How to define permission on django views? - django

Question

I have these models:
class Author(Model):
user = OneToOneField(User, on_delete=CASCADE)
# Fields
class Post(Model):
author = ForeignKey(Author, on_delete=CASCADE)
title = models.CharField(max_length=200)
text = models.TextField()
and a few views as below:
def authors(request)
authors = Authors.objects.all()
return render(request, 'authors.html', {'authors': authors})
The authors' view has a corresponding url path as below:
path('authors/', authors, name='authors')
in authors.html I loop over authors and for each one, I have a link that
sends the author primary key to the author url and view:
{% for author in authors%}
<a href="{% url 'author' author_pk=author.pk %}"{{author.user.email}}</a><br><br>
{% endfor %}
Ok; Everybody is able to see the list of authors.
I then have author url path as below:
path('authors/<int:author_pk>/', author, name='author')
path('authors/<int:author_pk>/<int:post_pk>/delete/', author_delete_post, name='author_delete_post')
And I have the author view in which I show the posts each author has published and a button to delete it.
def author(request, author_pk)
author=get_object_or_404(Author, pk=author_pk)
author_posts = Post.objects.filter(author=author)
return render(request, 'author.html', {'author_posts': author_posts}
#login_required
def author_delete_post(request, author_pk, post_pk):
author=get_object_or_404(Author, pk=author_pk)
author_post = Post.objects.get(author=author, pk=post_pk) # I know that author=author is redundent but it makes no problem
author_post.delete()
return redirect(author, author_pk)
This author template:
{% for author_post in author_posts %}
{{author_post.title}}<br>
{% if user.is_authenticated and author.user == user %}
Delete<br><br><br>
{% endif %}
{% endfor %}
I am letting those authors who are logged in and are in their own page to be able to see the delete button. This is something like facebook that a user is able to delete just his/her posts, not other's.
My problem:
Suppose there is an other having pk=1 and is logged in.
Although he/she cannot see delete button when he/she is in this page:
'/authors/2/'
he/she can play with the url and delete a post of another user having pk=2
'authors/2/10/delete/'
How can I solve this problem?

Answer 1

You can use the request.user to check if the object belongs to the logged in user
Also you should not need to add the author_pk. You can get the author with author = get_object_or_404(Author, user=request.user)
#login_required
def author_delete_post(request, post_pk):
author = get_object_or_404(Author, user=request.user)
author_post = Post.objects.get(author=author, pk=post_pk) # I know that author=author is redundent but it makes no problem
# check if the post belongs to the logged in user
if author_post.author.user == request.user:
# delete here
return redirect(author, author.pk)