dasboard: fix permission check in TemplateCreate

circle/dashboard/templates/dashboard/_template-choose.html

@@ -16,10 +16,12 @@
       <div class="clearfix"></div>
       <div class="clearfix"></div>
     </div>
     </div>
     {% endfor %}
     {% endfor %}
+    {% if perms.vm.create_base_template %}
     <div class="panel panel-default template-choose-list-element">
     <div class="panel panel-default template-choose-list-element">
       <input type="radio" name="parent" value="base_vm"/>
       <input type="radio" name="parent" value="base_vm"/>
       {% trans "Create a new base VM without disk" %}
       {% trans "Create a new base VM without disk" %}
     </div>
     </div>
+    {% endif %}
     <button type="submit" id="template-choose-next-button" class="btn btn-success pull-right">{% trans "Next" %}</button>
     <button type="submit" id="template-choose-next-button" class="btn btn-success pull-right">{% trans "Next" %}</button>
     <div class="clearfix"></div>
     <div class="clearfix"></div>
   </div>
   </div>

circle/dashboard/views.py

@@ -1019,7 +1019,7 @@ class TemplateChoose(LoginRequiredMixin, TemplateView):
         else:
         else:
             template = get_object_or_404(InstanceTemplate, pk=template)
             template = get_object_or_404(InstanceTemplate, pk=template)
 
 
-        if not template.has_level(user, "user"):
+        if not template.has_level(request.user, "user"):
             raise PermissionDenied()
             raise PermissionDenied()
 
 
         instance = Instance.create_from_template(
         instance = Instance.create_from_template(
@@ -1049,7 +1049,7 @@ class TemplateCreate(SuccessMessageMixin, CreateView):
         return context
         return context
 
 
     def get(self, *args, **kwargs):
     def get(self, *args, **kwargs):
-        if not self.request.user.has_perm('vm.create_template'):
+        if not self.request.user.has_perm('vm.create_base_template'):
             raise PermissionDenied()
             raise PermissionDenied()
 
 
         return super(TemplateCreate, self).get(*args, **kwargs)
         return super(TemplateCreate, self).get(*args, **kwargs)
@@ -1082,8 +1082,6 @@ class TemplateCreate(SuccessMessageMixin, CreateView):
 
 
             return redirect("%s#resources" % inst.get_absolute_url())
             return redirect("%s#resources" % inst.get_absolute_url())
 
 
-        return super(TemplateCreate, self).post(self, request, args, kwargs)
-
     def __create_networks(self, vlans, user):
     def __create_networks(self, vlans, user):
         networks = []
         networks = []
         for v in vlans:
         for v in vlans: