From 2de6e7b016a3bb0c76fa13837614a5b65c9e14f9 Mon Sep 17 00:00:00 2001
From: Chris Meyers <chris.meyers.fsu@gmail.com>
Date: Mon, 27 Apr 2015 16:17:47 -0400
Subject: [PATCH] validate extra_vars, but get them from request.DATA

---
 awx/api/serializers.py | 14 ++++++--------
 awx/api/views.py       |  3 ++-
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/awx/api/serializers.py b/awx/api/serializers.py
index 0160b5e90b..1d2589db30 100644
--- a/awx/api/serializers.py
+++ b/awx/api/serializers.py
@@ -6,7 +6,6 @@ import json
 import re
 import logging
 from dateutil import rrule
-from ast import literal_eval
 
 # PyYAML
 import yaml
@@ -1759,15 +1758,14 @@ class JobLaunchSerializer(BaseSerializer):
 
     def validate_extra_vars(self, attrs, source):
         extra_vars = attrs.get(source, {})
-        if not extra_vars:
-            return attrs
 
         try:
-            extra_vars = literal_eval(extra_vars)
-            attrs['extra_vars'] = extra_vars
-        except Exception:
-            if not isinstance(extra_vars, dict):
-                raise serializers.ValidationError("Invalid format. JSON expected.")
+            extra_vars = json.loads(extra_vars)
+        except (ValueError, TypeError):
+            try:
+                extra_vars = yaml.safe_load(extra_vars)
+            except (yaml.YAMLError, TypeError):
+                raise serializers.ValidationError('Must be valid JSON or YAML')
         return attrs
 
     def validate_variables_needed_to_start(self, attrs, source):
diff --git a/awx/api/views.py b/awx/api/views.py
index 699f816e9f..81914427f9 100644
--- a/awx/api/views.py
+++ b/awx/api/views.py
@@ -1455,8 +1455,9 @@ class JobTemplateLaunch(RetrieveAPIView, GenericAPIView):
 
         kv = {
             'credential': serializer.object.credential.pk,
-            'extra_vars': serializer.object.extra_vars
         }
+        if 'extra_vars' in request.DATA:
+            kv['extra_vars'] = request.DATA['extra_vars']
         kv.update(passwords)
 
         new_job = obj.create_unified_job(**kv)