如何限制用户访问权限以查看/修改其他用户使用Django创建的对象

Question

I'm making a hobby project with Django to store my ideas seperated by idea groups as the following:

class Idea(models.Model):
    name = models.CharField(unique=True, max_length=50)
    description = models.TextField()
    in_process = models.BooleanField()
    is_done = models.BooleanField()
    group = models.ForeignKey(Group, on_delete=models.CASCADE, blank=False)


class Group(models.Model):
    name = models.CharField(unique=True, max_length=25)
    description = models.CharField(max_length=50, blank=True)
    user = models.ForeignKey(User, on_delete=models.CASCADE, blank=False)

Is there any way to restrict the currently logged in user from being able to see or modify ideas and idea groups created by other users using generic class based views?

class GroupDelete(LoginRequiredMixin, generic.DeleteView):
    model = Group
    pk_url_kwarg = "id"
    success_url = reverse_lazy('ideas:list')

...and a url for example:

urlpatterns = [
    path('<int:id>/delete', views.GroupDelete.as_view(), name='delete'),
]

I'm using Django 2.0.

Answer 1

I would suggest writing a custom mixin where you'd inherit the LoginRequiredMixin and then add your own logic verifying that the currently logged in user (which you can retreive from request.user ) is the one who actually created the Group object.

Simple example would look something like this:

# mixins.py
from django.contrib.auth.mixins import LoginRequiredMixin
from django.http import HttpResponseNotFound, HttpResponseRedirect


class YourCustomMixin(LoginRequiredMixin):
    def dispatch(self, request, *args, **kwargs):
        can_access = ... logic to check if user can access Group ...

        disp = super().dispatch(request, *args, **kwargs)
        if not isinstance(disp, HttpResponseRedirect) and not can_access:
            return HttpResponseNotFound()
        return disp

Once you have a value for the can_access flag, you call the LoginRequiredMixin 's dispatch method and check if the result of that call is a redirect (to the login page) and check against the can_access flag, and then either return HttpResponseNotFound() or the original disp result.

Of course, you could also return HttpResponseForbidden() instead of HttpResponseNotFound() .

You can then use it in your views, eg:

from your_app.mixins import YourCustomMixin


class GroupDelete(YourCustomMixin, generic.DeleteView):
    ...