Merge pull request #273 from chrismeyersfsu/fix-job_launch_credential_permissions

restrict the set of valid, explicitly supplied credentials to be ones readable by the user

awx/api/views.py

@@ -1755,6 +1755,10 @@ class JobTemplateLaunch(RetrieveAPIView, GenericAPIView):
         if not serializer.is_valid():
             return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
 
+        # At this point, a credential is gauranteed to exist at serializer.object.credential
+        if not request.user.can_access(Credential, 'read', serializer.object.credential):
+            raise PermissionDenied()
+
         kv = {
             'credential': serializer.object.credential.pk,
         }