Fix 500 error when ordinary user viewed system JTs

awx/main/access.py

@@ -1843,6 +1843,11 @@ class SystemJobTemplateAccess(BaseAccess):
 
  model = SystemJobTemplate
 
+ def filtered_queryset(self):
+ if self.user.is_superuser or self.user.is_system_auditor:
+ return self.model.objects.all()
+ return self.model.objects.none()
+
  @check_superuser
  def can_start(self, obj, validate_license=True):
  '''Only a superuser can start a job from a SystemJobTemplate'''

awx/main/tests/functional/test_rbac_job.py

@@ -2,7 +2,7 @@
 
 from rest_framework.exceptions import PermissionDenied
 
-from awx.main.access import JobAccess, JobLaunchConfigAccess, AdHocCommandAccess, InventoryUpdateAccess, ProjectUpdateAccess
+from awx.main.access import JobAccess, JobLaunchConfigAccess, AdHocCommandAccess, InventoryUpdateAccess, ProjectUpdateAccess, SystemJobTemplateAccess
 from awx.main.models import (
  Job,
  JobLaunchConfig,
@@ -350,3 +350,21 @@ def test_can_use_minor(self, rando):
 
  assert access.can_use(config)
  assert rando.can_access(JobLaunchConfig, 'use', config)
+
+
+@pytest.mark.django_db
+class TestSystemJobTemplateAccess:
+ def test_system_job_template_auditor(self, system_auditor, system_job_template):
+ access = SystemJobTemplateAccess(system_auditor)
+ assert access.can_read(system_job_template)
+ assert not access.can_start(system_job_template)
+
+ def test_system_job_template_rando(self, rando, system_job_template):
+ access = SystemJobTemplateAccess(rando)
+ assert not access.can_read(system_job_template)
+ assert not access.can_start(system_job_template)
+
+ def test_system_job_template_superuser(self, admin_user, system_job_template):
+ access = SystemJobTemplateAccess(admin_user)
+ assert access.can_read(system_job_template)
+ assert access.can_start(system_job_template)

awx/main/tests/unit/test_access.py

@@ -5,7 +5,7 @@
 from django.forms.models import model_to_dict
 from rest_framework.exceptions import ParseError
 
-from awx.main.access import BaseAccess, check_superuser, JobTemplateAccess, WorkflowJobTemplateAccess, SystemJobTemplateAccess, vars_are_encrypted
+from awx.main.access import BaseAccess, check_superuser, JobTemplateAccess, WorkflowJobTemplateAccess, vars_are_encrypted
 
 from awx.main.models import (
  Credential,
@@ -239,14 +239,3 @@ def can_copy(self, obj):
  foo = object()
  foo_capabilities = foo_access.get_user_capabilities(foo, ['edit', 'copy'])
  assert foo_capabilities == {'edit': 'bar', 'copy': 'foo'}
-
-
-def test_system_job_template_can_start(mocker):
- user = mocker.MagicMock(spec=User, id=1, is_system_auditor=True, is_superuser=False)
- assert user.is_system_auditor
- access = SystemJobTemplateAccess(user)
- assert not access.can_start(None)
-
- user.is_superuser = True
- access = SystemJobTemplateAccess(user)
- assert access.can_start(None)