search

jenkinsci / hipchat-plugin

HipChat notification plugin for Jenkins
https://plugins.jenkins.io/hipchat/
54 stars 85 forks source link

Stop copying Global System parameters into job/config.xml #33

Closed gena01 closed 9 years ago

gena01 commented 9 years ago

It appears that the plugin is copying the global settings for server and token into each job/config.xml. This has two separate issues:

  1. Changing global system settings doesn't "fix" things until every job is re-saved. And things are broken until that step is performed.
  2. It's possibly leaking sensitive information. All a user needs to have access to is to be able to create and manage job configs. Normally there's no way to set HipChat connection information in the Job Configuration page, but because of this bug they might be able to see something they shouldn't.
gena01 commented 9 years ago

@aldaris done per comment in #31

aldaris commented 9 years ago

I haven't had much chance to look at this yet, but I'm wondering if any of my refactorings in master has already resolved this by any chance. Could you give it a test and see if the authToken still makes it into the job configurations? Thanks

retoo commented 9 years ago

I think this has been resolved.

aldaris commented 9 years ago

During my local tests today I've got the same result. Closing this one as fixed in 0.1.9-SNAPSHOT