shaba/awx
1
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2024-11-01 16:51:11 +03:00
Code Releases Activity

Prevent relaunching an ad hoc command if the module is no longer in the allowed list. Fixes https://trello.com/c/NS3YX2DU

Browse Source
This commit is contained in:
Chris Church 2015-05-11 21:05:46 -04:00
parent 2d1d371582
commit 79c00dc511
2 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
awx/api/views.py
View File

@ -2405,6 +2405,21 @@ class AdHocCommandRelaunch(GenericAPIView):
if not request.user.can_access(self.model, 'start', obj):
raise PermissionDenied()
# Re-validate ad hoc command against serializer to check if module is
# still allowed.
data = {}
for field in ('job_type', 'inventory_id', 'limit', 'credential_id',
'module_name', 'module_args', 'forks', 'verbosity',
'become_enabled'):
if field.endswith('_id'):
data[field[:-3]] = getattr(obj, field)
else:
data[field] = getattr(obj, field)
serializer = self.get_serializer(data=data)
if not serializer.is_valid():
return Response(serializer.errors,
status=status.HTTP_400_BAD_REQUEST)
# Check for passwords needed before copying ad hoc command.
needed = obj.passwords_needed_to_start
provided = dict([(field, request.DATA.get(field, '')) for field in needed])

8
awx/main/tests/ad_hoc.py
View File

@ -719,6 +719,14 @@ class AdHocCommandApiTest(BaseAdHocCommandTest):
self.patch(url, {}, expect=401)
self.delete(url, expect=401)
# Try to relaunch ad hoc command when module has been removed from
# allowed list of modules.
with self.settings(AD_HOC_COMMANDS=[]):
with self.current_user('admin'):
response = self.get(url, expect=200)
self.assertEqual(response['passwords_needed_to_start'], [])
response = self.post(url, {}, expect=400)
# Try to relaunch after the inventory has been marked inactive.
self.inventory.mark_inactive()
with self.current_user('admin'):