Django - how to restrict DeleteView to object owner

user_8836489 0
Viewed 672

I'm trying to implement a DeleteView and prevent the model from being deleted if the user is not the owner. I'm sure it's a pretty trivial task but i can't manage to find a clear answer. So far I can see my view but currently everyone can delete the object.

Here is my code :

views.py :

@method_decorator(login_required, name='dispatch')
class RestaurantDeleteView(DeleteView):
    model = Restaurant
    template_name = 'restaurant/delete_form.html'
    success_url = '/'

models.py :

class Restaurant(models.Model):
    owner = models.ForeignKey(User, on_delete=models.CASCADE)
    name = models.CharField(max_length=200)
    category = models.CharField(max_length=200)
    description = models.TextField()
    capacity = models.IntegerField(default=0)

def get_absolute_url(self):
    return reverse('detail', kwargs={'pk': self.pk})

Thanks in advance !

view django python
1 Answers

This might not be the best way, but it illustrates the point.

In your views.py, you can access self.get_object() to get the model instance in reference, and then check to see if instance.owner == self.request.user. Look at the source code and try to remain faithful as much possible to the original. All you need is a conditional check.

Something like this:

@method_decorator(login_required, name='dispatch')
class FooDeleteView(DeleteView):
    model = Foo
    success_url = reverse_lazy('index')

    def get(self, request, *args, **kwargs):
        self.object = self.get_object()
        if self.object.owner != self.request.user:
            return redirect(self.success_url)
        return super().post(request, *args, **kwargs)

If you are curious and would like to know more, you can import pdb and place pdb.set_trace() on the first line of the method, and explore what self is and what methods is available to it. You can do this by callin dir(self) once you inside the method call. You'd be surprised with the amount of things you'd discover.

user_70761860
Related