jenkinsci/jenkins — pull request #1102 by ikedam (2014-01-26 04:48:37+00:00)
Title: [FIXED JENKINS-18884] Access check to jobs in People pages.

People page displays users extracted from change logs of jobs belonging to that view.
And People page of All view also displays all users registered in Jenkins.

They do no permission check.

This patch does followings:

* Adds permission check to jobs to extract users (now requires Read permission).
* People page of All view no longer display all users registered in Jenkins. It works same as those of other views:
* There is no reason for People page of All page to work different from those of other views.
* Displaying all users in Jenkins should be handled by security realms (like [`HudsonPrivateSecurityRealm.ManageUserLinks`](http://javadoc.jenkins-ci.org/hudson/security/HudsonPrivateSecurityRealm.ManageUserLinks.html)). If needed, I would implement a default user listing page for administrators.

This is another approach of #1094 .
First I planned to add a new permission to restrict access to People page in All view, but I get to think that the root problem is the difference of behaviors of People pages between All view and other views.