Merge remote-tracking branch 'origin/master' into feature-port-operations

Conflicts:
	circle/dashboard/urls.py

circle/circle/settings/local.py

@@ -64,6 +64,13 @@ CACHES = {
 ########## END CACHE CONFIGURATION
 
 
+########## ROSETTA CONFIGURATION
+INSTALLED_APPS += (
+    'rosetta',
+)
+########## END ROSETTA CONFIGURATION
+
+
 ########## TOOLBAR CONFIGURATION
 # https://github.com/django-debug-toolbar/django-debug-toolbar#installation
 if get_env_variable('DJANGO_TOOLBAR', 'FALSE') == 'TRUE':

circle/circle/urls.py

@@ -18,9 +18,11 @@
 from django.conf.urls import patterns, include, url
 from django.views.generic import TemplateView
 
+from django.conf import settings
 from django.contrib import admin
-from django.shortcuts import redirect
 from django.core.urlresolvers import reverse
+from django.shortcuts import redirect
+
 
 from circle.settings.base import get_env_variable
 from dashboard.views import circle_login, HelpView
@@ -71,6 +73,13 @@ urlpatterns = patterns(
 )
 
 
+if 'rosetta' in settings.INSTALLED_APPS:
+    urlpatterns += patterns(
+        '',
+        url(r'^rosetta/', include('rosetta.urls')),
+    )
+
+
 if get_env_variable('DJANGO_SAML', 'FALSE') == 'TRUE':
     urlpatterns += patterns(
         '',

circle/dashboard/static/dashboard/dashboard.css

@@ -216,7 +216,7 @@ html {
 }
 
 #vm-list-rename-name, #node-list-rename-name, #group-list-rename-name {
-  max-width: 100px;
+  max-width: 150px;
 }
 
 .label-tag {
@@ -1042,3 +1042,12 @@ textarea[name="new_members"] {
 #vm-migrate-node-list li {
   cursor: pointer;
 }
+
+.group-list-table .actions,
+.group-list-table .admin,
+.group-list-table .number_of_users,
+.group-list-table .pk {
+  width: 1px;
+  white-space: nowrap;
+  text-align: center;
+}

circle/dashboard/static/dashboard/dashboard.js

@@ -50,6 +50,21 @@ $(function () {
     return false;
   });
 
+  $('.tx-tpl-ownership').click(function(e) {
+    $.ajax({
+      type: 'GET',
+      url: $('.tx-tpl-ownership').attr('href'),
+      success: function(data) {
+        $('body').append(data);
+        $('#confirmation-modal').modal('show');
+        $('#confirmation-modal').on('hidden.bs.modal', function() {
+          $('#confirmation-modal').remove();
+        });
+      }
+    });
+    return false;
+  });
+
   $('.template-choose').click(function(e) {
     $.ajax({
       type: 'GET',
@@ -428,7 +443,7 @@ function generateVmHTML(pk, name, host, icon, _status, fav, is_last) {
   return '<a href="/dashboard/vm/' + pk + '/" class="list-group-item' +
          (is_last ? ' list-group-item-last' : '') + '">' +      
         '<span class="index-vm-list-name">' + 
-          '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + name +
+          '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + safe_tags_replace(name) +
         '</span>' + 
         '<small class="text-muted"> ' + host + '</small>' +
         '<div class="pull-right dashboard-vm-favourite" data-vm="' + pk + '">' +  
@@ -441,14 +456,14 @@ function generateVmHTML(pk, name, host, icon, _status, fav, is_last) {
 
 function generateGroupHTML(url, name, is_last) {
   return '<a href="' + url + '" class="list-group-item real-link' + (is_last ? " list-group-item-last" : "") +'">'+
-         '<i class="fa fa-users"></i> '+ name +
+         '<i class="fa fa-users"></i> '+ safe_tags_replace(name) +
          '</a>';
 }
 
