External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-01-14 03:10:42 -03:30
Code Issues Packages Projects Releases Wiki Activity

do not expose the notication secret fields

Browse Source
This commit is contained in:
chris meyers 2019-08-14 10:06:01 -04:00
parent 31308e3795
commit 9fa4dac847
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
awx/api/serializers.py
View File

@ -4212,6 +4212,7 @@ class NotificationTemplateSerializer(BaseSerializer):
notification_class = NotificationTemplate.CLASS_FOR_NOTIFICATION_TYPE[notification_type]
missing_fields = []
incorrect_type_fields = []
password_fields_to_forward = []
error_list = []
if 'notification_configuration' not in attrs:
return attrs
@ -4236,7 +4237,7 @@ class NotificationTemplateSerializer(BaseSerializer):
error_list.append(_("No values specified for field '{}'").format(field))
continue
if field_type == "password" and field_val == "$encrypted$" and object_actual is not None:
attrs['notification_configuration'][field] = object_actual.notification_configuration[field]
password_fields_to_forward.append(field)
if field == "http_method" and field_val.lower() not in ['put', 'post']:
error_list.append(_("HTTP method must be either 'POST' or 'PUT'."))
if missing_fields:
@ -4247,6 +4248,13 @@ class NotificationTemplateSerializer(BaseSerializer):
type_field_error[1]))
if error_list:
raise serializers.ValidationError(error_list)
# Only pull the exisitng encrypted passwords from the existing objects
# to assign to the attribute and forward on the call stack IF AND ONLY IF
# we know an error will not be raised in the validation phase.
# Otherwise, the encrypted password will be exposed.
for field in password_fields_to_forward:
attrs['notification_configuration'][field] = object_actual.notification_configuration[field]
return super(NotificationTemplateSerializer, self).validate(attrs)