3232import org .jenkinsci .plugins .configfiles .maven .job .MvnGlobalSettingsProvider ;
3333import org .jenkinsci .plugins .configfiles .maven .job .MvnSettingsProvider ;
3434import org .jenkinsci .plugins .configfiles .sec .ProtectedCodeRunner ;
35+ import org .junit .jupiter .api .BeforeAll ;
3536import org .junit .jupiter .api .BeforeEach ;
3637import org .junit .jupiter .api .Test ;
3738import org .jvnet .hudson .test .Issue ;
@@ -57,6 +58,12 @@ class Security2203Test {
5758
5859 private FreeStyleProject project ;
5960
61+ @ BeforeAll
62+ static void enableManagePermission () {
63+ // TODO remove when baseline contains https://github.com/jenkinsci/jenkins/pull/23873
64+ Jenkins .MANAGE .setEnabled (true );
65+ }
66+
6067 @ BeforeEach
6168 void setUpAuthorizationAndProject (JenkinsRule r ) throws IOException {
6269 this .r = r ;
@@ -72,7 +79,10 @@ void setUpAuthorizationAndProject(JenkinsRule r) throws IOException {
7279 .to ("projectConfigurer" )
7380 .grant (Jenkins .ADMINISTER )
7481 .everywhere ()
75- .to ("administer" ));
82+ .to ("administer" )
83+ .grant (Jenkins .MANAGE )
84+ .everywhere ()
85+ .to ("manager" ));
7686 }
7787
7888 /**
@@ -292,8 +302,8 @@ private Config createSetting(ConfigProvider provider) {
292302 }
293303
294304 /**
295- * The {@link ConfigFilesManagement#getTarget()} is only accessible by people able to administer jenkins. It guarantees
296- * all methods in the class require {@link Jenkins#ADMINISTER }.
305+ * The {@link ConfigFilesManagement#getTarget()} is only accessible by people able to manage jenkins. It guarantees
306+ * all methods in the class require {@link Jenkins#MANAGE }.
297307 */
298308 @ Issue ("SECURITY-2203" )
299309 @ Test
@@ -304,7 +314,7 @@ void configFilesManagementAllMethodsProtected() {
304314 configFilesManagement .getTarget ();
305315 };
306316
307- assertWhoCanExecute (run , Jenkins .ADMINISTER , "ConfigFilesManagement#getTarget" );
317+ assertWhoCanExecute (run , Jenkins .MANAGE , "ConfigFilesManagement#getTarget" );
308318 }
309319
310320 /**
@@ -317,7 +327,7 @@ private void assertWhoCanExecute(Runnable run, Permission permission, String che
317327 final Map <Permission , String > userWithPermission = Stream .of (
318328 new AbstractMap .SimpleEntry <>(Jenkins .READ , "reader" ),
319329 new AbstractMap .SimpleEntry <>(Item .CONFIGURE , "projectConfigurer" ),
320- new AbstractMap .SimpleEntry <>(Jenkins .ADMINISTER , "administer " ))
330+ new AbstractMap .SimpleEntry <>(Jenkins .MANAGE , "manager " ))
321331 .collect (Collectors .toMap (Map .Entry ::getKey , Map .Entry ::getValue ));
322332
323333 try (ACLContext ctx = ACL .as (User .getOrCreateByIdOrFullName ("reader" ))) {
0 commit comments