 function generateNodeHTML(name, icon, _status, url, is_last) {
   return '<a href="' + url + '" class="list-group-item real-link' + (is_last ? ' list-group-item-last' : '') + '">' +
         '<span class="index-node-list-name">' +
-        '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + name +
+        '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + safe_tags_replace(name) +
         '</span>' +
         '<div style="clear: both;"></div>' +
         '</a>';
@@ -456,7 +471,7 @@ function generateNodeHTML(name, icon, _status, url, is_last) {
 
 function generateNodeTagHTML(name, icon, _status, label , url) {
   return '<a href="' + url + '" class="label ' + label + '" >' +
-        '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + name +
+        '<i class="fa ' + icon + '" title="' + _status + '"></i> ' + safe_tags_replace(name) +
         '</a> ';
 }
 
@@ -678,3 +693,18 @@ function getParameterByName(name) {
         results = regex.exec(location.search);
     return results == null ? "" : decodeURIComponent(results[1].replace(/\+/g, " "));
 }
+
+
+var tagsToReplace = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;'
+};
+
+function replaceTag(tag) {
+    return tagsToReplace[tag] || tag;
+}
+
+function safe_tags_replace(str) {
+    return str.replace(/[&<>]/g, replaceTag);
+}

circle/dashboard/static/dashboard/disk-list.js

-$(function() {
-  $(".disk-list-disk-percentage").each(function() {
-    var disk = $(this).data("disk-pk");
-    var element = $(this);
-    refreshDisk(disk, element);
-  });
-});
-
-function refreshDisk(disk, element) {
-    $.get("/dashboard/disk/" + disk + "/status/", function(result) {
-      if(result.percentage == null || result.failed == "True") {
-        location.reload(); 
-      } else {
-        var diff = result.percentage - parseInt(element.html());
-        var refresh = 5 - diff;
-        refresh = refresh < 1 ? 1 : (result.percentage == 0 ? 1 : refresh);
-        if(isNaN(refresh)) refresh = 2; // this should not happen
-
-        element.html(result.percentage);
-        setTimeout(function() {refreshDisk(disk, element)}, refresh * 1000);
-      }
-    });
-}

circle/dashboard/static/dashboard/group-details.js

@@ -14,7 +14,7 @@
       data: {'new_name': name},
       headers: {"X-CSRFToken": getCookie('csrftoken')},
       success: function(data, textStatus, xhr) {
-        $("#group-details-h1-name").html(data['new_name']).show();
+        $("#group-details-h1-name").text(data['new_name']).show();
         $('#group-details-rename').hide();
         // addMessage(data['message'], "success");
       },

circle/dashboard/static/dashboard/group-list.js

@@ -3,6 +3,7 @@ $(function() {
   $("#group-list-rename-button, .group-details-rename-button").click(function() {
     $("#group-list-column-name", $(this).closest("tr")).hide();
     $("#group-list-rename", $(this).closest("tr")).css('display', 'inline');
+    $("#group-list-rename").find("input").select();
   });
 
   /* rename ajax */

circle/dashboard/static/dashboard/node-details.js

@@ -15,7 +15,7 @@ $(function() {
       data: {'new_name': name},
       headers: {"X-CSRFToken": getCookie('csrftoken')},
       success: function(data, textStatus, xhr) {
- 	$("#node-details-h1-name").html(data['new_name']).show();
+        $("#node-details-h1-name").text(data['new_name']).show();
         $('#node-details-rename').hide();
         // addMessage(data['message'], "success");
       },

