Check READ/DISCOVER permissions on Queue.Item.getApi.
@@ -2206,10 +2206,21 @@ public class Queue extends ResourceController implements Saveable {
return Tasks.getDefaultAuthenticationOf(task, this);
}
-
- public Api getApi() {
+ @Restricted(DoNotUse.class) // only for Stapler export
+ public Api getApi() throws AccessDeniedException {
+ if (task instanceof AccessControlled) {
+ AccessControlled ac = (AccessControlled) task;
+ if (!ac.hasPermission(hudson.model.Item.DISCOVER)) {
+ return null; // same as getItem(long) returning null (details are printed only in case of -Dstapler.trace=true)
+ } else if (!ac.hasPermission(hudson.model.Item.READ)) {
+ throw new AccessDeniedException("Please log in to access " + task.getUrl()); // like Jenkins.getItem
+ } else { // have READ
return new Api(this);
}
+ } else { // err on the safe side
+ return null;
+ }
+ }
private Object readResolve() {
this.future = new FutureImpl(task);
