External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-06 11:11:07 -03:30
Code Issues Packages Projects Releases Wiki Activity

do not expose the notication secret fields

Browse Source
This commit is contained in:
chris meyers
2019-08-14 10:06:01 -04:00
parent 31308e3795
commit 9fa4dac847
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
awx/api/serializers.py
View File

@@ -4212,6 +4212,7 @@ class NotificationTemplateSerializer(BaseSerializer):
notification_class = NotificationTemplate.CLASS_FOR_NOTIFICATION_TYPE[notification_type] notification_class = NotificationTemplate.CLASS_FOR_NOTIFICATION_TYPE[notification_type]
missing_fields = [] missing_fields = []
incorrect_type_fields = [] incorrect_type_fields = []
password_fields_to_forward = []
error_list = [] error_list = []
if 'notification_configuration' not in attrs: if 'notification_configuration' not in attrs:
return attrs return attrs
@@ -4236,7 +4237,7 @@ class NotificationTemplateSerializer(BaseSerializer):
error_list.append(_("No values specified for field '{}'").format(field)) error_list.append(_("No values specified for field '{}'").format(field))
continue continue
if field_type == "password" and field_val == "$encrypted$" and object_actual is not None: if field_type == "password" and field_val == "$encrypted$" and object_actual is not None:
attrs['notification_configuration'][field] = object_actual.notification_configuration[field] password_fields_to_forward.append(field)
if field == "http_method" and field_val.lower() not in ['put', 'post']: if field == "http_method" and field_val.lower() not in ['put', 'post']:
error_list.append(_("HTTP method must be either 'POST' or 'PUT'.")) error_list.append(_("HTTP method must be either 'POST' or 'PUT'."))
if missing_fields: if missing_fields:
@@ -4247,6 +4248,13 @@ class NotificationTemplateSerializer(BaseSerializer):
type_field_error[1])) type_field_error[1]))
if error_list: if error_list:
raise serializers.ValidationError(error_list) raise serializers.ValidationError(error_list)
# Only pull the exisitng encrypted passwords from the existing objects
# to assign to the attribute and forward on the call stack IF AND ONLY IF
# we know an error will not be raised in the validation phase.
# Otherwise, the encrypted password will be exposed.
for field in password_fields_to_forward:
attrs['notification_configuration'][field] = object_actual.notification_configuration[field]
return super(NotificationTemplateSerializer, self).validate(attrs) return super(NotificationTemplateSerializer, self).validate(attrs)