circle/dashboard/static/dashboard/node-list.js

@@ -12,40 +12,6 @@ $(function() {
 	tr.removeClass('danger');
   }
 
-  /* rename */
-  $("#node-list-rename-button, .node-details-rename-button").click(function() {
-    $("#node-list-column-name", $(this).closest("tr")).hide();
-    $("#node-list-rename", $(this).closest("tr")).css('display', 'inline');
-  });
-
-  /* rename ajax */
-  $('.node-list-rename-submit').click(function() {
-    var row = $(this).closest("tr")
-    var name = $('#node-list-rename-name', row).val();
-    var url = '/dashboard/node/' + row.children("td:first-child").text().replace(" ", "") + '/';
-    $.ajax({
-      method: 'POST',
-      url: url,
-      data: {'new_name': name},
-      headers: {"X-CSRFToken": getCookie('csrftoken')},
-      success: function(data, textStatus, xhr) {
-        
-        $("#node-list-column-name", row).html(
-          $("<a/>", {
-            'class': "real-link",
-            href: "/dashboard/node/" + data['node_pk'] + "/",
-            text: data['new_name']
-          })
-        ).show();
-        $('#node-list-rename', row).hide();
-        // addMessage(data['message'], "success");
-      },
-      error: function(xhr, textStatus, error) {
-	 addMessage("Error during renaming!", "danger");
-      }
-    });
-    return false;
-  });
 
   function statuschangeSuccess(tr){
    var tspan=tr.children('.enabled').children();

circle/dashboard/tables.py

@@ -88,18 +88,21 @@ class GroupListTable(Table):
 
     number_of_users = TemplateColumn(
         orderable=False,
+        verbose_name=_("Number of users"),
         template_name='dashboard/group-list/column-users.html',
         attrs={'th': {'class': 'group-list-table-admin'}},
     )
 
     admin = TemplateColumn(
         orderable=False,
+        verbose_name=_("Admin"),
         template_name='dashboard/group-list/column-admin.html',
         attrs={'th': {'class': 'group-list-table-admin'}},
     )
 
     actions = TemplateColumn(
         orderable=False,
+        verbose_name=_("Actions"),
         attrs={'th': {'class': 'group-list-table-thin'}},
         template_code=('{% include "dashboard/group-list/column-'
                        'actions.html" with btn_size="btn-xs" %}'),

circle/dashboard/templates/dashboard/confirm/transfer-template-ownership.html

+{% extends "dashboard/base.html" %}
+{% load i18n %}
+
+{% block content %}
+  <div class="body-content">
+    <div class="panel panel-default">
+      <div class="panel-heading">
+        <h3 class="no-margin">
+          {% trans "Ownership transfer" %}
+        </h3>
+      </div>
+      <div class="panel-body">
+        {% blocktrans with owner=instance.owner name=instance.name id=instance.id%}
+        <strong>{{ owner }}</strong> offered to take the ownership of
+        template <strong>{{name}} ({{id}})</strong>.
+        Do you accept the responsility of being the template's owner?
+        {% endblocktrans %}
+        <div class="pull-right">
+          <form action="" method="POST">
+            {% csrf_token %}
+            <a class="btn btn-default" href="{% url "dashboard.index" %}">{% trans "No" %}</a>
+            <input type="hidden" name="key" value="{{ key }}"/>
+            <button class="btn btn-danger" type="submit">{% trans "Yes" %}</button>
+          </form>
+        </div>
+      </div>
+  </div>
+{% endblock %}

circle/dashboard/templates/dashboard/group-detail.html

 {% extends "dashboard/base.html" %}
 {% load crispy_forms_tags %}
 {% load i18n %}
+{% load static %}
 
