Scriptler using GET in Jenkins2

[adam.l...@gmail.com]

On Jenkins 1.x we can call scriptlet entries using GET.

On Jenkin 2.x, any GET attempts are being returned with an error that they must be done via POST

I'm not finding anything in JIRA, but my search could be bad.

Has this functionality changed?

 Thank you !

-----

From the documentation:  https://plugins.jenkins.io/scriptler/

REST

since version 1.7, one can also run a script using GET or POST to the URL /scriptler/run/<your-script-id> with the optional parameters node, script (alternative script text), contentType, and the parameters defined for your stored script.

e.g.

http://myserver/jenkins/scriptler/run/<yourScriptId>?param1=value1

[Daniel Beck]

On Wed, May 18, 2022 at 9:01 PM adam.l...@gmail.com <adam.l...@gmail.com> wrote:

On Jenkins 1.x we can call scriptlet entries using GET.

On Jenkin 2.x, any GET attempts are being returned with an error that they must be done via POST

That's a security fix. See https://www.jenkins.io/security/advisory/2017-04-10/#script-management-vulnerable-to-cross-site-request-forgery-attacks-in-scriptler-plugin

[adam.l...@gmail.com]

Thank you for that.

 But the way I read that is as a warning: subject to CSRF problems, be warned.  I don't see any indication that GET has been disabled.

What am I not seeing?

 Thank you

[Daniel Beck]

On Wed, May 18, 2022 at 10:02 PM adam.l...@gmail.com <adam.l...@gmail.com> wrote:

 But the way I read that is as a warning: subject to CSRF problems, be warned.  I don't see any indication that GET has been disabled.

What am I not seeing?

With publication of the advisory, we suspended distribution of the plugin for a while until the issues were fixed in release 3.0. The fix for this was to require POST, which Jenkins applies CSRF protection to. Advisories are not updated when previously unresolved issues are fixed, so it still says that as of publication, there is no fix.

[adam.l...@gmail.com]

Ah, I see.   Thank you.

 Hoping I can easily find the way to revert it via commits history.   We're not worried about the security issue, just the functionality.