-        Hudson.getInstance().checkPermission(permission);
+        Jenkins.getInstance().checkPermission(permission);
     }
 
     private String fixFileName(String catalogName, String name) {

diff --git a/src/main/java/org/jenkinsci/plugins/scriptler/builder/ScriptlerBuilder.java b/src/main/java/org/jenkinsci/plugins/scriptler/builder/ScriptlerBuilder.java
@@ -145,7 +145,7 @@ public static final class DescriptorImpl extends BuildStepDescriptor<Builder> {
 
         @Override
         public boolean isApplicable(Class<? extends AbstractProject> jobType) {
-            return Jenkins.getInstance().hasPermission(Jenkins.RUN_SCRIPTS);
+            return Jenkins.getInstance().hasPermission(getRequiredPermission());
         }
 
         @Override
@@ -162,7 +162,7 @@ public ScriptlerBuilder newInstance(StaplerRequest req, JSONObject formData) thr
             ScriptlerBuilder builder = null;
             String builderId = formData.optString("builderId");
 
-            if (!Jenkins.getInstance().hasPermission(Jenkins.RUN_SCRIPTS)) {
+            if (!Jenkins.getInstance().hasPermission(ScriptlerManagement.RUN)) {
                 // the user has no permission to change the builders, therefore we reload the builder without his changes!
                 final String backupJobName = formData.optString("backupJobName");
 
@@ -226,7 +226,7 @@ private ScriptlerConfiguration getConfig() {
         /**
          * gets the argument description to be displayed on the screen when selecting a config in the dropdown
          * 
-         * @param configId
+         * @param scriptlerScriptId
          *            the config id to get the arguments description for
          * @return the description
          */

diff --git a/src/main/resources/org/jenkinsci/plugins/scriptler/Messages.properties b/src/main/resources/org/jenkinsci/plugins/scriptler/Messages.properties
@@ -39,4 +39,6 @@ skipParamter = skipping parameter [{0}] this name is used internal, please renam
 resultPrefix = Result:  
 no_parameters_defined = There is not any parameter defined for this job.
 tokenmacro_AdminScriptOnly = The script [{0}] exists, but is marked to be used by admins only and is therefore not allowed for usage in the TokenMacro.
-tokenmacro_ScriptDoesNotExist = No script with the id [{0}] could be found.
+tokenmacro_ScriptDoesNotExist = No script with the id [{0}] could be found.
+permissons_title = Scriptler
+permissons_run_description = allow execution of scritpler scripts
diff --git a/src/main/webapp/help-allowRunScriptEdit.html b/src/main/webapp/help-allowRunScriptEdit.html
@@ -1,4 +1,4 @@
 <div>
-    Checking this option, allows users who have the 'RunScript' permission to change a scriptler scripts before executing it.<br />
+    Checking this option, allows users who have the 'Scriptler/Run' permission to change a scriptler scripts before executing it.<br />
     A user can seriously harm your system and compromise your security! 
 </div>
diff --git a/src/main/webapp/help-allowRunScriptPermission.html b/src/main/webapp/help-allowRunScriptPermission.html
@@ -1,3 +1,3 @@
 <div>
-    Checking this option, allows users who have the 'RunScript' permission to run scriptler scripts.
+    Checking this option, allows users who have the 'Scriptler/Run' permission to run scriptler scripts.
 </div>
diff --git a/src/test/java/org/jenkinsci/plugins/scriptler/restapi/ScriptlerRestApiTest.java b/src/test/java/org/jenkinsci/plugins/scriptler/restapi/ScriptlerRestApiTest.java
@@ -30,10 +30,10 @@ public class ScriptlerRestApiTest {
     private static final String SCRIPT_ID = "dummy.groovy";
 
     @Rule
-    public static JenkinsRule j = new JenkinsRule();
+    public JenkinsRule j = new JenkinsRule();
 
     @ClassRule
-    public BuildWatcher bw = new BuildWatcher();
+    public static BuildWatcher bw = new BuildWatcher();
 
     @Before
     public void setup() throws Exception {