[SECURITY-2794]

jenkinsci · Jun 21, 2022 · 4021487 · 4021487
1 parent 63f82f2
commit 4021487
Showing 1 changed file with 10 additions and 4 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/badge/actions/PublicBuildStatusAction.java b/src/main/java/org/jenkinsci/plugins/badge/actions/PublicBuildStatusAction.java
@@ -134,8 +134,11 @@ public String doText(StaplerRequest req, StaplerResponse rsp, @QueryParameter St
         }
 
         // check if user has permission to view the status
-        if(throwErrorWhenNotFound && (p == null || !p.hasPermission(VIEW_STATUS))){
-            throw HttpResponses.notFound();            
+        if (p == null || !p.hasPermission(VIEW_STATUS)) {
+            if (throwErrorWhenNotFound) {
+                throw HttpResponses.notFound();
+            }
+            return null;
         }
 
         return p;
@@ -180,8 +183,11 @@ public String doText(StaplerRequest req, StaplerResponse rsp, @QueryParameter St
             }    
         }
         // check if user has permission to view the status
-        if(throwErrorWhenNotFound && (run == null || !run.hasPermission(VIEW_STATUS))){
-            throw HttpResponses.notFound();
+        if (run == null || !run.hasPermission(VIEW_STATUS)) {
+            if (throwErrorWhenNotFound) {
+                throw HttpResponses.notFound();
+            }
+            return null;
         }
 
         return run;