My recommended fix in response to https://github.com/jenkinsci/jenkins/pull/1093. This does not eliminate nor exclude the need for more generic pluggability, but it would at least address the security concern.

[FIXED JENKINS-18694] Generalizing fix of JENKINS-18678 to include also rename of parent folders, taking advantage of JENKINS-18028 API.

[FIXED JENKINS-20008] [FIXED JENKINS-18028] [FIXED JENKINS-18680] #1069: support for moving jobs into or out of folders.

[FIXED JENKINS-19826] element.setAttribute('name', …) does not work in IE in compatibility mode, so use prototype’s Element(…) which does.

[FIXED JENKINS-21254] Ensuring that all <link>s offered on the /login page can be read even by anonymous users without Jenkins.READ.

[JENKINS-18410] NPE from previous fix (fcdf7499) under some conditions, which the test case was not exercising.
java.lang.NullPointerException
	at hudson.tasks.test.AggregatedTestResultPublisher$TestResultAction.getProject(AggregatedTestResultPublisher.java:173)
	at hudson.tasks.test.AggregatedTestResultPublisher$TestResultAction.<init>(AggregatedTestResultPublisher.java:146)
	at hudson.tasks.test.AggregatedTestResultPublisher$TestResultAction.<init>(AggregatedTestResultPublisher.java:135)
	at hudson.tasks.test.AggregatedTestResultPublisher.perform(AggregatedTestResultPublisher.java:90)

[JENKINS-18678] Tweaking API, adding @since & changelog for #1075, fixing purgeCache so that test can pass.

[FIXED JENKINS-21024] Catch a full range of XStreamException’s during deserialization, including rethrown exceptions from readResolve.

[JENKINS-20951] [JENKINS-18410] Did not make it into 1.544 due to validated merge holdups (mostly randomly failing tests, sigh).

[FIXED JENKINS-20951] XmlFile.read/unmarshal needs to catch general XStreamException so as to include CannotResolveClassException, thrown when a TopLevelItem provided by a plugin is unloadable.

[FIXED JENKINS-18410] AbstractTestResultAction should be a RunAction2 so it need not persist its owning build.