Django查询集过滤不起作用

Question

I want the admin users to see only the model instances they created. I followed these instructions Filter django admin by logged in user

class FilterUserAdmin(admin.ModelAdmin): 
    def save_model(self, request, obj, form, change):
        if getattr(obj, 'user', None) is None:  #Assign user only the first time, superusers can edit without changing user
            obj.user = request.user
        obj.save()
    def queryset(self, request):
        qs = super(FilterUserAdmin, self).queryset(request)
        if request.user.is_superuser:
            return qs
        return qs.filter(user=request.user)
    def has_change_permission(self, request, obj=None):
        if not obj:
            # the changelist itself
            print('query change')
            return True # So they can see the change list page
        return obj.user == request.user or request.user.is_superuser


class CampaignAdmin(FilterUserAdmin):
   ...

This is how my code looks like. Saving is fine. However, other users are seeing the model campaign in their campaign list, though they were not able to edit it. When a user, who is not the owner clicks the campaign to edit, 403 Forbidden page is seen.

I don't want the model instance to be shown in the other users' campaign list.

Answer 1

You should override get_queryset , not queryset . The method was renamed from queryset to get_queryset in Django 1.6.

def get_queryset(self, request):
    qs = super(FilterUserAdmin, self).get_queryset(request)
    if request.user.is_superuser:
        return qs
    return qs.filter(user=request.user)

Note that you do not need to use getattr when checking if getattr(obj, 'user', None) is None: , you can simplify it to if obj.user is None .