django authorization in class-based view
I'm trying to restrict access of CRUD pages to the owners, but I can't find the class-based view equivalent of "if request.user != post.author raise Http404". Thx for your time.
models.py
class Article(models.Model):
title = models.CharField(max_length=255)
body = models.TextField()
date = models.DateTimeField(auto_now_add=True)
author = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
def __str__(self):
return self.title
def get_absolute_url(self):
return reverse('article_detail', args=[str(self.id)])
views.py
class ArticleUpdateView(LoginRequiredMixin, UpdateView):
model = Article
fields = ['title', 'body']
template_name = 'article_edit.html'
login_url = 'login'
I tried the following (and many other combination arround those lines), but it isn't working.
def get(self, request, *args, **kwargs):
if self.request.user == self.obj.author:
raise Http404()
django request authorization
asked Nov 20 '18 at 6:20
josephjoseph
125
add a comment |
I'm trying to restrict access of CRUD pages to the owners, but I can't find the class-based view equivalent of "if request.user != post.author raise Http404". Thx for your time.
models.py
class Article(models.Model):
title = models.CharField(max_length=255)
body = models.TextField()
date = models.DateTimeField(auto_now_add=True)
author = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
def __str__(self):
return self.title
def get_absolute_url(self):
return reverse('article_detail', args=[str(self.id)])
views.py
class ArticleUpdateView(LoginRequiredMixin, UpdateView):
model = Article
fields = ['title', 'body']
template_name = 'article_edit.html'
login_url = 'login'
I tried the following (and many other combination arround those lines), but it isn't working.
def get(self, request, *args, **kwargs):
if self.request.user == self.obj.author:
raise Http404()
django request authorization
asked Nov 20 '18 at 6:20
josephjoseph
125
add a comment |
I'm trying to restrict access of CRUD pages to the owners, but I can't find the class-based view equivalent of "if request.user != post.author raise Http404". Thx for your time.
models.py
class Article(models.Model):
title = models.CharField(max_length=255)
body = models.TextField()
date = models.DateTimeField(auto_now_add=True)
author = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
def __str__(self):
return self.title
def get_absolute_url(self):
return reverse('article_detail', args=[str(self.id)])
views.py
class ArticleUpdateView(LoginRequiredMixin, UpdateView):
model = Article
fields = ['title', 'body']
template_name = 'article_edit.html'
login_url = 'login'
I tried the following (and many other combination arround those lines), but it isn't working.
def get(self, request, *args, **kwargs):
if self.request.user == self.obj.author:
raise Http404()
django request authorization
asked Nov 20 '18 at 6:20
josephjoseph
125
I'm trying to restrict access of CRUD pages to the owners, but I can't find the class-based view equivalent of "if request.user != post.author raise Http404". Thx for your time.
models.py
class Article(models.Model):
title = models.CharField(max_length=255)
body = models.TextField()
date = models.DateTimeField(auto_now_add=True)
author = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
def __str__(self):
return self.title
def get_absolute_url(self):
return reverse('article_detail', args=[str(self.id)])
views.py
class ArticleUpdateView(LoginRequiredMixin, UpdateView):
model = Article
fields = ['title', 'body']
template_name = 'article_edit.html'
login_url = 'login'
I tried the following (and many other combination arround those lines), but it isn't working.
def get(self, request, *args, **kwargs):
if self.request.user == self.obj.author:
raise Http404()
django request authorization
django request authorization
asked Nov 20 '18 at 6:20
josephjoseph
125
asked Nov 20 '18 at 6:20
josephjoseph
125
asked Nov 20 '18 at 6:20
josephjoseph
125
asked Nov 20 '18 at 6:20
josephjoseph
125
asked Nov 20 '18 at 6:20
josephjoseph
125
125
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
Youn can do something like this:-
class ArticleUpdateView(LoginRequiredMixin, UpdateView):
model = Article
fields = ['title', 'body']
template_name = 'article_edit.html'
login_url = 'login'
def get(self, request, *args, **kwargs):
self.obj = self.get_object()
if self.request.user != self.obj.author:
raise Http404()
return super(ArticleUpdateView, self).get(request, *args, **kwargs)
answered Nov 20 '18 at 6:34
Ritesh BishtRitesh Bisht
515
Not working : 'super' object has no attribute 'get'
– joseph
Nov 20 '18 at 6:55
replace super(ArticleUpdateView).get(self, request, *args, **kwargs) with this super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:05
just add return in front of super then, like this return super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:16
add a comment |
I think you can override the get_queryset method to achieve this. For example:
class ArticleUpdateView(...):
def get_queryset(self):
queryset = super(ArticleUpdateView, self).get_queryset()
return queryset.filter(author = self.request.user)
So, when a user tries to update an post which is not created by him, then he will not be able to get it because will not be able find the post object in Queryset provided by get_queryset method. For details, please SingleObjectMixin which is later sub-classed by UpdateView. FYI you don't need to override the get method for this implementation.
