Fix for AC-310. Change how we unattach a group from a parent group when it has no other parents, mark it inactive instead of just removing the relationship.

awx/main/views.py

@@ -420,13 +420,26 @@ class GroupChildrenList(SubListCreateAPIView):
         Special case for disassociating a child group from the parent. If the
         child group has no more parents, then automatically mark it inactive.
         '''
-        response = super(GroupChildrenList, self).unattach(request, *args, **kwargs)
-        if response.status_code != status.HTTP_204_NO_CONTENT:
-            return response
-        sub = self.model.objects.get(pk=request.DATA.get('id', None))
-        if sub.parents.filter(active=True).count() == 0:
+        sub_id = request.DATA.get('id', None)
+        if not sub_id:
+            data = dict(msg='"id" is required to disassociate')
+            return Response(data, status=status.HTTP_400_BAD_REQUEST)
+
+        parent = self.get_parent_object()
+        parent_key = getattr(self, 'parent_key', None)
+        relationship = getattr(parent, self.relationship)
+        sub = get_object_or_400(self.model, pk=sub_id)
+
+        if not request.user.can_access(self.parent_model, 'unattach', parent,
+                                       sub, self.relationship):
+            raise PermissionDenied()
+
+        if sub.parents.filter(active=True).exclude(pk=parent.pk).count() == 0:
             sub.mark_inactive()
-        return response
+        else:
+            relationship.remove(sub)
+
+        return Response(status=status.HTTP_204_NO_CONTENT)
 
 class GroupHostsList(SubListCreateAPIView):
     ''' the list of hosts directly below a group '''