From 8c6a1e348d30efc34ccec6e2a2fd65a4f7083565 Mon Sep 17 00:00:00 2001
From: Ryan Petrello <rpetrell@redhat.com>
Date: Fri, 1 Dec 2017 10:48:11 -0500
Subject: [PATCH] upgrade survey encryption migration to work around an old
 survey bug

see: https://github.com/ansible/ansible-tower/issues/7800
---
 awx/main/migrations/_reencrypt.py | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/awx/main/migrations/_reencrypt.py b/awx/main/migrations/_reencrypt.py
index 7d5b0984ce..80a4eaff5c 100644
--- a/awx/main/migrations/_reencrypt.py
+++ b/awx/main/migrations/_reencrypt.py
@@ -92,7 +92,18 @@ def _encrypt_survey_passwords(Job, JobTemplate, WorkflowJob, WorkflowJobTemplate
             if jt.survey_spec.get('spec', []):
                 for field in jt.survey_spec['spec']:
                     if field.get('type') == 'password' and field.get('default', ''):
-                        if field['default'].startswith('$encrypted$'):
+                        default = field['default']
+                        if default.startswith('$encrypted$'):
+                            if default == '$encrypted$':
+                                # If you have a survey_spec with a literal
+                                # '$encrypted$' as the default, you have
+                                # encountered a known bug in awx/Tower
+                                # https://github.com/ansible/ansible-tower/issues/7800
+                                logger.error(
+                                    '{}.pk={} survey_spec has ambiguous $encrypted$ default for {}, needs attention...'.format(jt, jt.pk, field['variable'])
+                                )
+                                field['default'] = ''
+                                changed = True
                             continue
                         field['default'] = encrypt_value(field['default'], pk=None)
                         changed = True