Bug 27175

Summary: Jenkins instance exposed to public
Product: Project Infrastructure Reporter: freddy murcury <farmankhan977>
Component: Continuous IntegrationAssignee: Tomás Cohen Arazi (tcohen) <tomascohen>
Status: CLOSED INVALID QA Contact:
Severity: critical    
Priority: P5 - low CC: dcook, jonathan.druart, mtj
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Attachments: jenkins4koha

Description freddy murcury 2020-12-08 19:51:59 UTC
Created attachment 114267 [details]
jenkins4koha

hi team
during recon i found here 
https://jenkins.koha-community.org/view/supported/builds 
that your jenkins instance is exposed to public which should be private.
Comment 1 Mason James 2020-12-09 00:55:55 UTC
(In reply to Furman Khan from comment #0)
> Created attachment 114267 [details]
> jenkins4koha
> 
> hi team
> during recon i found here 
> https://jenkins.koha-community.org/view/supported/builds 
> that your jenkins instance is exposed to public which should be private.

hi Furman,
the jenkins.io project has it's instances public, so we can safely follow it's example?

 https://ci.jenkins.io/computer/
 https://ci.jenkins.io/view/Projects/builds
Comment 2 Jonathan Druart 2020-12-09 12:25:51 UTC
That's the expected behaviour, why should not they be public?
Comment 3 David Cook 2020-12-11 02:02:39 UTC
I don't think that this is a genuine issue. If there is a documented security vulnerability, it should be reported as a security bug instead.