[JENKINS-73958] remove eval call from js (#269)

* [JENKINS-73958] remove eval call from js * fix formatting * Clean up formatting --------- Co-authored-by: Basil Crow <me@basilcrow.com>
jenkinsci · Oct 18, 2024 · 01036ad · 01036ad
1 parent 0a08070
commit 01036ad
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/...a/org/jenkinsci/plugins/authorizeproject/strategy/SpecificUsersAuthorizationStrategy.java b/...a/org/jenkinsci/plugins/authorizeproject/strategy/SpecificUsersAuthorizationStrategy.java
@@ -276,9 +276,7 @@ public String getDisplayName() {
         @Restricted(NoExternalUse.class) // used by stapler/jelly
         @SuppressWarnings("unused")
         public String calcCheckPasswordRequestedUrl() {
-            return String.format(
-                    "'%s/%s/checkPasswordRequested' + qs(this).nearBy('userid')",
-                    getCurrentDescriptorByNameUrl(), getDescriptorUrl());
+            return String.format("%s/%s/checkPasswordRequested", getCurrentDescriptorByNameUrl(), getDescriptorUrl());
         }
 
         /**

diff --git a/...ns/authorizeproject/strategy/SpecificUsersAuthorizationStrategy/checkPasswordRequested.js b/...ns/authorizeproject/strategy/SpecificUsersAuthorizationStrategy/checkPasswordRequested.js
@@ -74,8 +74,10 @@ Behaviour.specify(".specific-user-authorization", "checkPasswordRequired", 0, fu
 
   var onchange = function(evt) {
     var url = useridField.getAttribute("checkPasswordRequestedUrl");
-    url = eval(url);
-    fetch(url, {
+    var params = new URLSearchParams({
+      userid: useridField.value,
+    });
+    fetch(url + "?" + params, {
       method: "post",
       headers: crumb.wrap({}),
     }).then((rsp) => {