From 60da24d82fbcf06c8d4629edaf309aa85c39efea Mon Sep 17 00:00:00 2001
From: Ryan Petrello <rpetrell@redhat.com>
Date: Thu, 27 Jul 2017 11:19:23 -0400
Subject: [PATCH] fix a few activity stream bugs related to setting
 creation/update

* when a setting is created, only create *one* activity stream record
  for the creation, not one for create and another for update (similar
  to https://github.com/ansible/tower/pull/53)
* add code to hide `$encrypted$` activity stream content

see: https://github.com/ansible/ansible-tower/issues/7320
---
 awx/conf/models.py       | 6 ++++--
 awx/main/utils/common.py | 6 +++++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/awx/conf/models.py b/awx/conf/models.py
index 5c26e17c54..afdacb1757 100644
--- a/awx/conf/models.py
+++ b/awx/conf/models.py
@@ -65,8 +65,10 @@ class Setting(CreatedModifiedModel):
         # After saving a new instance for the first time, set the encrypted
         # field and save again.
         if encrypted and new_instance:
-            self.value = self._saved_value
-            self.save(update_fields=['value'])
+            from awx.main.signals import disable_activity_stream
+            with disable_activity_stream():
+                self.value = self._saved_value
+                self.save(update_fields=['value'])
 
     @classmethod
     def get_cache_key(self, key):
diff --git a/awx/main/utils/common.py b/awx/main/utils/common.py
index 1005ad74c8..58d795567f 100644
--- a/awx/main/utils/common.py
+++ b/awx/main/utils/common.py
@@ -16,6 +16,7 @@ import urlparse
 import threading
 import contextlib
 import tempfile
+import six
 
 # Decorator
 from decorator import decorator
@@ -325,7 +326,10 @@ def _convert_model_field_for_display(obj, field_name, password_fields=None):
         return '<missing {}>-{}'.format(obj._meta.verbose_name, getattr(obj, '{}_id'.format(field_name)))
     if password_fields is None:
         password_fields = set(getattr(type(obj), 'PASSWORD_FIELDS', [])) | set(['password'])
-    if field_name in password_fields:
+    if field_name in password_fields or (
+        isinstance(field_val, six.string_types) and
+        field_val.startswith('$encrypted$')
+    ):
         return u'hidden'
     if hasattr(obj, 'display_%s' % field_name):
         field_val = getattr(obj, 'display_%s' % field_name)()