Skip to content

pfsense_phpshell executes the script in check mode and always reports changed=true #264

Description

@wpfleger96

Describe the bug

The module advertises supports_check_mode=True but run() calls self.pfsense.phpshell(params['cmd']) unconditionally, so ansible-playbook --check runs the PHP against the live box. It also hard-codes the result:

# plugins/modules/pfsense_phpshell.py
def __init__(self, module, pfsense=None):
    ...
    self.result['changed'] = True
def main():
    module = AnsibleModule(argument_spec=PHP_SHELL_ARGUMENT_SPEC, supports_check_mode=True)

Expected behavior

  • In check mode the module should not execute the script (or should require an explicit opt-in such as check_mode_safe: true for scripts that are read-only), and should report skipped/changed=false.
  • changed should not be forced to true; at minimum document changed_when prominently, or let the script signal change via a sentinel on stdout.

Playbook

- pfsensible.core.pfsense_phpshell:
    cmd: |
      $config['system']['hostname'] = 'oops';
      write_config('changed by check mode');

ansible-playbook --check writes the config.

Suggested fix

def run(self, params):
    if self.module.check_mode:
        self.module.exit_json(changed=False, skipped=True, msg='phpshell not executed in check mode')
    ...

and drop the self.result['changed'] = True default (or make it changed_when-friendly by defaulting to False when the script prints a CHANGED=0 sentinel).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions