[JIRA] (JENKINS-61235) User/people disclosure

[cz@flyingcircus.io (JIRA)]

Christian Zagrodnick created an issue

Jenkins / JENKINS-61235 User/people disclosure Issue Type: Bug Assignee: Daniel Beck Components: matrix-auth-plugin Created: 2020-02-26 13:22 Priority: Minor Reporter: Christian Zagrodnick With project/matrix based security, a user requires Overall/Read to do anything in the web UI. That is, even with permissions on a folder they cannot see anything and get the infamous “user is missing the Overall/Read permission”. But with the Overall/Read permission they can see all the other users (via e.g. /asynchPeople/). So there doesn’t seem to be a way to limit access to the user information – which, depending on context, is a data protection issue. (tested on Jenkins 2.220) Add Comment

This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)

[dbeck@cloudbees.com (JIRA)]

Daniel Beck closed an issue as Not A Defect

Has nothing to do with this plugin, it cannot offer options that don't exist. (And is a duplicate of an existing issue in the general case, no time to look right now.)

Jenkins / JENKINS-61235 User/people disclosure

Change By: Daniel Beck Status: Open Closed Resolution: Not A Defect

Add Comment

[cz@flyingcircus.io (JIRA)]

Christian Zagrodnick commented on JENKINS-61235

Re: User/people disclosure Right, that's JENKINS-18884. Didn't find that before.

Add Comment