 {% block title-page %}{{ group.name }} | {% trans "group" %}{% endblock %}
 
@@ -8,9 +9,15 @@
 <div class="body-content">
   <div class="page-header">
     <div class="pull-right" style="padding-top: 15px;">
-      <a title="{% trans "Rename" %}" href="#" class="btn btn-default btn-xs group-details-rename-button"><i class="fa fa-pencil"></i></a>
-      <a title="{% trans "Delete" %}" data-group-pk="{{ group.pk }}" class="btn btn-default btn-xs real-link group-delete" href="{% url "dashboard.views.delete-group" pk=group.pk %}"><i class="fa fa-trash-o"></i></a>
-      <a title="{% trans "Help" %}" href="#" class="btn btn-default btn-xs group-details-help-button"><i class="fa fa-question"></i></a>
+      <a title="{% trans "Rename" %}" href="#" class="btn btn-default btn-xs group-details-rename-button">
+        <i class="fa fa-pencil"></i>
+      </a>
+      <a title="{% trans "Delete" %}" data-group-pk="{{ group.pk }}" class="btn btn-default btn-xs real-link group-delete" href="{% url "dashboard.views.delete-group" pk=group.pk %}">
+        <i class="fa fa-trash-o"></i>
+      </a>
+      <a title="{% trans "Help" %}" href="#" class="btn btn-default btn-xs group-details-help-button">
+        <i class="fa fa-question"></i>
+      </a>
     </div>
    <h1>
       <div id="group-details-rename">
@@ -39,21 +46,18 @@
         </li>
       </ul>
     </div>
- </div>
+  </div><!-- .page-header -->
   <div class="row">
     <div class="col-md-12" id="group-detail-pane">
-      <div class="panel panel-default" id="group-detail-panel">
-        <div class="tab-content panel-body" id="group-form-body">
-
+      <div class="panel panel-default panel-body" id="group-detail-panel">
         <form method="POST" action="{% url "dashboard.views.group-update" pk=group.pk %}">
-{% csrf_token %}
-{% crispy group_profile_form %}
-</form>
-
-<hr />
+          {% csrf_token %}
+          {% crispy group_profile_form %}
+        </form>
+        <hr />
 
-<h3>{% trans "Available objects for this group" %}</h3>
-<ul class="dashboard-profile-vm-list fa-ul">
+        <h3>{% trans "Available objects for this group" %}</h3>
+        <ul class="dashboard-profile-vm-list fa-ul">
           {% for i in vm_objects %}
             <li>
               <a href="{{ i.get_absolute_url }}">
@@ -78,17 +82,19 @@
               </a>
             </li>
           {% endfor %}
-</ul>
-
-<hr />
+        </ul>
+        <hr />
 
-<h3>{% trans "User list"|capfirst %}
+        <h3>
+          {% trans "User list" %}
           {% if perms.auth.add_user %}
-        <a href="{% url "dashboard.views.create-user" group.pk %}" class="btn btn-success pull-right">{% trans "Create user" %}</a>
+          <a href="{% url "dashboard.views.create-user" group.pk %}" class="btn btn-success pull-right">
+            {% trans "Create user" %}
+          </a>
           {% endif %}
-</h3>
-<form action="" method="post">{% csrf_token %}
-<table class="table table-striped table-with-form-fields table-bordered" id="group-detail-user-table">
+        </h3>
+        <form action="" method="post">{% csrf_token %}
+        <table class="table table-striped table-with-form-fields table-bordered" id="group-detail-user-table">
           <tbody>
             <thead><tr><th></th><th>{% trans "Who" %}</th><th>{% trans "Remove" %}</th></tr></thead>
               {% for i in users %}
@@ -101,7 +107,9 @@
                       >{% include "dashboard/_display-name.html" with user=i show_org=True %}</a>
                   </td>
                   <td>
-              <a data-group_pk="{{ group.pk }}" data-member_pk="{{i.pk}}" href="{% url "dashboard.views.remove-user" member_pk=i.pk group_pk=group.pk %}" class="real-link delete-from-group btn btn-link btn-xs"><i class="fa fa-times"><span class="sr-only">{% trans "remove" %}</span></i></a>
+                    <a data-group_pk="{{ group.pk }}" data-member_pk="{{i.pk}}" href="{% url "dashboard.views.remove-user" member_pk=i.pk group_pk=group.pk %}" class="real-link delete-from-group btn btn-link btn-xs"><i class="fa fa-times">
+                        <span class="sr-only">{% trans "remove" %}</span></i>
+                    </a>
                   </td>
                 </tr>
               {% endfor %}
@@ -132,29 +140,31 @@
             <button type="submit" class="btn btn-success">{% trans "Save" %}</button>
           </div>
         </form>
-
-  <hr />
-<h3 id="group-detail-perm-header">{% trans "Access permissions"|capfirst %}</h3>
-{% include "dashboard/_manage_access.html" with table_id="group-detail-perm-table" %}
-{% if user.is_superuser %}
         <hr />
+        <h3 id="group-detail-perm-header">{% trans "Access permissions" %}</h3>
+        {% include "dashboard/_manage_access.html" with table_id="group-detail-perm-table" %}
 
