Bug Fix: Tighten action controls so only official event fields may be specified.

Author: jhuckaby

lib/action.js

@@ -326,7 +326,9 @@ class Actions {
 
 		// allow action to specify overrides for job (i.e. from workflow action)
 		if (action.overrides) {
-			Tools.mergeHashInto( new_job, Tools.copyHash( action.overrides, true ) );
+			['input', 'parent'].forEach( function(key) {
+				if (action.overrides[key]) new_job[key] = Tools.copyHash( action.overrides[key], true );
+			} );
 		}
 
 		// if prev job had tickets, copy them over
@@ -335,9 +337,12 @@ class Actions {
 		}
 
 		// allow action to specify event param overrides
-		if (action.params) {
+		if (action.params && event.fields) {
 			if (!new_job.params) new_job.params = {};
-			Tools.mergeHashInto(new_job.params, action.params);
+			
+			event.fields.forEach( function(field) {
+				if (field.id in action.params) new_job.params[field.id] = action.params[field.id];
+			} );
 		}
 
 		// set start node for workflows