Strange output in footer about scm-sync-configuration-plugin HOT 7 OPEN

Thanks for the note. Is it safe to say the blanket disabling is just a band-aid and a patch should still be made so the plugin itself can handle the reconfiguration?

from scm-sync-configuration-plugin.

Same here on Jenkins 2.138.3 and Plugin version 0.0.10 (also tried 0.0.9)
Looks like the HTML has '<' HTML-encoded:
<br/>To remove this message, please <a href='#' onclick='javascript:removeLog();'>click here</a>

from scm-sync-configuration-plugin.

Bit more than cosmetic because it also covers the last bits of console output, which are often the most important. :(

Thx for reading

from scm-sync-configuration-plugin.

You need to set -Dorg.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault=false which helps in this case. There are several things broken with this change in Jenkins. See https://jenkins.io/blog/2018/10/10/security-updates/ and https://wiki.jenkins.io/display/JENKINS/Plugins+affected+by+2018-10-10+Stapler+security+hardening

from scm-sync-configuration-plugin.

Indeed, it would be really nice if the plugin could be targeted about disabling the escaping logic.

from scm-sync-configuration-plugin.

Same issue, just to report it. It looks like the j:set var="msg" block creates a commented out span, and not what the code is expecting.

from scm-sync-configuration-plugin.

+1

from scm-sync-configuration-plugin.