From ed64d4521c365454ed9deba94dcfb9b57ab6cb57 Mon Sep 17 00:00:00 2001
From: Wayne Witzel III <wayne@riotousliving.com>
Date: Fri, 23 Sep 2016 10:10:39 -0400
Subject: [PATCH] Remerge: only allow superusers to start a job from a
 SystemJobTemplate

---
 awx/main/access.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/awx/main/access.py b/awx/main/access.py
index d2180cadaa..a33503920f 100644
--- a/awx/main/access.py
+++ b/awx/main/access.py
@@ -1320,8 +1320,10 @@ class SystemJobTemplateAccess(BaseAccess):
 
     model = SystemJobTemplate
 
-    def can_start(self, obj, validate_license=True):
-        return self.can_read(obj)
+    @check_superuser
+    def can_start(self, obj):
+        '''Only a superuser can start a job from a SystemJobTemplate'''
+        return False
 
 class SystemJobAccess(BaseAccess):
     '''