diff --git a/awx/main/access.py b/awx/main/access.py index ad40a3dafe..f2a00a6417 100644 --- a/awx/main/access.py +++ b/awx/main/access.py @@ -1048,10 +1048,6 @@ class JobTemplateAccess(BaseAccess): return qs.select_related('created_by', 'modified_by', 'inventory', 'project', 'credential', 'cloud_credential', 'next_schedule').all() - @check_superuser - def can_read(self, obj): - return self.user in obj.read_role - def can_add(self, data): ''' a user can create a job template if they are a superuser, an org admin diff --git a/awx/main/tests/functional/test_rbac_job_templates.py b/awx/main/tests/functional/test_rbac_job_templates.py index 13e0da8e8c..f3868daeb7 100644 --- a/awx/main/tests/functional/test_rbac_job_templates.py +++ b/awx/main/tests/functional/test_rbac_job_templates.py @@ -226,6 +226,14 @@ def test_job_template_access_org_admin(jt_objects, rando): assert access.can_delete(jt_objects.job_template) +@pytest.mark.django_db +def test_orphan_JT_readable_by_system_auditor(job_template, system_auditor): + assert system_auditor.is_system_auditor + assert job_template.project is None + access = JobTemplateAccess(system_auditor) + assert access.can_read(job_template) + + @pytest.mark.django_db @pytest.mark.job_permissions def test_job_template_creator_access(project, rando, post):