{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/awx/issues/2024","repository_url":"https://api.github.com/repos/ansible/awx","labels_url":"https://api.github.com/repos/ansible/awx/issues/2024/labels{/name}","comments_url":"https://api.github.com/repos/ansible/awx/issues/2024/comments","events_url":"https://api.github.com/repos/ansible/awx/issues/2024/events","html_url":"https://github.com/ansible/awx/issues/2024","id":336274687,"node_id":"MDU6SXNzdWUzMzYyNzQ2ODc=","number":2024,"title":"Allow search on `extra_vars`","user":{"login":"mponton","id":822167,"node_id":"MDQ6VXNlcjgyMjE2Nw==","avatar_url":"https://avatars1.githubusercontent.com/u/822167?v=4","gravatar_id":"","url":"https://api.github.com/users/mponton","html_url":"https://github.com/mponton","followers_url":"https://api.github.com/users/mponton/followers","following_url":"https://api.github.com/users/mponton/following{/other_user}","gists_url":"https://api.github.com/users/mponton/gists{/gist_id}","starred_url":"https://api.github.com/users/mponton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mponton/subscriptions","organizations_url":"https://api.github.com/users/mponton/orgs","repos_url":"https://api.github.com/users/mponton/repos","events_url":"https://api.github.com/users/mponton/events{/privacy}","received_events_url":"https://api.github.com/users/mponton/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-06-27T15:17:03Z","updated_at":"2018-06-27T15:58:46Z","closed_at":"2018-06-27T15:27:41Z","author_association":"NONE","body":"<!---\r\nThe Ansible community is highly committed to the security of our open source\r\nprojects.  Security concerns should be reported directly by email to\r\nsecurity@ansible.com.  For more information on the Ansible community's\r\npractices regarding responsible disclosure, see\r\nhttps://www.ansible.com/security\r\n-->\r\n\r\n##### ISSUE TYPE\r\n<!--- Pick one below and delete the rest: -->\r\n - Feature Idea\r\n\r\n##### COMPONENT NAME\r\n<!-- Pick the area of AWX for this issue, you can have multiple, delete the rest: -->\r\n - API\r\n\r\n##### SUMMARY\r\n<!-- Briefly describe the problem. -->\r\nAPI forbids search on `extra_vars` with this error:\r\n```json\r\n{\r\n\"detail\": \"Filtering on extra_vars is not allowed.\"\r\n}\r\n```\r\nI am not sure why this is expressly restricted in the code like this:\r\n```python\r\n    extra_vars = prevent_search(models.TextField(\r\n        blank=True,\r\n        default='',\r\n    ))\r\n```\r\nThe `extra_vars` are visible to any users that has access to the jobs. So I am not sure why search should be prevented.\r\n\r\n##### ENVIRONMENT\r\n* AWX version: 3.2.3\r\n* AWX install method: Official RH Tower distribution\r\n* Ansible version:  2.4.2\r\n* Operating System: RHEL v7.3\r\n* Web Browser: Chrome\r\n\r\n##### STEPS TO REPRODUCE\r\n\r\n```\r\nhttps://your-tower-host/api/v2/jobs/?extra_vars=foo\r\n```\r\n\r\n##### EXPECTED RESULTS\r\n\r\nWould expect to be able to search on this field.\r\n\r\n##### ACTUAL RESULTS\r\n\r\n```\r\nHTTP 403 Forbidden\r\nAllow: GET, HEAD, OPTIONS\r\nContent-Type: application/json\r\nVary: Accept\r\nX-API-Node: your-tower-host\r\nX-API-Time: 0.094s\r\n\r\n\r\n{\r\n    \"detail\": \"Filtering on extra_vars is not allowed.\"\r\n}\r\n```\r\n\r\n##### ADDITIONAL INFORMATION\r\n\r\nWe have a particularly good use case for this. We have jobs that run on a specific set of hosts to \"pre-stage\" servers (e.g. into Active Directory) before these servers are provisioned. `extra_vars` contains the different values including the name of the server to pre-stage. When looking at a bunch of jobs in Tower, we see the same job name, limit, etc... The only field differentiating jobs is `extra_vars`. Not being able to search on it makes the UI (and API) quite limited. \r\n"},"comment":{"url":"https://api.github.com/repos/ansible/awx/issues/comments/400729538","html_url":"https://github.com/ansible/awx/issues/2024#issuecomment-400729538","issue_url":"https://api.github.com/repos/ansible/awx/issues/2024","id":400729538,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMDcyOTUzOA==","user":{"login":"mponton","id":822167,"node_id":"MDQ6VXNlcjgyMjE2Nw==","avatar_url":"https://avatars1.githubusercontent.com/u/822167?v=4","gravatar_id":"","url":"https://api.github.com/users/mponton","html_url":"https://github.com/mponton","followers_url":"https://api.github.com/users/mponton/followers","following_url":"https://api.github.com/users/mponton/following{/other_user}","gists_url":"https://api.github.com/users/mponton/gists{/gist_id}","starred_url":"https://api.github.com/users/mponton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mponton/subscriptions","organizations_url":"https://api.github.com/users/mponton/orgs","repos_url":"https://api.github.com/users/mponton/repos","events_url":"https://api.github.com/users/mponton/events{/privacy}","received_events_url":"https://api.github.com/users/mponton/received_events","type":"User","site_admin":false},"created_at":"2018-06-27T15:58:46Z","updated_at":"2018-06-27T15:58:46Z","author_association":"NONE","body":"@wenottingham OK, I appreciate the explanation. I am pushing my luck a bit here (I know your time is precious and I don't want to waste it, just trying to better understand the actual issue), I am assuming your are talking about credentials passed as extra vars as defined in Tower, right?\r\n\r\nWe have a set of these credentials (e.g. for API calls to our CMDB), and after my previous comment I looked into it and confirmed what you told me: I cannot see these credential vars in the UI nor in the API output when listing jobs.\r\n\r\nSo if the API already strips then from the output, wouldn't it be doable to search on the resulting string instead? Or is the search implementation limited to queries on the \"raw\" value only? If there was a \"safe\" way of doing this, would you guys consider integrating it?\r\n\r\nThanks for your time and all the work you put in this project."}}
{"actor":{"display_login":"mponton"}}