answered Nov 20 '18 at 6:24
ruddraruddra
14.8k32748
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53387321%2fdjango-authorization-in-class-based-view%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Youn can do something like this:-
class ArticleUpdateView(LoginRequiredMixin, UpdateView):
model = Article
fields = ['title', 'body']
template_name = 'article_edit.html'
login_url = 'login'
def get(self, request, *args, **kwargs):
self.obj = self.get_object()
if self.request.user != self.obj.author:
raise Http404()
return super(ArticleUpdateView, self).get(request, *args, **kwargs)
answered Nov 20 '18 at 6:34
Ritesh BishtRitesh Bisht
515
Not working : 'super' object has no attribute 'get'
– joseph
Nov 20 '18 at 6:55
replace super(ArticleUpdateView).get(self, request, *args, **kwargs) with this super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:05
just add return in front of super then, like this return super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:16
add a comment |
Youn can do something like this:-
class ArticleUpdateView(LoginRequiredMixin, UpdateView):
model = Article
fields = ['title', 'body']
template_name = 'article_edit.html'
login_url = 'login'
def get(self, request, *args, **kwargs):
self.obj = self.get_object()
if self.request.user != self.obj.author:
raise Http404()
return super(ArticleUpdateView, self).get(request, *args, **kwargs)
answered Nov 20 '18 at 6:34
Ritesh BishtRitesh Bisht
515
Not working : 'super' object has no attribute 'get'
– joseph
Nov 20 '18 at 6:55
replace super(ArticleUpdateView).get(self, request, *args, **kwargs) with this super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:05
just add return in front of super then, like this return super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:16
add a comment |
Youn can do something like this:-
class ArticleUpdateView(LoginRequiredMixin, UpdateView):
model = Article
fields = ['title', 'body']
template_name = 'article_edit.html'
login_url = 'login'
def get(self, request, *args, **kwargs):
self.obj = self.get_object()
if self.request.user != self.obj.author:
raise Http404()
return super(ArticleUpdateView, self).get(request, *args, **kwargs)
answered Nov 20 '18 at 6:34
Ritesh BishtRitesh Bisht
515
Youn can do something like this:-
class ArticleUpdateView(LoginRequiredMixin, UpdateView):
model = Article
fields = ['title', 'body']
template_name = 'article_edit.html'
login_url = 'login'
def get(self, request, *args, **kwargs):
self.obj = self.get_object()
if self.request.user != self.obj.author:
raise Http404()
return super(ArticleUpdateView, self).get(request, *args, **kwargs)
answered Nov 20 '18 at 6:34
Ritesh BishtRitesh Bisht
515
edited Nov 20 '18 at 7:16
answered Nov 20 '18 at 6:34
Ritesh BishtRitesh Bisht
515
answered Nov 20 '18 at 6:34
Ritesh BishtRitesh Bisht
515
answered Nov 20 '18 at 6:34
Ritesh BishtRitesh Bisht
515
515
Not working : 'super' object has no attribute 'get'
– joseph
Nov 20 '18 at 6:55
replace super(ArticleUpdateView).get(self, request, *args, **kwargs) with this super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:05
just add return in front of super then, like this return super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:16
add a comment |
Not working : 'super' object has no attribute 'get'
– joseph
Nov 20 '18 at 6:55
replace super(ArticleUpdateView).get(self, request, *args, **kwargs) with this super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:05
just add return in front of super then, like this return super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:16
Not working : 'super' object has no attribute 'get'
– joseph
Nov 20 '18 at 6:55
Not working : 'super' object has no attribute 'get'
– joseph
Nov 20 '18 at 6:55
replace super(ArticleUpdateView).get(self, request, *args, **kwargs) with this super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:05
replace super(ArticleUpdateView).get(self, request, *args, **kwargs) with this super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:05
just add return in front of super then, like this return super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:16
just add return in front of super then, like this return super(ArticleUpdateView, self).get(request, *args, **kwargs)
– Ritesh Bisht
Nov 20 '18 at 7:16
add a comment |
I think you can override the get_queryset method to achieve this. For example:
class ArticleUpdateView(...):
def get_queryset(self):
queryset = super(ArticleUpdateView, self).get_queryset()
return queryset.filter(author = self.request.user)
So, when a user tries to update an post which is not created by him, then he will not be able to get it because will not be able find the post object in Queryset provided by get_queryset method. For details, please SingleObjectMixin which is later sub-classed by UpdateView. FYI you don't need to override the get method for this implementation.
answered Nov 20 '18 at 6:24
ruddraruddra
14.8k32748
add a comment |
I think you can override the get_queryset method to achieve this. For example:
class ArticleUpdateView(...):
def get_queryset(self):
queryset = super(ArticleUpdateView, self).get_queryset()
return queryset.filter(author = self.request.user)
So, when a user tries to update an post which is not created by him, then he will not be able to get it because will not be able find the post object in Queryset provided by get_queryset method. For details, please SingleObjectMixin which is later sub-classed by UpdateView. FYI you don't need to override the get method for this implementation.
answered Nov 20 '18 at 6:24
ruddraruddra
14.8k32748
add a comment |
I think you can override the get_queryset method to achieve this. For example:
class ArticleUpdateView(...):
def get_queryset(self):
queryset = super(ArticleUpdateView, self).get_queryset()
return queryset.filter(author = self.request.user)
So, when a user tries to update an post which is not created by him, then he will not be able to get it because will not be able find the post object in Queryset provided by get_queryset method. For details, please SingleObjectMixin which is later sub-classed by UpdateView. FYI you don't need to override the get method for this implementation.
answered Nov 20 '18 at 6:24
ruddraruddra
14.8k32748
I think you can override the get_queryset method to achieve this. For example:
class ArticleUpdateView(...):
def get_queryset(self):
queryset = super(ArticleUpdateView, self).get_queryset()
return queryset.filter(author = self.request.user)
So, when a user tries to update an post which is not created by him, then he will not be able to get it because will not be able find the post object in Queryset provided by get_queryset method. For details, please SingleObjectMixin which is later sub-classed by UpdateView. FYI you don't need to override the get method for this implementation.
answered Nov 20 '18 at 6:24
ruddraruddra
14.8k32748
edited Nov 20 '18 at 6:31
answered Nov 20 '18 at 6:24
ruddraruddra
14.8k32748
answered Nov 20 '18 at 6:24
ruddraruddra
14.8k32748
answered Nov 20 '18 at 6:24
ruddraruddra
14.8k32748
14.8k32748
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53387321%2fdjango-authorization-in-class-based-view%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