-<script type="text/javascript" src="/static/admin/js/jquery.min.js"></script>
-<script type="text/javascript" src="/static/admin/js/jquery.init.js"></script>
-{{ group_perm_form.media }}
+        {% if user.is_superuser %}
+          <hr />
 
-<h3>{% trans "Group permissions" %}</h3>
+          <script type="text/javascript" src="/static/admin/js/jquery.min.js"></script>
+          <script type="text/javascript" src="/static/admin/js/jquery.init.js"></script>
+          {{ group_perm_form.media }}
 
-<div id="group-detail-permissions">
-{% crispy group_perm_form %}
-</div>
+          <h3>{% trans "Group permissions" %}</h3>
 
-<link rel="stylesheet" type="text/css" href="/static/admin/css/widgets.css" />
-
-{% endif %}
+          <div id="group-detail-permissions">
+          {% crispy group_perm_form %}
           </div>
+
+          <link rel="stylesheet" type="text/css" href="/static/admin/css/widgets.css" />
+        {% endif %}
       </div>
     </div>
   </div>
 </div>
 {% endblock %}
+
+{% block extra_js %}
+  <script type="text/javascript" src="{% static "dashboard/group-details.js" %}"></script>
+{% endblock %}

circle/dashboard/templates/dashboard/group-list.html

@@ -10,7 +10,7 @@
   <div class="col-md-12">
     <div class="panel panel-default">
       <div class="panel-heading">
-        <h3 class="no-margin"><i class="fa fa-group"></i> Your groups</h3>
+        <h3 class="no-margin"><i class="fa fa-group"></i> {% trans "Groups" %}</h3>
       </div>
       <div class="panel-body">
         <div id="table_container">

circle/dashboard/templates/dashboard/index-nodes.html

@@ -74,9 +74,11 @@
               {% trans "list" %}
           {% endif %}
         </a>
+        {% if request.user.is_superuser %}
         <a class="btn btn-success btn-xs node-create" href="{% url "dashboard.views.node-create" %}">
           <i class="fa fa-plus-circle"></i> {% trans "new" %}
         </a>
+        {% endif  %}
       </div>
     </div>
   </div>

circle/dashboard/templates/dashboard/index.html

@@ -35,7 +35,7 @@
     </div>
     {% endif %}
 
-    {% if user.is_superuser %}
+    {% if perms.vm.view_statistics %}
     <div class="col-lg-4 col-sm-6">
       {% include "dashboard/index-nodes.html" %}
     </div>

circle/dashboard/templates/dashboard/node-detail.html

@@ -6,6 +6,7 @@
 {% block content %}
 <div class="body-content">
   <div class="page-header">
+    {% if request.user.is_superuser %}
     <div class="pull-right" id="ops">
       {% include "dashboard/vm-detail/_operations.html" %}
     </div>
@@ -13,6 +14,7 @@
      <a title="{% trans "Rename" %}" href="#" class="btn btn-default btn-xs node-details-rename-button"><i class="fa fa-pencil"></i></a>
      <a title="{% trans "Delete" %}" data-node-pk="{{ node.pk }}" class="btn btn-default btn-xs real-link node-delete" href="{% url "dashboard.views.delete-node" pk=node.pk %}"><i class="fa fa-trash-o"></i></a>
     </div>
+    {% endif  %}
     <h1>
       <div id="node-details-rename">
        <form action="" method="POST" id="node-details-rename-form">

circle/dashboard/templates/dashboard/node-detail/home.html

@@ -16,16 +16,19 @@
         {% endif %}
       </div>
  {% load crispy_forms_tags %}
+
 <style>
   .row {
     margin-bottom: 15px;
   }
 </style>
 
+  {% if request.user.is_superuser %}
     <form action="{% url "dashboard.views.node-addtrait" node.pk %}" method="POST">
     {% csrf_token %}
     {% crispy trait_form %}
     </form>
+  {% endif %}
     </div><!-- id:node-details-traits -->
   </div>
   <div class="col-md-8">

circle/dashboard/templates/dashboard/node-detail/resources.html

@@ -10,6 +10,16 @@
     <dt>{% trans "Enabled" %}:</dt><dd>{{ node.enabled }}</dd>
     <dt>{% trans "Host online" %}:</dt><dd> {{ node.online }}</dd>
     <dt>{% trans "Priority" %}:</dt><dd>{{ node.priority }}</dd>
+    <dt>{% trans "Driver Version:" %}</dt>
+    <dd>
+      {% if node.driver_version %}
+        {{ node.driver_version.branch }} at
+        {{ node.driver_version.commit }} ({{ node.driver_version.commit_text }})
+        {% if node.driver_version.is_dirty %}
+          <span class="label label-danger">{% trans "with uncommitted changes!" %}</span>
+        {% endif %}
+      {% endif %}
+    </dd>
     <dt>{% trans "Host owner" %}:</dt>
     <dd>
       {% include "dashboard/_display-name.html" with user=node.host.owner show_org=True %}
@@ -18,10 +28,12 @@
     <dt>{% trans "Host name" %}:</dt>
     <dd>
       {{ node.host.hostname }}
+      {% if request.user.is_superuser %}
       <a href="{{ node.host.get_absolute_url }}" class="btn btn-default btn-xs">
         <i class="fa fa-pencil"></i>
         {% trans "Edit host" %}
       </a>
+      {% endif  %}
     </dd>
     </dl>
 

circle/dashboard/templates/dashboard/template-edit.html

@@ -81,6 +81,26 @@
 
     <div class="panel panel-default">
       <div class="panel-heading">
+        <h4 class="no-margin"><i class="fa fa-user"></i> {% trans "Owner"  %}</h4>
+      </div>
+      <div class="panel-body">
+        {% if user == object.owner %}
+        {% blocktrans %}You are the current owner of this template.{% endblocktrans %}
+        {% else %}
+        {% url "dashboard.views.profile" username=object.owner.username as url %}
+        {% blocktrans with owner=object.owner name=object.owner.get_full_name%}
+          The current owner of this template is <a href="{{url}}">{{name}} ({{owner}})</a>.
+        {% endblocktrans %}
+        {% endif %}
+        {% if user == object.owner or user.is_superuser %}
+        <a href="{% url "dashboard.views.template-transfer-ownership" object.pk %}"
+           class="btn btn-link tx-tpl-ownership">{% trans "Transfer ownership..." %}</a>
+        {% endif %}
+      </div>
+    </div>
+
+    <div class="panel panel-default">
+      <div class="panel-heading">
         <h4 class="no-margin"><i class="fa fa-group"></i> {% trans "Manage access"  %}</h4>
       </div>
       <div class="panel-body">

circle/dashboard/templates/dashboard/template-tx-owner.html

+{% load i18n %}
+
+<div class="pull-right">
+  <form action="{% url "dashboard.views.template-transfer-ownership" pk=object.pk %}" method="POST" style="max-width: 400px;">
+    {% csrf_token %}
+    <label>
+      {{ form.name.label }}
+    </label>
+    <div class="input-group">
+      {{form.name}}
+      <div class="input-group-btn">
+        <input type="submit" value="{% trans "Save" %}" class="btn btn-primary">
+      </div>
+    </div>
+  </form>
+</div>

