Restricted non-admin user choices in then field

flowspec/forms.py

@@ -22,6 +22,7 @@ class RouteForm(forms.ModelForm):
 #                                         " e.g.10.10.0.1/32"), label=ugettext_lazy("Destination Address"), required=False)
 #    destination_ports = forms.ModelMultipleChoiceField(queryset=MatchPort.objects.all(), help_text=ugettext_lazy("A set of destination ports to block"), label=ugettext_lazy("Destination Ports"), required=False)
 #    ports = forms.ModelMultipleChoiceField(queryset=MatchPort.objects.all(), help_text=ugettext_lazy("A set of ports to block"), label=ugettext_lazy("Ports"), required=False)
+
     class Meta:
         model = Route
     
@@ -99,6 +100,8 @@ class RouteForm(forms.ModelForm):
             raise forms.ValidationError('Once destination port is matched, destination has to be filled as well. Either deselect destination port or fill destination address')
         if not (source or sourceports or ports or destination or destinationports):
             raise forms.ValidationError('Fill at least a Route Match Condition')
+        if not user.is_superuser and then[0].action not in settings.UI_USER_THEN_ACTIONS:
+            raise forms.ValidationError('This action "%s" is not permitted' %(then[0].action))
         existing_routes = Route.objects.exclude(status='EXPIRED').exclude(status='PENDING').exclude(status='ERROR').exclude(status='ADMININACTIVE')
         existing_routes = existing_routes.filter(applier__userprofile__peer=peer)
         if source:

flowspec/views.py

@@ -78,6 +78,8 @@ def add_route(request):
          return HttpResponseRedirect(reverse("group-routes"))
     if request.method == "GET":
         form = RouteForm()
+        if not request.user.is_superuser:
+            form.fields['then'] = forms.ModelMultipleChoiceField(queryset=ThenAction.objects.filter(action__in=settings.UI_USER_THEN_ACTIONS).order_by('action'), required=True)
         return render_to_response('apply.html', {'form': form, 'applier': applier},
                                   context_instance=RequestContext(request))
 
@@ -153,6 +155,8 @@ def edit_route(request, route_slug):
         dictionary = model_to_dict(route_edit, fields=[], exclude=[])
         #form = RouteForm(instance=route_edit)
         form = RouteForm(dictionary)
+        if not request.user.is_superuser:
+            form.fields['then'] = forms.ModelMultipleChoiceField(queryset=ThenAction.objects.filter(action__in=settings.UI_USER_THEN_ACTIONS).order_by('action'), required=True)
         return render_to_response('apply.html', {'form': form, 'edit':True, 'applier': applier},
                                   context_instance=RequestContext(request))