JEP-224 - Add a Overall/SystemRead permission enabler controlled by…

… the `jenkins.security.SystemReadPermission` system property for Jenkins 2.222+ + Add a Beta `hudson.plugins.extendedread.SystemReadPermission#SYSTEM_READ` permission entity for plugin developers who want to use the permission without updating the Jenkins core dependency (#7) * Add system read permission enabler * Fix spotbugs * getInstance to get * Make as beta * Update src/main/java/hudson/plugins/extendedread/SystemReadPermission.java Co-Authored-By: Oleg Nenashev <[email protected]> Co-authored-by: Oleg Nenashev <[email protected]>
jenkinsci · Feb 24, 2020 · 2964999 · 2964999
1 parent ee774ba
commit 2964999
Show file tree

Hide file tree

Showing 2 changed files with 51 additions and 0 deletions.
diff --git a/src/main/java/hudson/plugins/extendedread/SystemReadPermission.java b/src/main/java/hudson/plugins/extendedread/SystemReadPermission.java
@@ -0,0 +1,32 @@
+package hudson.plugins.extendedread;
+
+import hudson.security.Permission;
+import hudson.util.ReflectionUtils;
+import java.lang.reflect.InvocationTargetException;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import jenkins.model.Jenkins;
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.Beta;
+
+import static jenkins.model.Jenkins.ADMINISTER;
+
+@Restricted(Beta.class)
+public class SystemReadPermission {
+
+    private static final Logger LOGGER = Logger.getLogger(SystemReadPermission.class.getName());
+
+    public static final Permission SYSTEM_READ;
+
+    static {
+        Permission systemRead;
+        try { // System Read is available starting from Jenkins 2.222 (https://jenkins.io/changelog/#v2.222). See JEP-224 for more info
+            systemRead = (Permission) ReflectionUtils.getPublicProperty(Jenkins.get(), "SYSTEM_READ");
+        } catch (IllegalArgumentException | InvocationTargetException | NoSuchMethodException | IllegalAccessException e) {
+            LOGGER.log(Level.FINE, "Couldn't find system read permission, falling back to ADMINISTER", e);
+            systemRead = ADMINISTER;
+        }
+
+        SYSTEM_READ = systemRead;
+    }
+}
diff --git a/src/main/java/hudson/plugins/extendedread/SystemReadPermissionEnabler.java b/src/main/java/hudson/plugins/extendedread/SystemReadPermissionEnabler.java
@@ -0,0 +1,19 @@
+package hudson.plugins.extendedread;
+
+import hudson.Extension;
+import hudson.init.InitMilestone;
+import hudson.init.Initializer;
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
+
+@Extension
+@Restricted(NoExternalUse.class)
+public class SystemReadPermissionEnabler {
+
+    @Initializer(after = InitMilestone.PLUGINS_STARTED)
+    public static void enableSystemReadPermission() {
+        if (System.getProperty("jenkins.security.SystemReadPermission") == null) {
+            SystemReadPermission.SYSTEM_READ.setEnabled(true);
+        }
+    }
+}