Merge pull request #6962 from ryanpetrello/fix-6959

prevent creation of custom credential types that != 'cloud || network`

awx/api/serializers.py

@@ -1904,6 +1904,11 @@ class CredentialTypeSerializer(BaseSerializer):
                 )
         ret = super(CredentialTypeSerializer, self).validate(attrs)
 
+        if 'kind' in attrs and attrs['kind'] not in ('cloud', 'network'):
+            raise serializers.ValidationError({
+                "kind": _("Must be 'cloud' or 'network', not %s") % attrs['kind']
+            })
+
         fields = attrs.get('inputs', {}).get('fields', [])
         for field in fields:
             if field.get('ask_at_runtime', False):

awx/main/tests/functional/api/test_credential_type.py

@@ -143,6 +143,28 @@ def test_create_managed_by_tower_readonly(get, post, admin):
     assert response.data['results'][0]['managed_by_tower'] is False
 
 
+@pytest.mark.django_db
+@pytest.mark.parametrize('kind', ['ssh', 'vault', 'scm', 'insights'])
+def test_create_invalid_kind(kind, get, post, admin):
+    response = post(reverse('api:credential_type_list'), {
+        'kind': kind,
+        'name': 'My Custom Type',
+        'inputs': {
+            'fields': [{
+                'id': 'api_token',
+                'label': 'API Token',
+                'type': 'string',
+                'secret': True
+            }]
+        },
+        'injectors': {}
+    }, admin)
+    assert response.status_code == 400
+
+    response = get(reverse('api:credential_type_list'), admin)
+    assert response.data['count'] == 0
+
+
 @pytest.mark.django_db
 def test_create_with_valid_inputs(get, post, admin):
     response = post(reverse('api:credential_type_list'), {