circle/dashboard/templates/dashboard/vm-detail.html

@@ -121,7 +121,14 @@
         <dd style="font-size: 10px; text-align: right; padding-top: 8px;">
           <div id="vm-details-pw-reset">
           {% with op=op.password_reset %}{% if op %}
-          <a href="{% if op.disabled %}#{% else %}{{op.get_url}}{% endif %}" class="operation operation-{{op.op}}" data-disabled="{% if op.disabled %}true" title="{% trans "Start the VM to change the password." %}"{% else %}false" {% endif %}>{% trans "Generate new password!" %}</a>
+          <a href="{% if op.disabled %}#{% else %}{{op.get_url}}{% endif %}"
+            class="operation operation-{{op.op}}"
+            {% if op.disabled %}
+            data-disabled="true"
+            title="{% if instance.has_agent %}{% trans "Start the VM to change the password." %}{% else %}{% trans "This machine has no agent installed." %}{% endif %}"
+            {% endif %}>
+            {% trans "Generate new password!" %}
+          </a>
           {% endif %}{% endwith %}
           </div>
         </dd>

circle/dashboard/templates/dashboard/vm-detail/access.html

@@ -4,8 +4,9 @@
   {% if user == instance.owner %}
   {% blocktrans %}You are the current owner of this instance.{% endblocktrans %}
   {% else %}
-  {% blocktrans with owner=instance.owner %}
-    The current owner of this instance is {{owner}}.
+  {% url "dashboard.views.profile" username=instance.owner.username as url %}
+  {% blocktrans with owner=instance.owner name=instance.owner.get_full_name%}
+    The current owner of this instance is <a href="{{url}}">{{name}} ({{owner}})</a>.
   {% endblocktrans %}
   {% endif %}
   {% if user == instance.owner or user.is_superuser %}

circle/dashboard/tests/test_views.py

@@ -637,7 +637,7 @@ class NodeDetailTest(LoginMixin, TestCase):
         c = Client()
         self.login(c, 'user1')
         response = c.get('/dashboard/node/25555/')
-        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response.status_code, 403)
 
     def test_anon_node_page(self):
         c = Client()
@@ -667,7 +667,7 @@ class NodeDetailTest(LoginMixin, TestCase):
         node = Node.objects.get(pk=1)
         old_name = node.name
         response = c.post("/dashboard/node/1/", {'new_name': 'test1235'})
-        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response.status_code, 403)
         self.assertEqual(Node.objects.get(pk=1).name, old_name)
 
     def test_permitted_set_name(self):
@@ -721,7 +721,7 @@ class NodeDetailTest(LoginMixin, TestCase):
         c = Client()
         self.login(c, "user2")
         response = c.post("/dashboard/node/1/", {'to_remove': traitid})
-        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response.status_code, 403)
         self.assertEqual(Node.objects.get(pk=1).traits.count(), trait_count)
 
     def test_permitted_remove_trait(self):

