Merge pull request #1831 from jenkinsci/1.55.x

jenkinsci · Jan 18, 2022 · b4622e2 · b4622e2
2 parents 0a35be1 + 6bf8bf9
commit b4622e2
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/plugin/src/main/java/io/jenkins/plugins/casc/TokenReloadAction.java b/plugin/src/main/java/io/jenkins/plugins/casc/TokenReloadAction.java
@@ -6,6 +6,8 @@
 import hudson.security.ACL;
 import hudson.security.ACLContext;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
 import java.util.logging.Logger;
 import javax.servlet.http.HttpServletRequest;
 import org.kohsuke.stapler.StaplerRequest;
@@ -48,7 +50,8 @@ public void doIndex(StaplerRequest request, StaplerResponse response) throws IOE
         } else {
             String requestToken = getRequestToken(request);
 
-            if (token.equals(requestToken)) {
+            if (requestToken != null && MessageDigest.isEqual(token.getBytes(StandardCharsets.UTF_8), requestToken.getBytes(
+                StandardCharsets.UTF_8))) {
                 LOGGER.info("Configuration reload triggered via token");
 
                 try (ACLContext ignored = ACL.as(ACL.SYSTEM)) {

diff --git a/pom.xml b/pom.xml
@@ -19,7 +19,7 @@
   </modules>
 
   <properties>
-    <revision>1.56</revision>
+    <revision>1.55.2</revision>
     <changelist>-SNAPSHOT</changelist>
     <jenkins.version>2.249.1</jenkins.version>
     <java.level>8</java.level>