How do I restrict access in django? - django

Question

I have an application in which all users, after registration, can publish articles, how can I make it so that only those who have the rights for this can publish (something like ordinary users and moderators / editors and how to grant these rights. Below is the attached code:
models.py/blogapp
class Post(models.Model):
title = models.CharField(verbose_name=("Заголовок"), max_length=200)
author = models.ForeignKey(User, on_delete=models.CASCADE)
header_image = models.ImageField(verbose_name=("Заглавное Изображение"), null=True, blank=True, upload_to="images/" )
body = RichTextField(verbose_name=("Тело Статьи"), blank=True, null=True)
#body = models.TextField(blank=True, null=True)
post_date = models.DateTimeField(auto_now_add=True)
category = models.CharField(verbose_name=("Категория"), max_length=200)
snippet = models.CharField(verbose_name=("Фрагмент Статьи"), max_length=200)
likes = models.ManyToManyField(User, related_name='blog_post')
updated_on = models.DateTimeField(auto_now= True)
def total_likes(self):
return self.likes.count()
def __str__(self):
return self.title + ' | ' + str(self.author)
def get_absolute_url(self):
return reverse('article_detail', args=[str(self.id)])
views.py/members
class CreateProfilePageView(CreateView):
model = Profile
form_class = ProfilePageForm
template_name = "registration/create_user_profile.html"
#fields = '__all__'
def form_valid(self, form):
form.instance.user = self.request.user
return super().form_valid(form)
class EditProfilePageView(generic.UpdateView):
model = Profile
template_name = 'registration/edit_profile_page.html'
fields = ['bio', 'profile_pic', 'website_url', 'instagram_url', 'twitter_url', 'status', 'age']
success_url = reverse_lazy('home')
class ShowProfilePageView(DetailView):
model = Profile
template_name = 'registration/user_profile.html'
def get_context_data(self, *args, **kwargs):
#users = Profile.objects.all()
context = super(ShowProfilePageView, self).get_context_data(*args, **kwargs)
page_user = get_object_or_404(Profile, id=self.kwargs['pk'])
context["page_user"] = page_user
return context
class PasswordsChangeView(PasswordChangeView):
form_class = PasswordChangingForm
#form_class = PasswordChangeForm
success_url = reverse_lazy('password_success')
#success_url = reverse_lazy('home')
def password_success(request):
return render(request, 'registration/password_success.html', {})
class UserRegisterView(generic.CreateView):
form_class = SignUpForm
template_name = 'registration/registr.html'
success_url = reverse_lazy('login')
class UserEditView(generic.UpdateView):
form_class = EditProfileForm
template_name = 'registration/edit_profile.html'
success_url = reverse_lazy('home')
def get_object(self):
return self.request.user
views.py/blogapp
class HomeView(ListView):
model = Post
queryset = Post.objects.filter(draft=False)
cats = Category.objects.all()
template_name = 'home.html'
ordering = ['-post_date']
paginate_by = 6
def get_context_data(self, *args, **kwargs):
cat_menu = Category.objects.all()
context = super(HomeView, self).get_context_data(*args, **kwargs)
context["cat_menu"] = cat_menu
return context
def CategoryListView(request):
cat_menu = Category.objects.all()
return render(request, 'category_list.html', {'cat_menu':cat_menu})
def CategoryView(request, cats):
category_posts = Post.objects.filter(category = cats). order_by('-post_date')
return render(request, 'categories.html', {'cats':cats.title(), 'category_posts':category_posts})
class ArticleDetailView(HitCountDetailView):
model = Post
template_name = 'post_detail.html'
count_hit = True
def get_context_data(self, *args, **kwargs):
cat_menu = Category.objects.all()
context = super(ArticleDetailView, self).get_context_data(*args, **kwargs)
stuff = get_object_or_404(Post, id=self.kwargs['pk'])
total_likes = stuff.total_likes()
context["cat_menu"] = cat_menu
context["total_likes"] = total_likes
return context
class AddPostView(CreateView):
model = Post
form_class = PostForm
template_name= 'add_post.html'
#fields = '__all__'
class AddCommentView(CreateView):
model = Comment
form_class = CommentForm
template_name= 'add_comment.html'
def form_valid(self, form):
form.instance.post_id = self.kwargs['pk']
return super().form_valid(form)
def get_success_url(self):
return reverse_lazy('article_detail', kwargs={'pk': self.kwargs['pk']})
class AddCategoryView(CreateView):
model = Category
template_name= 'add_category.html'
fields = '__all__'
class UpdatePostView(UpdateView):
model = Post
template_name = 'update_post.html'
form_class = EditForm
#fields = ['title', 'body']
class DeletePostView(DeleteView):
model = Post
template_name = 'delete_post.html'
success_url = reverse_lazy('home')
If you need any more code, I will attach it, thanks, and forgive my english)

Answer 1

Hello asd you can add flags like this in your Profile Model like this
class Profile(models.Model):
user = models.ForeignKey(User,on_delete=models.PROTECT)
is_moderator = models.BooleanField(default=False)
is_editor = models.BooleanField(default=False)#you can add many more as you want
and you can validate user in template or in views like this
in views.py
def check_user(request):
moderator_profile = Profile(user_id=request.user.id,is_moderator=True)
editor_profile = Profile(user_id=request.user.id,is_editor=True)
if user_profile:
return redirect('url_for_moderator')
elif editor_profile:
return redirect('url_for_editor')
OR
you can pass data to the template and give certain functionality for certain user
like this
in your views.py
def get_post(request):
user_profile = Profile.objects.filter(user=request.user.id)
return render(request,"post.html",{"user_profile":user_profile})
and inside post.html
{% if user_profile.is_editor or user_profile.is_moderator %}
<button>Edit</button>
{% endif %}
if you don't like this way you can do it in better way check this post
https://simpleisbetterthancomplex.com/tutorial/2018/01/18/how-to-implement-multiple-user-types-with-django.html