CopyAPIView (awx\/awx\/api\/generics.py:873) sets permission_classes =
\n(IsAuthenticated,), so DRF’s get_object() performs no object-level
\nRBAC. The get() handler (lines 988\u2013991) explicitly guards with
\nrequest.user.can_access(obj._class_, ‘read’, obj) \u2014 but post()
\n(lines 1001\u20131010) does not. POST only checks:<\/p>\n
can_access(model, ‘add’, create_kwargs_check)<\/p>\n
can_access(model, ‘copy_related’, obj)<\/p>\n
For JobTemplate, can_add (awx\/awx\/main\/access.py:1465\u20131520) gates on<\/p>\n
inventory.use_role + project.use_role +
\nexecution_environment.read_role \u2014 resource-level roles that do not
\nimply read on the source JT \u2014 and can_copy_related (1522\u20131534) checks
\nonly credentials.use_role. None of these imply the caller can read the
\nsource JT.<\/p>\n","protected":false},"excerpt":{"rendered":"
CopyAPIView (awx\/awx\/api\/generics.py:873) sets permission_classes =
\n(IsAuthenticated,), so DRF’s get_object() performs no object-level
\nRBAC. The get() handler (lines 988\u2013991) explicitly guards with
\nre<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28119","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}