CVE-2025-58460

@@ -129,6 +129,9 @@ public String getDisplayName() {
 
         @RequirePOST
         public FormValidation doCheckElasticsearchUrl(@QueryParameter("elasticsearchUrl") String url) {
+            if (!isAuthorized()) {
+                return FormValidation.error("You do not have permission to configure this setting.");
+            }
             if (StringUtils.isEmpty(url)) {
                 return FormValidation.ok();
             }
@@ -141,24 +144,22 @@ public FormValidation doCheckElasticsearchUrl(@QueryParameter("elasticsearchUrl"
         }
 
         @RequirePOST
-        public ListBoxModel doFillElasticsearchCredentialsIdItems(Item context,
+        public ListBoxModel doFillElasticsearchCredentialsIdItems(
                 @QueryParameter String elasticsearchCredentialsId) {
-            if (context == null && !Jenkins.get().hasPermission(Jenkins.ADMINISTER)
-                    || context != null && !context.hasPermission(Item.CONFIGURE)) {
+            if (!isAuthorized()) {
                 return new StandardListBoxModel();
             }
 
             return new StandardListBoxModel().includeEmptyValue()
-                    .includeAs(ACL.SYSTEM2, context, StandardUsernameCredentials.class)
+                    .includeAs(ACL.SYSTEM2, (Item) null, StandardUsernameCredentials.class)
                     .includeCurrentValue(elasticsearchCredentialsId);
         }
 
         @RequirePOST
-        public FormValidation doCheckElasticsearchCredentialsId(Item context,
+        public FormValidation doCheckElasticsearchCredentialsId(
                 @QueryParameter String elasticsearchCredentialsId) {
-            if (context == null && !Jenkins.get().hasPermission(Jenkins.ADMINISTER)
-                    || context != null && !context.hasPermission(Item.CONFIGURE)) {
-                return FormValidation.ok();
+            if (!isAuthorized()) {
+                return FormValidation.error("You do not have permission to configure this setting.");
             }
 
             if (elasticsearchCredentialsId == null || elasticsearchCredentialsId.isEmpty()) {
@@ -175,6 +176,9 @@ public FormValidation doCheckElasticsearchCredentialsId(Item context,
         @RequirePOST
         public FormValidation doValidate(@QueryParameter String elasticsearchUrl,
                 @QueryParameter boolean disableSslVerifications, @QueryParameter String elasticsearchCredentialsId) {
+            if (!isAuthorized()) {
+                return FormValidation.error("You do not have permission to configure this setting.");
+            }
             FormValidation elasticsearchUrlValidation = doCheckElasticsearchUrl(elasticsearchUrl);
             if (elasticsearchUrlValidation.kind != FormValidation.Kind.OK) {
                 return elasticsearchUrlValidation;
@@ -193,5 +197,13 @@ public FormValidation doValidate(@QueryParameter String elasticsearchUrl,
                 return FormValidation.error(e, e.getMessage());
             }
         }
+
+        /**
+         * Checks if the user has permission to configure the backend.
+         * @return true if the user is authorized, false otherwise
+         */
+        private boolean isAuthorized() {
+            return Jenkins.get().hasPermission(Jenkins.ADMINISTER);
+        }
     }
 }

@@ -75,7 +75,7 @@ public void testDoFillCredentialsIdItems(JenkinsConfiguredWithCodeRule j) {
         ElasticLogsBackendWithJenkinsVisualization visualization = elasticStack.getElasticStackConfiguration();
         ElasticLogsBackendWithJenkinsVisualization.DescriptorImpl visDescriptor = (ElasticLogsBackendWithJenkinsVisualization.DescriptorImpl) visualization
                 .getDescriptor();
-        assertFalse(visDescriptor.doFillElasticsearchCredentialsIdItems(null, ElasticStack.CRED_ID).isEmpty());
+        assertFalse(visDescriptor.doFillElasticsearchCredentialsIdItems(ElasticStack.CRED_ID).isEmpty());
     }
 
     @Test
@@ -86,8 +86,8 @@ public void testDoCheckCredentialsId(JenkinsConfiguredWithCodeRule j) {
         ElasticLogsBackendWithJenkinsVisualization.DescriptorImpl visDescriptor = (ElasticLogsBackendWithJenkinsVisualization.DescriptorImpl) visualization
                 .getDescriptor();
         assertEquals(FormValidation.Kind.OK,
-                visDescriptor.doCheckElasticsearchCredentialsId(null, ElasticStack.CRED_ID).kind);
-        assertEquals(FormValidation.Kind.ERROR, visDescriptor.doCheckElasticsearchCredentialsId(null, "foo").kind);
+                visDescriptor.doCheckElasticsearchCredentialsId(ElasticStack.CRED_ID).kind);
+        assertEquals(FormValidation.Kind.ERROR, visDescriptor.doCheckElasticsearchCredentialsId("foo").kind);
     }
 
     private void waitForLogs(WorkflowRun run) throws InterruptedException {

@@ -7,12 +7,24 @@
 import hudson.util.FormValidation;
 import io.jenkins.plugins.opentelemetry.backend.ElasticBackend;
 import io.jenkins.plugins.opentelemetry.backend.elastic.ElasticLogsBackendWithJenkinsVisualization;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.junit.jupiter.WithJenkins;
 
 import static junit.framework.TestCase.assertEquals;
 
+@WithJenkins
 public class ElasticStackConfigurationFormTest {
 
+    @SuppressWarnings("unused")
+    private JenkinsRule r;
+
+    @BeforeEach
+    public void setUp(JenkinsRule r) {
+        this.r = r;
+    }
+
     @Test
     public void testDoCheckKibanaUrl() {
         ElasticBackend.DescriptorImpl config = new ElasticBackend.DescriptorImpl();