if a user adds a sliver and doesn't have privilege, then throw an error
diff --git a/xos/core/admin.py b/xos/core/admin.py
index beeb982..8ef7a53 100644
--- a/xos/core/admin.py
+++ b/xos/core/admin.py
@@ -19,7 +19,9 @@
from django.utils.html import conditional_escape, format_html
from django.utils.text import capfirst
from django.forms.utils import flatatt, to_current_timezone
+from django.core.exceptions import PermissionDenied, ValidationError
from cgi import escape as html_escape
+from django.contrib import messages
import django_evolution
import threading
@@ -194,6 +196,21 @@
return super(XOSAdminMixin, self).change_view(request, object_id, extra_context=extra_context)
except PermissionDenied:
pass
+ except ValidationError as e:
+ if (e.params is None):
+ # Validation errors that don't reference a specific field will
+ # often throw a non-descriptive 500 page to the user. The code
+ # below will cause an error message to be printed and the
+ # page refreshed instead.
+ # As a side-effect it turns the request back into a 'GET' which
+ # may wipe anything the user had changed on the page. But, at
+ # least the user gets a real error message.
+ # TODO: revisit this and display some kind of error view
+ request.method = 'GET'
+ messages.error(request, e.message)
+ return super(XOSAdminMixin, self).change_view(request, object_id, extra_context=extra_context)
+ else:
+ raise
if request.method == 'POST':
raise PermissionDenied
request.readonly = True
diff --git a/xos/core/models/sliver.py b/xos/core/models/sliver.py
index 6c102d5..5430dc7 100644
--- a/xos/core/models/sliver.py
+++ b/xos/core/models/sliver.py
@@ -16,6 +16,7 @@
from django.contrib.contenttypes import generic
from xos.config import Config
from monitor import driver as monitor
+from django.core.exceptions import PermissionDenied, ValidationError
config = Config()
@@ -114,6 +115,13 @@
if not self.creator:
raise ValidationError('sliver has no creator')
+ if (self.slice.creator != self.creator):
+ # Check to make sure there's a slice_privilege for the user. If there
+ # isn't, then keystone will throw an exception inside the observer.
+ slice_privs = SlicePrivilege.objects.filter(slice=self.slice, user=self.creator)
+ if not slice_privs:
+ raise ValidationError('sliver creator has no privileges on slice')
+
# XXX smbaker - disabled for now, was causing fault in tenant view create slice
# if not self.controllerNetwork.test_acl(slice=self.slice):
# raise exceptions.ValidationError("Deployment %s's ACL does not allow any of this slice %s's users" % (self.controllerNetwork.name, self.slice.name))