dashboard: fix permission checks in TemplateForm

circle/dashboard/forms.py

@@ -25,7 +25,7 @@ from django.contrib.auth.forms import (
 )
 from django.contrib.auth.models import User, Group
 from django.core.validators import URLValidator
-from django.core.exceptions import PermissionDenied
+from django.core.exceptions import PermissionDenied, ValidationError
 
 from crispy_forms.helper import FormHelper
 from crispy_forms.layout import (
@@ -594,6 +594,17 @@ class TemplateForm(forms.ModelForm):
             n = self.instance.interface_set.values_list("vlan", flat=True)
             self.initial['networks'] = n
 
+        self.allowed_fields = (
+            'name', 'access_method', 'description', 'system', 'tags')
+        if self.user.has_perm('vm.change_template_resources'):
+            self.allowed_fields += tuple(set(self.fields.keys()) -
+                                         set(['raw_data']))
+        if self.user.is_superuser:
+            self.allowed_fields += ('raw_data', )
+        for name, field in self.fields.items():
+            if name not in self.allowed_fields:
+                field.widget.attrs['disabled'] = 'disabled'
+
         if not self.instance.pk and len(self.errors) < 1:
             self.instance.priority = 20
             self.instance.ram_size = 512
@@ -604,14 +615,35 @@ class TemplateForm(forms.ModelForm):
             return User.objects.get(pk=self.instance.owner.pk)
         return self.user
 
-    def clean_raw_data(self):
-        # if raw_data has changed and the user is not superuser
-        if "raw_data" in self.changed_data and not self.user.is_superuser:
-            old_raw_data = InstanceTemplate.objects.get(
-                pk=self.instance.pk).raw_data
-            return old_raw_data
-        else:
-            return self.cleaned_data['raw_data']
+    def _clean_fields(self):
+        try:
+            old = InstanceTemplate.objects.get(pk=self.instance.pk)
+        except InstanceTemplate.DoesNotExist:
+            old = None
+        for name, field in self.fields.items():
+            if name in self.allowed_fields:
+                value = field.widget.value_from_datadict(
+                    self.data, self.files, self.add_prefix(name))
+                try:
+                    if isinstance(field, forms.FileField):
+                        initial = self.initial.get(name, field.initial)
+                        value = field.clean(value, initial)
+                    else:
+                        value = field.clean(value)
+                    self.cleaned_data[name] = value
+                    if hasattr(self, 'clean_%s' % name):
+                        value = getattr(self, 'clean_%s' % name)()
+                        self.cleaned_data[name] = value
+                except ValidationError as e:
+                    self._errors[name] = self.error_class(e.messages)
+                    if name in self.cleaned_data:
+                        del self.cleaned_data[name]
+            elif old:
+                if name == 'networks':
+                    self.cleaned_data[name] = [
+                        i.vlan for i in self.instance.interface_set.all()]
+                else:
+                    self.cleaned_data[name] = getattr(old, name)
 
     def save(self, commit=True):
         data = self.cleaned_data
@@ -638,10 +670,6 @@ class TemplateForm(forms.ModelForm):
 
     @property
     def helper(self):
-        kwargs_raw_data = {}
-        if not self.user.is_superuser:
-            kwargs_raw_data['readonly'] = None
-
         helper = FormHelper()
         helper.layout = Layout(
             Field("name"),
@@ -693,7 +721,7 @@ class TemplateForm(forms.ModelForm):
                 _("Virtual machine settings"),
                 Field('access_method'),
                 Field('boot_menu'),
-                Field('raw_data', **kwargs_raw_data),
+                Field('raw_data'),
                 Field('req_traits'),
                 Field('description'),
                 Field("parent", type="hidden"),

circle/dashboard/static/dashboard/bootstrap-slider/bootstrap-slider.js

@@ -192,6 +192,9 @@
 		},
 
 		mousedown: function(ev) {
+                        if (this.element[0].disabled) {
+                            return false;
+                        }
 
 			// Touch: Get the original event:
 			if (this.touchCapable && ev.type === 'touchstart') {

circle/vm/models/instance.py

@@ -153,7 +153,8 @@ class InstanceTemplate(AclBase, VirtualMachineDescModel, TimeStampedModel):
             ('create_template', _('Can create an instance template.')),
             ('create_base_template',
              _('Can create an instance template (base).')),
-            ('change_resources', _('Can change resources of a template.')),
+            ('change_template_resources',
+             _('Can change resources of a template.')),
         )
         verbose_name = _('template')
         verbose_name_plural = _('templates')