dashboard: disable template buttons for non-owner users

fixes #194

circle/dashboard/forms.py

@@ -596,8 +596,12 @@ class TemplateForm(forms.ModelForm):
             n = self.instance.interface_set.values_list("vlan", flat=True)
             self.initial['networks'] = n
 
-        self.allowed_fields = (
-            'name', 'access_method', 'description', 'system', 'tags')
+        if self.instance.pk and not self.instance.has_level(self.user,
+                                                            'owner'):
+            self.allowed_fields = ()
+        else:
+            self.allowed_fields = (
+                'name', 'access_method', 'description', 'system', 'tags')
         if self.user.has_perm('vm.change_template_resources'):
             self.allowed_fields += tuple(set(self.fields.keys()) -
                                          set(['raw_data']))
@@ -675,6 +679,11 @@ class TemplateForm(forms.ModelForm):
 
     @property
     def helper(self):
+        submit_kwargs = {}
+        if self.instance.pk and not self.instance.has_level(self.user,
+                                                            'owner'):
+            submit_kwargs['disabled'] = None
+
         helper = FormHelper()
         helper.layout = Layout(
             Field("name"),
@@ -739,7 +748,7 @@ class TemplateForm(forms.ModelForm):
                 Field("tags"),
             ),
         )
-        helper.add_input(Submit('submit', 'Save changes'))
+        helper.add_input(Submit('submit', 'Save changes', **submit_kwargs))
         return helper
 
     class Meta:

circle/dashboard/templates/dashboard/_disk-list-element.html

@@ -10,10 +10,12 @@
   <div class="label label-danger"{% if user.is_superuser %} title="{{ d.get_latest_activity_result }}"{% endif %}>{% trans "failed" %}</div>
   {% endif %}
 {% else %}<span class="disk-list-disk-percentage" data-disk-pk="{{ d.pk }}">{{ d.get_download_percentage }}</span>%{% endif %}
+{% if is_owner != False %}
 <a href="{% url "dashboard.views.disk-remove" pk=d.pk %}?next={{ request.path }}"
-  data-disk-pk="{{ d.pk }}" class="btn btn-xs btn-danger pull-right disk-remove"
+  data-disk-pk="{{ d.pk }}" class="btn btn-xs btn-danger pull-right disk-remove "
   {% if not long_remove %}title="{% trans "Remove" %}"{% endif %}
   >
   <i class="fa fa-times"></i>{% if long_remove %} {% trans "Remove" %}{% endif %}
 </a>
+{% endif %}
 <div style="clear: both;"></div>

circle/dashboard/templates/dashboard/template-edit.html

@@ -95,7 +95,7 @@
             </tbody>
           </table>
           <div class="form-actions">
-            <button type="submit" class="btn btn-success">{% trans "Save" %}</button>
+            <button type="submit" class="btn btn-success {% if not is_owner %}disabled{% endif %}">{% trans "Save" %}</button>
           </div>
         </form>
       </div>

circle/dashboard/views.py

@@ -1326,6 +1326,7 @@ class TemplateDetail(LoginRequiredMixin, SuccessMessageMixin, UpdateView):
         context = super(TemplateDetail, self).get_context_data(**kwargs)
         context['acl'] = get_vm_acl_data(obj)
         context['disks'] = obj.disks.all()
+        context['is_owner'] = obj.has_level(self.request.user, 'owner')
         return context
 
     def get_success_url(self):