validate extra_vars, but get them from request.DATA

awx/api/serializers.py

@@ -6,7 +6,6 @@ import json
 import re
 import logging
 from dateutil import rrule
-from ast import literal_eval
 
 # PyYAML
 import yaml
@@ -1759,15 +1758,14 @@ class JobLaunchSerializer(BaseSerializer):
 
     def validate_extra_vars(self, attrs, source):
         extra_vars = attrs.get(source, {})
-        if not extra_vars:
-            return attrs
 
         try:
-            extra_vars = literal_eval(extra_vars)
+            extra_vars = json.loads(extra_vars)
-            attrs['extra_vars'] = extra_vars
+        except (ValueError, TypeError):
-        except Exception:
+            try:
-            if not isinstance(extra_vars, dict):
+                extra_vars = yaml.safe_load(extra_vars)
-                raise serializers.ValidationError("Invalid format. JSON expected.")
+            except (yaml.YAMLError, TypeError):
+                raise serializers.ValidationError('Must be valid JSON or YAML')
         return attrs
 
     def validate_variables_needed_to_start(self, attrs, source):

awx/api/views.py

@@ -1455,8 +1455,9 @@ class JobTemplateLaunch(RetrieveAPIView, GenericAPIView):
 
         kv = {
             'credential': serializer.object.credential.pk,
-            'extra_vars': serializer.object.extra_vars
         }
+        if 'extra_vars' in request.DATA:
+            kv['extra_vars'] = request.DATA['extra_vars']
         kv.update(passwords)
 
         new_job = obj.create_unified_job(**kv)