dashboard: fix permission checks in TemplateDetail

circle/dashboard/forms.py

@@ -25,6 +25,7 @@ from django.contrib.auth.forms import (
 )
 )
 from django.contrib.auth.models import User, Group
 from django.contrib.auth.models import User, Group
 from django.core.validators import URLValidator
 from django.core.validators import URLValidator
+from django.core.exceptions import PermissionDenied
 
 
 from crispy_forms.helper import FormHelper
 from crispy_forms.helper import FormHelper
 from crispy_forms.layout import (
 from crispy_forms.layout import (
@@ -624,6 +625,8 @@ class TemplateForm(forms.ModelForm):
         networks = InterfaceTemplate.objects.filter(
         networks = InterfaceTemplate.objects.filter(
             template=self.instance).values_list("vlan", flat=True)
             template=self.instance).values_list("vlan", flat=True)
         for m in data['networks']:
         for m in data['networks']:
+            if not m.has_level(self.user, "user"):
+                raise PermissionDenied()
             if m.pk not in networks:
             if m.pk not in networks:
                 InterfaceTemplate(vlan=m, managed=m.managed,
                 InterfaceTemplate(vlan=m, managed=m.managed,
                                   template=self.instance).save()
                                   template=self.instance).save()

circle/dashboard/views.py

@@ -1142,12 +1142,6 @@ class TemplateDetail(LoginRequiredMixin, SuccessMessageMixin, UpdateView):
         template = self.get_object()
         template = self.get_object()
         if not template.has_level(request.user, 'owner'):
         if not template.has_level(request.user, 'owner'):
             raise PermissionDenied()
             raise PermissionDenied()
-        for disk in self.get_object().disks.all():
-            if not disk.has_level(request.user, 'user'):
-                raise PermissionDenied()
-        for network in self.get_object().interface_set.all():
-            if not network.vlan.has_level(request.user, "user"):
-                raise PermissionDenied()
         return super(TemplateDetail, self).post(self, request, args, kwargs)
         return super(TemplateDetail, self).post(self, request, args, kwargs)
 
 
     def get_form_kwargs(self):
     def get_form_kwargs(self):