CODEWITHSUNDEEP
pythondjangodjango-class-based-views
user3913192
user3913192

Reputation: 15

Django Class Based View UpdateView Restricted User

I am trying to use a Django UpdateView to display an update form for the user. https://docs.djangoproject.com/en/1.8/ref/class-based-views/generic-editing/

I only want the user to be able to edit their own form.

How can I filter or restrict the the objects in the model to only show objects belonging to the authenticated user?

When the user only has one object I can use this:

def get_object(self, queryset=None):
        return self.request.user.profile.researcher

However, I now need the user to be able to edit multiple objects.

UPDATE:

class ExperimentList(ListView):

model = Experiment
template_name = 'part_finder/experiment_list.html'

def get_queryset(self):
    self.researcher = get_object_or_404(Researcher, id=self.args[0])
    return Experiment.objects.filter(researcher=self.researcher)

class ExperimentUpdate(UpdateView):

model = Experiment
template_name = 'part_finder/experiment_update.html'
success_url='/part_finder/'
fields = ['name','short_description','long_description','duration', 'city','address', 'url']

def get_queryset(self):
    qs = super(ExperimentUpdate, self).get_queryset()
    return qs.filter(researcher=self.request.user.profile.researcher)

URL:

url(r'^experiment/update/(?P<pk>[\w\-]+)/$', login_required(ExperimentUpdate.as_view()), name='update_experiment'),

Upvotes: 1

Views: 1657

Answers (2)

Burhan Khalid
Burhan Khalid

Reputation: 174624

UpdateView is only for one object; you'd need to implement a ListView that is filtered for objects belonging to that user, and then provide edit links appropriately.

To prevent someone from simply putting the URL for an edit view explicitly, you can override get_object (as you are doing in your question) and return an appropriate response.

I have successfully been able to generate the list view and can get the update view to work by passing a PK. However, when trying to override the UpdateView get_object, I'm still running into problems.

Simply override the get_queryset method:

def get_queryset(self):
  qs = super(ExperimentUpdate, self).get_queryset()

  # replace this with whatever makes sense for your application
  return qs.filter(user=self.request.user)

If you do the above, then you don't need to override get_object.

The other (more complicated) option is to use custom form classes in your UpdateView; one for each of the objects - or simply use a normal method-based-view with multiple objects.

Upvotes: 3

Pynchia
Pynchia

Reputation: 11590

As the previous answer has indicated, act on the list to show only the elements belonging to the user. Then in the update view you can limit the queryset which is used to pick the object by overriding

def get_queryset(self):
    qs = super(YourUpdateView, self).get_queryset()
    return qs.filter(user=self.request.user)

Upvotes: 0

Related Questions