如何允许用户仅在django rest框架中修改其数据？

Question

I have a Location model that only should be modified by the owner

class Location(models.Model):
    user = models.ForeignKey(User)
    name = models.CharField(max_length=100)
    address = models.TextField()

This is the API Location Serializer

class LocationSerializer(serializers.ModelSerializer):

    class Meta:
        model = Location
        fields = ('user', 'name', 'address',)

The problem is that I want the user be the request user

Actually I overwrite the create method of viewset but I think that is not the best solution

class LocationViewSet(mixins.CreateModelMixin,
                mixins.RetrieveModelMixin,
                mixins.ListModelMixin,
                GenericViewSet):
    model = Location
    serializer_class = LocationSerializer

    def get_queryset(self):
        return self.model.objects.filter(user=self.request.user)

    def create(self, request, *args, **kwargs):
        data = request.DATA.copy()
        data.update({'user':unicode(self.request.user.id)})

        serializer = self.get_serializer(data=data, files=request.FILES)

        if serializer.is_valid():
            self.pre_save(serializer.object)
            self.object = serializer.save(force_insert=True)
            self.post_save(self.object, created=True)
            headers = self.get_success_headers(serializer.data)
            return Response(serializer.data, status=status.HTTP_201_CREATED,
                        headers=headers)

            return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

Thanks for any suggestions

Answer 1

You want to adapt the example from the tutorial about associating snippets with users . Keep your get_queryset implementation and then set the user field to the request user in pre_save .