diff --git a/awx/main/models/jobs.py b/awx/main/models/jobs.py index c233269ce9..4709ab43c6 100644 --- a/awx/main/models/jobs.py +++ b/awx/main/models/jobs.py @@ -747,7 +747,9 @@ class Job(UnifiedJob, JobOptions): ''' if self.survey_passwords: extra_vars = json.loads(self.extra_vars) - extra_vars.update(self.survey_passwords) + for key, value in self.survey_passwords.items(): + if key in extra_vars: + extra_vars[key] = value return json.dumps(extra_vars) else: return self.extra_vars diff --git a/awx/main/tests/unit/models/test_job_unit.py b/awx/main/tests/unit/models/test_job_unit.py index 1b66681dcf..9de1f77ee6 100644 --- a/awx/main/tests/unit/models/test_job_unit.py +++ b/awx/main/tests/unit/models/test_job_unit.py @@ -32,6 +32,21 @@ def test_job_survey_password_redaction(): 'secret_key': '$encrypted$', 'SSN': '$encrypted$'} +@pytest.mark.survey +def test_survey_passwords_not_in_extra_vars(): + """Tests that survey passwords not included in extra_vars are + not included when displaying job information""" + job = Job( + name="test-survey-not-in", + extra_vars=json.dumps({ + 'submitter_email': 'foobar@redhat.com'}), + survey_passwords={ + 'secret_key': '$encrypted$', + 'SSN': '$encrypted$'}) + assert json.loads(job.display_extra_vars()) == { + 'submitter_email': 'foobar@redhat.com', + } + def test_job_safe_args_redacted_passwords(job): """Verify that safe_args hides passwords in the job extra_vars""" kwargs = {'ansible_version': '2.1'}