Added ownership checks for the various objects in the WebUI to make

things more obvious.  Still need to disable save/reset buttons.

Note that kickstart editing (supported via the WebUI) is not yet
protected and we still need to add that seperately.  This is complicated.
Currently anyone can sync and we'll keep it that way.

5 files changed, 34 insertions, 4 deletions

diff --git a/cobbler/webui/CobblerWeb.py b/cobbler/webui/CobblerWeb.py
index b2de916..2012708 100644
--- a/cobbler/webui/CobblerWeb.py
+++ b/cobbler/webui/CobblerWeb.py
@@ -399,9 +399,13 @@ class CobblerWeb(object):
         input_system = None
         if name is not None:
             input_system = self.remote.get_system(name,True)
+            can_edit = self.remote.check_access_no_fail(self.token,"modify_system",name)
+        else:
+            can_edit = self.remote.check_access_no_fail(self.token,"new_system",None)
 
         return self.__render( 'system_edit.tmpl', {
             'edit' : True,
+            'editable' : can_edit,
             'system': input_system,
             'profiles': self.remote.get_profiles()
         } )
@@ -436,10 +440,14 @@ class CobblerWeb(object):
 
         input_profile = None
         if name is not None:
-             input_profile = self.remote.get_profile(name,True)
+            input_profile = self.remote.get_profile(name,True)
+            can_edit = self.remote.check_access_no_fail(self.token,"modify_profile",name)
+        else:
+            can_edit = self.remote.check_access_no_fail(self.token,"new_profile",None)
 
         return self.__render( 'profile_edit.tmpl', {
             'edit' : True,
+            'editable' : can_edit,
             'profile': input_profile,
             'distros': self.remote.get_distros(),
             'profiles': self.remote.get_profiles(),
@@ -576,9 +584,14 @@ class CobblerWeb(object):
         input_repo = None
         if name is not None:
             input_repo = self.remote.get_repo(name, True)
+            can_edit = self.remote.check_access_no_fail(self.token,"modify_repo",name)
+        else:
+            can_edit = self.remote.check_access_no_fail(self.token,"new_repo",None)
+
 
         return self.__render( 'repo_edit.tmpl', {
             'repo': input_repo,
+            'editable' : can_edit
         } )
 
     def repo_save(self,name=None,oldname=None,new_or_edit=None,editmode="edit",
diff --git a/webui_templates/distro_edit.tmpl b/webui_templates/distro_edit.tmpl
index ccbb72f..3fc2f5a 100644
--- a/webui_templates/distro_edit.tmpl
+++ b/webui_templates/distro_edit.tmpl
@@ -17,8 +17,6 @@ function disablename(value)
 
 #if $editable != True
 <blockquote>
-$editable
-
 WARNING:  It looks like you do not have permission to make changes.
 To recieve access, contact your Cobbler server administrator.
 </blockquote>
diff --git a/webui_templates/profile_edit.tmpl b/webui_templates/profile_edit.tmpl
index 95ad1fd..4077c57 100644
--- a/webui_templates/profile_edit.tmpl
+++ b/webui_templates/profile_edit.tmpl
@@ -13,6 +13,13 @@ function disablename(value)
 </script>
 #end if
 
+#if $editable != True
+<blockquote>
+WARNING:  It looks like you do not have permission to make changes.
+To recieve access, contact your Cobbler server administrator.
+</blockquote>
+#end if
+
 <form method="post" action="$base_url?mode=profile_save">
 <fieldset id="cform">
 
diff --git a/webui_templates/repo_edit.tmpl b/webui_templates/repo_edit.tmpl
index 8d22879..bb40ee7 100644
--- a/webui_templates/repo_edit.tmpl
+++ b/webui_templates/repo_edit.tmpl
@@ -13,6 +13,12 @@ function disablename(value)
 </script>
 #end if
 
+#if $editable != True
+<blockquote>
+WARNING:  It looks like you do not have permission to make changes.
+To recieve access, contact your Cobbler server administrator.
+</blockquote>
+#end if
 
 <form method="post" action="$base_url?mode=repo_save">
 <fieldset id="cform">
diff --git a/webui_templates/system_edit.tmpl b/webui_templates/system_edit.tmpl
index bc8a0a3..309d3b2 100644
--- a/webui_templates/system_edit.tmpl
+++ b/webui_templates/system_edit.tmpl
@@ -65,7 +65,6 @@ function get_random_mac(field)
     #set $defined_interfaces = [ "intf0" ]
 #end if
 
-
 ### 
 ### now generate the onload function.
 ###
@@ -87,6 +86,13 @@ function page_onload() {
 }
 </script>
 
+#if $editable != True
+<blockquote>
+WARNING:  It looks like you do not have permission to make changes.
+To recieve access, contact your Cobbler server administrator.
+</blockquote>
+#end if
+
 <form method="post" action="$base_url?mode=system_save">
 <fieldset id="cform">