zware/awx
1
0
Fork 0
mirror of https://github.com/ZwareBear/awx.git synced 2026-05-13 15:58:41 -05:00
Code Issues Packages Projects Releases Wiki Activity

protect launch endpoint against certain falsy values

Browse Source
This commit is contained in:
AlanCoding
2016-06-15 10:52:25 -04:00
parent 490425970a
commit 5af6d14f27
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
awx/api/views.py
+2 -2
View File
@@ -2325,12 +2325,12 @@ class JobTemplateLaunch(RetrieveAPIView, GenericAPIView):
prompted_fields, ignored_fields = obj._accept_or_ignore_job_kwargs(**request.data)
if 'credential' in prompted_fields and prompted_fields['credential'] != getattrd(obj, 'credential.pk', None):
new_credential = Credential.objects.get(pk=prompted_fields['credential'])
new_credential = get_object_or_400(Credential, pk=get_pk_from_dict(prompted_fields, 'credential'))
if request.user not in new_credential.use_role:
raise PermissionDenied()
if 'inventory' in prompted_fields and prompted_fields['inventory'] != getattrd(obj, 'inventory.pk', None):
new_inventory = Inventory.objects.get(pk=prompted_fields['inventory'])
new_inventory = get_object_or_400(Inventory, pk=get_pk_from_dict(prompted_fields, 'inventory'))
if request.user not in new_inventory.use_role:
raise PermissionDenied()