[webui] Disable create button and use public route

for icons.
The controller needs to be accessible for not logged in users otherwise interconnect won't work.
However, the create button needs to be disabled and retrieving the icons needs to happen
via the /public route, otherwise backend requires login to access the page.
Fixes #2619.

src/api/app/models/package.rb

@@ -433,6 +433,10 @@ def source_path(file = nil, opts = {})
     Package.source_path(project.name, name, file, opts)
   end
 
+  def public_source_path(file = nil, opts = {})
+    "/public#{source_path(file, opts)}"
+  end
+
   def source_file(file, opts = {})
     Suse::Backend.get(source_path(file, opts)).body
   end

src/api/app/views/webui/image_templates/index.html.haml

@@ -15,7 +15,7 @@
             %dd
               %span.form-radio
               - if template.has_icon?
-                %img{ alt: template.title, src: template.source_path('_icon') }
+                %img{ alt: template.title, src: template.public_source_path('_icon') }
               - else
                 = sprite_tag('drive-optical-48')
               %span.group
@@ -28,7 +28,7 @@
             There are currently no base image templates available for project
             = succeed '.' do
               %strong= title_or_name(project)
-  - if first_template && User.current
+  - if first_template
     .templates_form
       = form_tag({ controller: :package, action: :branch }, method: :post, id: 'appliance_form') do
         = hidden_field_tag 'linked_project', first_template.project
@@ -40,7 +40,7 @@
           (Maximum of 200 characters, no blank, /, :, - or ; characters)
         %br
         = text_field_tag(:target_package, first_template, class: 'name_appliance_form', required: true)
-        = submit_tag('Create appliance', class: 'create_appliance')
+        = submit_tag('Create appliance', class: 'create_appliance', disabled: User.current.is_nobody? ? true: nil)
   - elsif @projects.empty?
     %p
       There are no templates yet, sorry.