Advice on Django user profile edit views - django

Question

I'm building a Django app that will have users and profile models associated with them and they should have the ability to edit their profile in a view. As I see there are two similar but slightly different approaches how that could be done.
An UpdateView could be used that retrieves a pk from the url and then verifies if the pk corresponds to the actual authenticated user, for instance:
class ProfileUpdateView(UpdateView):
model = Profile
fields = ['field1', 'field2']
def get_object(self, queryset=None):
obj = super().get_object(queryset=queryset)
if obj.user != self.request.user:
# If the object user does not match the logged in user,
# raise a 404 Not Found exception.
raise Http404("You do not have permission to edit this profile.")
return obj
Or an alternative way that would check/ reference the current user via Django's authentication backend, for instance:
def profile_update(request):
profile = request.user.profile
form = ProfileForm(request.POST or None, instance=profile)
if form.is_valid():
form.save()
context = {'form': form}
return render(request, 'profile_update.html', context)
The main question is a bit generic, hence the name 'advice' in the post title, but are there any benefits/ risks associated with one or the other way of implementing a profile edit view that one should definitely consider when choosing between the two? The relationship between User and Profile model is a OneToOne relationship.
Thank's

Answer 1

I would not say it makes any difference, as long as only authenticated user can login in and one user can not modify other's profile. You can take any of the approaches, even implement the second approach in the first view (using /update/profile within Class Based View), like this:
class ProfileUpdateView(LoginRequiredMixin, UpdateView):
model = Profile
fields = ['field1', 'field2']
def get_object(self, queryset=None):
return self.request.user.profile
But you need to use LoginRequiredMixin with the view so that only authenticated users can log in.

Answer 2

A simpler way is to use the framework's own functions directly, for example, use login_required to check if a user is logged in, and forms to control user profile editing.
Here is my own code for your reference.
views.py
from django.contrib.auth.models import User
from django.contrib.auth.decorators import login_required
from django.contrib import messages
from .forms import UserProfileForm
#login_required
def userinfo(request):
if request.method == 'POST':
form = UserProfileForm(request.POST)
if form.is_valid():
user = User.objects.get(pk=request.user.id)
user.first_name = form.cleaned_data['fullname']
user.email = form.cleaned_data['email']
user.save()
msg = "Profile updated!"
messages.add_message(request, messages.SUCCESS, msg)
return redirect('user.info')
else:
form = UserProfileForm()
context = {
'title': 'My Profile',
'form': form,
}
return render(request, 'accounts/info.html', context)
forms.py
from django import forms
class UserProfileForm(forms.Form):
fullname = forms.CharField(
label="Name",
error_messages={
'required': 'Required!',
})
email = forms.EmailField(
label="E-mail",
error_messages={
'required': 'Required!',
'invalid': 'The format is not correct!',
})