circle/dashboard/urls.py

@@ -27,8 +27,8 @@ from .views import (
     MyPreferencesView, NodeAddTraitView, NodeCreate, NodeDelete,
     NodeDetailView, NodeList, NodeStatus,
     NotificationView, TemplateAclUpdateView, TemplateCreate,
-    TemplateDelete, TemplateDetail, TemplateList, TransferOwnershipConfirmView,
-    TransferOwnershipView, vm_activity, VmCreate, VmDetailView,
+    TemplateDelete, TemplateDetail, TemplateList,
+    vm_activity, VmCreate, VmDetailView,
     VmDetailVncTokenView, VmList,
     DiskRemoveView, get_disk_download_status, InterfaceDeleteView,
     GroupRemoveUserView,
@@ -48,6 +48,8 @@ from .views import (
     toggle_template_tutorial,
     ClientCheck, TokenLogin,
     VmGraphView, NodeGraphView, NodeListGraphView,
+    TransferInstanceOwnershipView, TransferInstanceOwnershipConfirmView,
+    TransferTemplateOwnershipView, TransferTemplateOwnershipConfirmView,
 )
 from .views.vm import vm_ops, vm_mass_ops
 from .views.node import node_ops
@@ -78,13 +80,15 @@ urlpatterns = patterns(
         name="dashboard.views.template-list"),
     url(r"^template/delete/(?P<pk>\d+)/$", TemplateDelete.as_view(),
         name="dashboard.views.template-delete"),
+    url(r'^template/(?P<pk>\d+)/tx/$', TransferTemplateOwnershipView.as_view(),
+        name='dashboard.views.template-transfer-ownership'),
     url(r'^vm/(?P<pk>\d+)/$', VmDetailView.as_view(),
         name='dashboard.views.detail'),
     url(r'^vm/(?P<pk>\d+)/vnctoken/$', VmDetailVncTokenView.as_view(),
         name='dashboard.views.detail-vnc'),
     url(r'^vm/(?P<pk>\d+)/acl/$', AclUpdateView.as_view(model=Instance),
         name='dashboard.views.vm-acl'),
-    url(r'^vm/(?P<pk>\d+)/tx/$', TransferOwnershipView.as_view(),
+    url(r'^vm/(?P<pk>\d+)/tx/$', TransferInstanceOwnershipView.as_view(),
         name='dashboard.views.vm-transfer-ownership'),
     url(r'^vm/list/$', VmList.as_view(), name='dashboard.views.vm-list'),
     url(r'^vm/create/$', VmCreate.as_view(),
@@ -106,8 +110,12 @@ urlpatterns = patterns(
         name='dashboard.views.node-detail'),
     url(r'^node/(?P<pk>\d+)/add-trait/$', NodeAddTraitView.as_view(),
         name='dashboard.views.node-addtrait'),
-    url(r'^tx/(?P<key>.*)/?$', TransferOwnershipConfirmView.as_view(),
+    url(r'^vm/tx/(?P<key>.*)/?$',
+        TransferInstanceOwnershipConfirmView.as_view(),
         name='dashboard.views.vm-transfer-ownership-confirm'),
+    url(r'^template/tx/(?P<key>.*)/?$',
+        TransferTemplateOwnershipConfirmView.as_view(),
+        name='dashboard.views.template-transfer-ownership-confirm'),
     url(r'^node/delete/(?P<pk>\d+)/$', NodeDelete.as_view(),
         name="dashboard.views.delete-node"),
     url(r'^node/status/(?P<pk>\d+)/$', NodeStatus.as_view(),

circle/dashboard/views/graph.py

@@ -26,7 +26,7 @@ from django.http import HttpResponse, Http404
 from django.utils.translation import ugettext_lazy as _
 from django.views.generic import View
 
-from braces.views import LoginRequiredMixin, SuperuserRequiredMixin
+from braces.views import LoginRequiredMixin
 
 from vm.models import Instance, Node
 
@@ -142,22 +142,28 @@ class VmGraphView(GraphViewBase):
     base = VmMetric
 
 
-class NodeGraphView(SuperuserRequiredMixin, GraphViewBase):
+class NodeGraphView(GraphViewBase):
     model = Node
     base = NodeMetric
 
     def get_object(self, request, pk):
+        if not self.request.user.has_perm('vm.view_statistics'):
+            raise PermissionDenied()
         return self.model.objects.get(id=pk)
 
 
-class NodeListGraphView(SuperuserRequiredMixin, GraphViewBase):
+class NodeListGraphView(GraphViewBase):
     model = Node
     base = Metric
 
     def get_object(self, request, pk):
+        if not self.request.user.has_perm('vm.view_statistics'):
+            raise PermissionDenied()
         return Node.objects.filter(enabled=True)
 
     def get(self, request, metric, time, *args, **kwargs):
+        if not self.request.user.has_perm('vm.view_statistics'):
+            raise PermissionDenied()