jenkinsci/build-flow-plugin — pull request #33 by daniel-beck (2013-07-14 16:41:56+00:00)
Title: Prevent users without RUN_SCRIPTS permission from editing Groovy DSL

Groovy DSL isn't sandboxed (see [JENKINS-16980](https://issues.jenkins-ci.org/browse/JENKINS-16980)), and some work needs to be done to determine what should be exposed to the script via e.g. JobInvocation.

So as a temporary solution, require RUN_SCRIPTS to edit the DSL instead of simply Job/CONFIGURE. Shouldn't be an issue in unsecured (or mostly unsecured) Jenkins, and will fix a security hole in secured Jenkins.