From 55827611b6d8bec6b313ecc27b3a3d9ab4c31b44 Mon Sep 17 00:00:00 2001
From: Chris Meyers <chris.meyers.fsu@gmail.com>
Date: Thu, 15 Dec 2016 15:37:56 -0500
Subject: [PATCH] filter out ansible_* facts from provision callback extra_vars

related to #4358
---
 awx/api/views.py         |  5 ++++-
 awx/main/utils/common.py | 12 +++++++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/awx/api/views.py b/awx/api/views.py
index 826941ec5f..f19b61e4e9 100644
--- a/awx/api/views.py
+++ b/awx/api/views.py
@@ -65,6 +65,9 @@ from awx.api.generics import * # noqa
 from awx.conf.license import get_license, feature_enabled, feature_exists, LicenseForbids
 from awx.main.models import * # noqa
 from awx.main.utils import * # noqa
+from awx.main.utils import (
+    callback_filter_out_ansible_extra_vars
+)
 from awx.api.permissions import * # noqa
 from awx.api.renderers import * # noqa
 from awx.api.serializers import * # noqa
@@ -2663,7 +2666,7 @@ class JobTemplateCallback(GenericAPIView):
         # Send a signal to celery that the job should be started.
         kv = {"inventory_sources_already_updated": inventory_sources_already_updated}
         if extra_vars is not None:
-            kv['extra_vars'] = extra_vars
+            kv['extra_vars'] = callback_filter_out_ansible_extra_vars(extra_vars)
         result = job.signal_start(**kv)
         if not result:
             data = dict(msg=_('Error starting job!'))
diff --git a/awx/main/utils/common.py b/awx/main/utils/common.py
index 00937a84c1..bed0588287 100644
--- a/awx/main/utils/common.py
+++ b/awx/main/utils/common.py
@@ -43,7 +43,8 @@ __all__ = ['get_object_or_400', 'get_object_or_403', 'camelcase_to_underscore',
            'copy_m2m_relationships' ,'cache_list_capabilities', 'to_python_boolean',
            'ignore_inventory_computed_fields', 'ignore_inventory_group_removal',
            '_inventory_updates', 'get_pk_from_dict', 'getattrd', 'NoDefaultProvided',
-           'get_current_apps', 'set_current_apps', 'OutputEventFilter']
+           'get_current_apps', 'set_current_apps', 'OutputEventFilter',
+           'callback_filter_out_ansible_extra_vars',]
 
 
 def get_object_or_400(klass, *args, **kwargs):
@@ -824,3 +825,12 @@ class OutputEventFilter(object):
             self._current_event_data = next_event_data
         else:
             self._current_event_data = None
+
+
+def callback_filter_out_ansible_extra_vars(extra_vars):
+    extra_vars_redacted = {}
+    for key, value in extra_vars.iteritems():
+        if not key.startswith('ansible_'):
+            extra_vars_redacted[key] = value
+    return extra_vars_redacted
+