jenkinsci / jenkinsci/cloudbees-folder-plugin

Folder credentials are erased by user lacking Item/Configure permission

Open
#727 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
59
Forks
117
PR merge metrics
No merged PRs in 30d

Description

### Jenkins and plugins versions report

[Jenkins core masks password](https://github.com/jenkinsci/jenkins/blob/1bb6359330510075fc8d90fe4c6516292bbe75d2/core/src/main/java/hudson/Functions.java#L2262-L2265) fields (i.e. replaces with ********) when you're lacking `Item/Configure` permission.

Folders credentials can be updated with `Credentials/View` and `Credentials/Update` permissions.

Meaning that someone with these permissions but lacking `Item/Configure` permission can edit a credentials, however the value of the password fields will be replaced by `********`.
So even without changing anyfield and just resaving the credentials, it will erase the value of the password by `********`.

### What Operating System are you using (both controller, and any agents involved in the problem)?

Linux, but unrelated to OS

### Reproduction steps

Create a credentials on a folder with a password set to `123`.

Image

As a user with `Credentials/View` and `Credentials/Update` permissions but lacking `Item/Configure` permission update the credentials without changing any fields, only by resaving.

Image

### Expected Results

As a user with `Credentials/View` and `Credentials/Update` permissions but lacking `Item/Configure` permission update the credentials without changing any fields do not erase the password value.

### Actual Results

As a user with `Credentials/View` and `Credentials/Update` permissions but lacking `Item/Configure` permission update the credentials without changing any fields do erase the password value.

### Anything else?

FTR: This behavior is unrelated to the recent core fix of Jenkins core on the [masking of the password field](https://github.com/jenkinsci/jenkins/blob/1bb6359330510075fc8d90fe4c6516292bbe75d2/core/src/main/java/hudson/Functions.java#L2262-L2265), it was already happening in before.

### Are you interested in contributing a fix?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.