Reworking internal result flags and making sure include_vars hides vault data

Fixes #10194

lib/ansible/executor/process/result.py

@@ -131,19 +131,19 @@ class ResultProcess(multiprocessing.Process):
 
                     for result_item in result_items:
                         # if this task is notifying a handler, do it now
-                        if 'ansible_notify' in result_item:
+                        if '_ansible_notify' in result_item:
                             if result.is_changed():
                                 # The shared dictionary for notified handlers is a proxy, which
                                 # does not detect when sub-objects within the proxy are modified.
                                 # So, per the docs, we reassign the list so the proxy picks up and
                                 # notifies all other threads
-                                for notify in result_item['ansible_notify']:
+                                for notify in result_item['_ansible_notify']:
                                     if result._task._role:
                                         role_name = result._task._role.get_name()
                                         notify = "%s : %s" % (role_name, notify)
                                     self._send_result(('notify_handler', result, notify))
                             # now remove the notify field from the results, as its no longer needed
-                            result_item.pop('ansible_notify')
+                            result_item.pop('_ansible_notify')
 
                         if 'add_host' in result_item:
                             # this task added a new host (add_host module)

lib/ansible/executor/task_executor.py

@@ -346,7 +346,7 @@ class TaskExecutor:
         # this task may be running in a loop in which case the notification
         # may be item-specific, ie. "notify: service {{item}}"
         if self._task.notify is not None:
-            result['ansible_notify'] = self._task.notify
+            result['_ansible_notify'] = self._task.notify
 
         # and return
         debug("attempt loop complete, returning result")

lib/ansible/plugins/action/debug.py

@@ -43,6 +43,6 @@ class ActionModule(ActionBase):
             result = dict(msg='here we are')
 
         # force flag to make debug output module always verbose
-        result['verbose_always'] = True
+        result['_ansible_verbose_always'] = True
 
         return result

lib/ansible/plugins/action/include_vars.py

@@ -39,12 +39,13 @@ class ActionModule(ActionBase):
             source = self._loader.path_dwim(source)
 
         if os.path.exists(source):
-            data = self._loader.load_from_file(source)
+            (data, show_content) = self._loader._get_file_contents(source)
+            data = self._loader.load(data, show_content)
             if data is None:
                 data = {}
             if not isinstance(data, dict):
                 raise AnsibleError("%s must be stored as a dictionary/hash" % source)
-            return dict(ansible_facts=data)
+            return dict(ansible_facts=data, _ansible_no_log=not show_content)
         else:
             return dict(failed=True, msg="Source file not found.", file=source)
 

lib/ansible/plugins/callback/__init__.py

@@ -23,6 +23,8 @@ import json
 import difflib
 import warnings
 
+from six import string_types
+
 from ansible import constants as C
 from ansible.utils.unicode import to_unicode
 
@@ -48,8 +50,20 @@ class CallbackBase:
             version = getattr(self, 'CALLBACK_VERSION', '1.0')
             self._display.vvvv('Loaded callback %s of type %s, v%s' % (name, ctype, version))
 
-    def _dump_results(self, result, indent=4, sort_keys=True):
-        return json.dumps(result, indent=indent, ensure_ascii=False, sort_keys=sort_keys)
+    def _dump_results(self, result, indent=None, sort_keys=True):
+        if result.get('_ansible_no_log', False):
+            return json.dumps(dict(censored="the output has been hidden due to the fact that 'no_log: true' was specified for this result"))
+        else:
+            if '_ansible_verbose_always' in result:
+                indent = 4
+            # all result keys stating with _ansible_ are internal, so remove
+            # them from the result before we output anything. We have to save
+            # the keys off first, as we're modifying the dict (so iteritems()
+            # won't work here)
+            for k in result.keys():
+                if isinstance(k, string_types) and k.startswith('_ansible_'):
+                    del result[k]
+            return json.dumps(result, indent=indent, ensure_ascii=False, sort_keys=sort_keys)
 
     def _handle_warnings(self, res):
         ''' display warnings, if enabled and any exist in the result '''

lib/ansible/plugins/callback/default.py

@@ -63,24 +63,16 @@ class CallbackModule(CallbackBase):
             msg = "ok: [%s]" % result._host.get_name()
             color = 'green'
 
-        if (self._display.verbosity > 0 or 'verbose_always' in result._result) and result._task.action not in ('setup', 'include'):
-            indent = None
-            if 'verbose_always' in result._result:
-                indent = 4
-                del result._result['verbose_always']
-            msg += " => %s" % self._dump_results(result._result, indent=indent)
+        if (self._display.verbosity > 0 or '_ansible_verbose_always' in result._result) and result._task.action not in ('setup', 'include'):
+            msg += " => %s" % self._dump_results(result._result)
         self._display.display(msg, color=color)
 
         self._handle_warnings(result._result)
 
     def v2_runner_on_skipped(self, result):
         msg = "skipping: [%s]" % result._host.get_name()
-        if self._display.verbosity > 0 or 'verbose_always' in result._result:
-            indent = None
-            if 'verbose_always' in result._result:
-                indent = 4
-                del result._result['verbose_always']
-            msg += " => %s" % self._dump_results(result._result, indent=indent)
+        if self._display.verbosity > 0 or '_ansible_verbose_always' in result._result:
+            msg += " => %s" % self._dump_results(result._result)
         self._display.display(msg, color='cyan')
 
     def v2_runner_on_unreachable(self, result):

lib/ansible/plugins/callback/skippy.py

@@ -63,12 +63,8 @@ class CallbackModule(CallbackBase):
             msg = "ok: [%s]" % result._host.get_name()
             color = 'green'
 
-        if (self._display.verbosity > 0 or 'verbose_always' in result._result) and result._task.action not in ('setup', 'include'):
-            indent = None
-            if 'verbose_always' in result._result:
-                indent = 4
-                del result._result['verbose_always']
-            msg += " => %s" % self._dump_results(result._result, indent=indent)
+        if (self._display.verbosity > 0 or '_ansible_verbose_always' in result._result) and result._task.action not in ('setup', 'include'):
+            msg += " => %s" % self._dump_results(result._result)
 
         self._display.display(msg, color=color)
         self._handle_warnings(result._result)