Merge pull request #746 from AlanCoding/i_forgot

Intentionally forget start_args when job is done

awx/main/migrations/0011_blank_start_args.py

@@ -0,0 +1,22 @@
+# -*- coding: utf-8 -*-
+# Python
+from __future__ import unicode_literals
+
+# Django
+from django.db import migrations, models
+
+# AWX
+from awx.main.migrations import _migration_utils as migration_utils
+from awx.main.migrations._reencrypt import blank_old_start_args
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('main', '0010_saved_launchtime_configs'),
+    ]
+
+    operations = [
+        migrations.RunPython(migration_utils.set_current_apps_for_migrations, migrations.RunPython.noop),
+        migrations.RunPython(blank_old_start_args, migrations.RunPython.noop),
+    ]

awx/main/migrations/_reencrypt.py

@@ -74,3 +74,20 @@ def _unified_jobs(apps):
                 uj.start_args = decrypt_field(uj, 'start_args')
                 uj.start_args = encrypt_field(uj, 'start_args')
                 uj.save()
+
+
+def blank_old_start_args(apps, schema_editor):
+    UnifiedJob = apps.get_model('main', 'UnifiedJob')
+    for uj in UnifiedJob.objects.defer('result_stdout_text').exclude(start_args='').iterator():
+        if uj.status in ['running', 'pending', 'new', 'waiting']:
+            continue
+        try:
+            args_dict = decrypt_field(uj, 'start_args')
+        except ValueError:
+            args_dict = None
+        if args_dict == {}:
+            continue
+        if uj.start_args:
+            logger.debug('Blanking job args for %s', uj.pk)
+            uj.start_args = ''
+            uj.save()

awx/main/models/unified_jobs.py

@@ -1236,7 +1236,8 @@ class UnifiedJob(PolymorphicModel, PasswordFieldsModel, CommonModelNameNotUnique
 
             if not self.cancel_flag:
                 self.cancel_flag = True
-                cancel_fields = ['cancel_flag']
+                self.start_args = ''  # blank field to remove encrypted passwords
+                cancel_fields = ['cancel_flag', 'start_args']
                 if self.status in ('pending', 'waiting', 'new'):
                     self.status = 'canceled'
                     cancel_fields.append('status')

awx/main/scheduler/task_manager.py

@@ -479,6 +479,7 @@ class TaskManager():
                 if isolated:
                     new_status = 'error'
                 task.status = new_status
+                task.start_args = ''  # blank field to remove encrypted passwords
                 if isolated:
                     # TODO: cancel and reap artifacts of lost jobs from heartbeat
                     task.job_explanation += ' '.join((
@@ -493,7 +494,7 @@ class TaskManager():
                         'Celery, so it has been marked as failed.',
                     ))
                 try:
-                    task.save(update_fields=['status', 'job_explanation'])
+                    task.save(update_fields=['status', 'start_args', 'job_explanation'])
                 except DatabaseError:
                     logger.error("Task {} DB error in marking failed. Job possibly deleted.".format(task.log_format))
                     continue

awx/main/tasks.py

@@ -759,7 +759,8 @@ class BaseTask(LogErrorsTask):
         execution_node = settings.CLUSTER_HOST_ID
         if isolated_host is not None:
             execution_node = isolated_host
-        instance = self.update_model(pk, status='running', execution_node=execution_node)
+        instance = self.update_model(pk, status='running', execution_node=execution_node,
+                                     start_args='')  # blank field to remove encrypted passwords
 
         instance.websocket_emit_status("running")
         status, rc, tb = 'error', None, ''

awx/main/tests/unit/models/test_unified_job_unit.py

@@ -52,7 +52,7 @@ def test_cancel(unified_job):
     # Some more thought may want to go into only emitting canceled if/when the job record
     # status is changed to canceled. Unlike, currently, where it's emitted unconditionally.
     unified_job.websocket_emit_status.assert_called_with("canceled")
-    unified_job.save.assert_called_with(update_fields=['cancel_flag', 'status'])
+    unified_job.save.assert_called_with(update_fields=['cancel_flag', 'start_args', 'status'])
 
 
 def test_cancel_job_explanation(unified_job):
@@ -61,7 +61,7 @@ def test_cancel_job_explanation(unified_job):
     unified_job.cancel(job_explanation=job_explanation)
 
     assert unified_job.job_explanation == job_explanation
-    unified_job.save.assert_called_with(update_fields=['cancel_flag', 'status', 'job_explanation'])
+    unified_job.save.assert_called_with(update_fields=['cancel_flag', 'start_args', 'status', 'job_explanation'])
 
 
 def test_log_representation():

awx/main/tests/unit/test_tasks.py

@@ -271,7 +271,7 @@ class TestGenericRun(TestJobExecution):
         with pytest.raises(Exception):
             self.task.run(self.pk)
         for c in [
-            mock.call(self.pk, execution_node=settings.CLUSTER_HOST_ID, status='running'),
+            mock.call(self.pk, execution_node=settings.CLUSTER_HOST_ID, status='running', start_args=''),
             mock.call(self.pk, status='canceled')
         ]:
             assert c in self.task.update_model.call_args_list