diff --git a/awx/main/access.py b/awx/main/access.py index 582a402adb..5fa3b76274 100644 --- a/awx/main/access.py +++ b/awx/main/access.py @@ -655,7 +655,7 @@ class CredentialAccess(BaseAccess): return False # Cannot change the organization for a credential after it's been created - if 'organization' in data: + if data and 'organization' in data: organization_pk = get_pk_from_dict(data, 'organization') if (organization_pk and (not obj.organization or organization_pk != obj.organization.id)) \ or (not organization_pk and obj.organization): diff --git a/awx/main/tests/functional/test_rbac_credential.py b/awx/main/tests/functional/test_rbac_credential.py index 3b154d6f42..dad60524e0 100644 --- a/awx/main/tests/functional/test_rbac_credential.py +++ b/awx/main/tests/functional/test_rbac_credential.py @@ -133,29 +133,6 @@ def test_org_credential_access_member(alice, org_credential, credential): 'description': 'New description.', 'organization': None}) -@pytest.mark.django_db -def test_credential_access_org_permissions( - org_admin, org_member, organization, org_credential, credential): - credential.admin_role.members.add(org_admin) - credential.admin_role.members.add(org_member) - org_credential.admin_role.members.add(org_member) - - access = CredentialAccess(org_admin) - member_access = CredentialAccess(org_member) - - # Org admin can move their own credential into their org - assert access.can_change(credential, {'organization': organization.pk}) - # Org member can not - assert not member_access.can_change(credential, { - 'organization': organization.pk}) - - # Org admin can remove a credential from their org - assert access.can_change(org_credential, {'organization': None}) - # Org member can not - assert not member_access.can_change(org_credential, {'organization': None}) - assert not member_access.can_change(org_credential, { - 'user': org_member.pk, 'organization': None}) - @pytest.mark.django_db def test_cred_job_template_xfail(user, deploy_jobtemplate): ' Personal credential migration ' @@ -256,11 +233,6 @@ def test_single_cred_multi_job_template_multi_org(user, organizations, credentia credential.refresh_from_db() assert jts[0].credential != jts[1].credential - assert access.can_change(jts[0].credential, {'organization': org.pk}) - assert access.can_change(jts[1].credential, {'organization': org.pk}) - - orgs[0].admin_role.members.remove(a) - assert not access.can_change(jts[0].credential, {'organization': org.pk}) @pytest.mark.django_db def test_cred_inventory_source(user, inventory, credential):