Don't post_validate vars and vars_files on Play objects

Fixes #11343

lib/ansible/playbook/base.py

@@ -254,15 +254,17 @@ class Base:
                     raise AnsibleParserError("the field '%s' is required but was not set" % name)
 
             try:
-                # if the attribute contains a variable, template it now
-                value = templar.template(getattr(self, name))
-
-                # run the post-validator if present
+                # Run the post-validator if present. These methods are responsible for
+                # using the given templar to template the values, if required.
                 method = getattr(self, '_post_validate_%s' % name, None)
                 if method:
-                    value = method(attribute, value, all_vars, templar._fail_on_undefined_errors)
+                    value = method(attribute, getattr(self, name), templar)
                 else:
-                    # otherwise, just make sure the attribute is of the type it should be
+                    # if the attribute contains a variable, template it now
+                    value = templar.template(getattr(self, name))
+
+                # and make sure the attribute is of the type it should be
+                if value is not None:
                     if attribute.isa == 'string':
                         value = unicode(value)
                     elif attribute.isa == 'int':

lib/ansible/playbook/play.py

@@ -187,6 +187,20 @@ class Play(Base, Taggable, Become):
             roles.append(Role.load(ri))
         return roles
 
+    def _post_validate_vars(self, attr, value, templar):
+        '''
+        Override post validation of vars on the play, as we don't want to
+        template these too early.
+        '''
+        return value
+
+    def _post_validate_vars_files(self, attr, value, templar):
+        '''
+        Override post validation of vars_files on the play, as we don't want to
+        template these too early.
+        '''
+        return value
+
     # FIXME: post_validation needs to ensure that become/su/sudo have only 1 set
 
     def _compile_roles(self):