dashboard: validate user input for resources

circle/dashboard/forms.py

@@ -85,21 +85,25 @@ class VmCustomizeForm(forms.Form):
         'required': "",
     }))
 
-    cpu_count = forms.CharField(widget=forms.NumberInput(attrs={
+    cpu_count = forms.IntegerField(widget=forms.NumberInput(attrs={
         'class': "form-control input-tags cpu-count-input",
         'min': 1,
         'max': 10,
         'required': "",
-    }))
+    }),
+        min_value=1, max_value=10,
+    )
 
-    ram_size = forms.CharField(widget=forms.TextInput(attrs={
+    ram_size = forms.IntegerField(widget=forms.TextInput(attrs={
         'class': "form-control input-tags ram-input",
         'min': 128,
         'pattern': "\d+",
         'max': MAX_NODE_RAM,
         'step': 128,
         'required': "",
-    }))
+    }),
+        min_value=128, max_value=MAX_NODE_RAM,
+    )
 
     cpu_priority = forms.ChoiceField(
         priority_choices, widget=forms.Select(attrs={
@@ -1134,20 +1138,24 @@ class GroupPermissionForm(forms.ModelForm):
 
 
 class VmResourcesForm(forms.ModelForm):
-    num_cores = forms.CharField(widget=forms.NumberInput(attrs={
+    num_cores = forms.IntegerField(widget=forms.NumberInput(attrs={
         'class': "form-control input-tags cpu-count-input",
         'min': 1,
         'max': 10,
         'required': "",
-    }))
+    }),
+        min_value=1, max_value=10,
+    )
 
-    ram_size = forms.CharField(widget=forms.NumberInput(attrs={
+    ram_size = forms.IntegerField(widget=forms.NumberInput(attrs={
         'class': "form-control input-tags ram-input",
         'min': 128,
         'max': MAX_NODE_RAM,
         'step': 128,
         'required': "",
-    }))
+    }),
+        min_value=128, max_value=MAX_NODE_RAM,
+    )
 
     priority = forms.ChoiceField(priority_choices, widget=forms.Select(attrs={
         'class': "form-control input-tags cpu-priority-input",

circle/dashboard/static/dashboard/vm-details.js

@@ -43,8 +43,12 @@ $(function() {
       url: "/dashboard/vm/" + vm + "/op/resources_change/", 
       data: $('#vm-details-resources-form').serialize(),
       success: function(data, textStatus, xhr) {
-        $("#vm-details-resources-save i").removeClass('fa-refresh fa-spin').addClass("fa-floppy-o");
+        if(data.success) {
           $('a[href="#activity"]').trigger("click");
+        } else {
+          addMessage(data.messages.join("<br />"), "danger");
+        }
+        $("#vm-details-resources-save i").removeClass('fa-refresh fa-spin').addClass("fa-floppy-o");
       },
       error: function(xhr, textStatus, error) {
         $("#vm-details-resources-save i").removeClass('fa-refresh fa-spin').addClass("fa-floppy-o");

circle/dashboard/views.py

@@ -765,15 +765,33 @@ class VmResourcesChangeView(VmOperationView):
         if extra is None:
             extra = {}
 
+        instance = get_object_or_404(Instance, pk=kwargs['pk'])
+
+        form = VmResourcesForm(request.POST, instance=instance)
+        if not form.is_valid():
+            for f in form.errors:
+                messages.error(request, "<strong>%s</strong>: %s" % (
+                    f, form.errors[f].as_text()
+                ))
+            if request.is_ajax():  # this is not too nice
+                store = messages.get_messages(request)
+                store.used = True
+                return HttpResponse(
+                    json.dumps({'success': False,
+                                'messages': [unicode(m) for m in store]}),
+                    content_type="application=json"
+                )
+            else:
+                return redirect(instance.get_absolute_url() + "#resources")
+        else:
             resources = {
                 'num_cores': "num_cores",
                 'priority': "priority",
                 'ram_size': "ram_size",
-            "max_ram_size": "ram_size",  # TODO
+                'max_ram_size': "ram_size",  # TODO
             }
             for k, v in resources.iteritems():
                 extra[k] = request.POST.get(v)
-
             return super(VmResourcesChangeView, self).post(request, extra,
                                                            *args, **kwargs)