From cd4cf63b9e00199cf934b74b241f3085a904a2e4 Mon Sep 17 00:00:00 2001
From: Basil Crow <me@basilcrow.com>
Date: Fri, 8 Nov 2024 05:49:26 -0800
Subject: [PATCH] [JENKINS-74795] Job created via REST API attaches to default
 view (#9947)

Co-authored-by: Mark Waite <mark.earl.waite@gmail.com>
(cherry picked from commit 8298257227d078bc247292e4de9e7112a15d9b0c)
---
 .../hudson/model/ModifiableItemGroup.java     |  3 +-
 .../test/java/hudson/jobs/CreateItemTest.java | 53 +++++++++++++++++++
 2 files changed, 55 insertions(+), 1 deletion(-)

diff --git a/core/src/main/java/hudson/model/ModifiableItemGroup.java b/core/src/main/java/hudson/model/ModifiableItemGroup.java
index 35e41305afb5..d0bcda31187c 100644
--- a/core/src/main/java/hudson/model/ModifiableItemGroup.java
+++ b/core/src/main/java/hudson/model/ModifiableItemGroup.java
@@ -33,6 +33,7 @@
 import org.kohsuke.stapler.StaplerRequest2;
 import org.kohsuke.stapler.StaplerResponse;
 import org.kohsuke.stapler.StaplerResponse2;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 /**
  * {@link ItemGroup} that is a general purpose container, which allows users and the rest of the program
@@ -50,7 +51,7 @@ public interface ModifiableItemGroup<T extends Item> extends ItemGroup<T> {
      * The request format follows that of {@code &lt;n:form xmlns:n="/lib/form">}.
      *
      */
-    @StaplerNotDispatchable
+    @RequirePOST
     default T doCreateItem(StaplerRequest2 req, StaplerResponse2 rsp) throws IOException, ServletException {
         if (ReflectionUtils.isOverridden(
                 ModifiableItemGroup.class,
diff --git a/test/src/test/java/hudson/jobs/CreateItemTest.java b/test/src/test/java/hudson/jobs/CreateItemTest.java
index df8c577e30dc..284200abdef8 100644
--- a/test/src/test/java/hudson/jobs/CreateItemTest.java
+++ b/test/src/test/java/hudson/jobs/CreateItemTest.java
@@ -25,19 +25,25 @@
 package hudson.jobs;
 
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsInAnyOrder;
 import static org.hamcrest.Matchers.nullValue;
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
 
 import hudson.model.Failure;
 import hudson.model.FreeStyleProject;
 import hudson.model.Item;
 import hudson.model.ItemGroup;
+import hudson.model.ListView;
+import hudson.model.User;
 import hudson.model.listeners.ItemListener;
 import java.net.HttpURLConnection;
 import java.net.URI;
 import java.net.URL;
 import java.text.MessageFormat;
+import jenkins.model.Jenkins;
 import org.htmlunit.HttpMethod;
 import org.htmlunit.Page;
 import org.htmlunit.WebRequest;
@@ -46,6 +52,7 @@
 import org.junit.Test;
 import org.jvnet.hudson.test.Issue;
 import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.MockAuthorizationStrategy;
 import org.jvnet.hudson.test.MockFolder;
 import org.jvnet.hudson.test.TestExtension;
 
@@ -142,4 +149,50 @@ public void onCheckCopy(Item src, ItemGroup parent) throws Failure {
         }
     }
 
+    @Issue("JENKINS-74795")
+    @Test
+    public void testCreateItemDoesNotPopulateDefaultView() throws Exception {
+        // Create a view that only displays jobs that start with 'a-'
+        FreeStyleProject aJob = rule.createFreeStyleProject("a-freestyle-job");
+        ListView aView = new ListView("a-view");
+        aView.setIncludeRegex("a-.*");
+        rule.jenkins.addView(aView);
+        assertThat(aView.getItems(), containsInAnyOrder(aJob));
+        assertFalse(aView.isDefault()); // Not yet the default view
+
+        // Create a view that only displays jobs that start with 'b-'
+        FreeStyleProject bJob = rule.createFreeStyleProject("b-freestyle-job");
+        ListView bView = new ListView("b-view");
+        bView.setIncludeRegex("b-.*");
+        rule.jenkins.addView(bView);
+        assertThat(bView.getItems(), containsInAnyOrder(bJob));
+        assertFalse(bView.isDefault()); // Not the default view
+
+        // Make the a-view the default
+        rule.jenkins.setPrimaryView(aView);
+        assertTrue(aView.isDefault()); // Now a-view is the default view
+
+        // Use createItem API to create a new job
+        User user = User.getById("user", true);
+        rule.jenkins.setSecurityRealm(rule.createDummySecurityRealm());
+        rule.jenkins.setAuthorizationStrategy(new MockAuthorizationStrategy()
+                .grant(Jenkins.READ, Item.CREATE)
+                .everywhere()
+                .to(user.getId()));
+        String b2JobName = "b-freestyle-job-2";
+        try (JenkinsRule.WebClient wc = rule.createWebClient()) {
+            wc.login(user.getId());
+            WebRequest request = new WebRequest(wc.createCrumbedUrl("createItem?name=" + b2JobName), HttpMethod.POST);
+            request.setAdditionalHeader("Content-Type", "application/xml");
+            request.setRequestBody("<project/>");
+            wc.getPage(request);
+        }
+        FreeStyleProject b2Job = rule.jenkins.getItemByFullName(b2JobName, FreeStyleProject.class);
+        assertThat(bView.getItems(), containsInAnyOrder(bJob, b2Job));
+        assertFalse(bView.isDefault());
+
+        // Confirm new job is not visible in default view
+        assertTrue(aView.isDefault()); // a-view is still the default view
+        assertThat(aView.getItems(), containsInAnyOrder(aJob));
+    }
 }