CODEWITHSUNDEEP
djangodjango-admin
Jay P.
Jay P.

Reputation: 2590

Is it possible to limit accessing posts to its own writer?

In my Django admin, I have a column, created_by, which is for who made a post. I have many people who can access Django admin to make posts. The problem is that it is possible for them to edit each other's posts right now.

I want them to be able to edit only their each own posts, not others' posts. Is there anyway to limit access permission to a specific user in Django admin?

Also, here's my codes for admin.py and models.py.

admin.py

@admin.register(Store)
class StoreAdmin(SummernoteModelAdmin):
    summernote_fields = '__all__'
    formfield_overrides = {
        models.CharField: {'widget': TextInput(attrs={'size': '91'})},
    }
    list_display = ('id', 'status', 'businessName',
                    'typ', 'author', 'updated_by', 'created_by', 'updated_at', 'created_at')
    list_filter = ('businessName',)
    search_fields = ('businessName',)

    def save_model(self, request, obj, form, change):
        # adding the entry for the first time
        if not change:
            obj.created_by = request.user
        # updating already existing record
        else:
            obj.updated_by = request.user
        obj.save()

models.py

class Store(TimeStampedModel):
    ...
    created_by = ForeignKey(settings.AUTH_USER_MODEL, editable=False,
                            related_name='stores_of_created_by', null=True, blank=True)
    updated_by = ForeignKey(settings.AUTH_USER_MODEL, editable=False,
                            related_name='stores_of_updated_by', null=True, blank=True)

Upvotes: 0

Views: 41

Answers (1)

JPG
JPG

Reputation: 88519

I think you should override the get_queryset() method of ModelAdmin as below

@admin.register(Store)
class StoreAdmin(SummernoteModelAdmin):
    # your code
    def get_queryset(self, request):
        if request.user.is_superuser:
            return super(StoreAdmin, self).get_queryset(request).filter(created_by=request.user)
        if request.user.is_staff:
            return someting 
    # your code

Upvotes: 2

Related Questions