Restrict users to read exclusively one's own articles - django

Question

I have the following article_detail view which restrict that only users logged in could read the details.
#login_required(login_url="/user/login/")
def article_detail(request, pk):
article = get_object_or_404(Article, pk=pk)
total_views = r.incr("article:{}:views".format(article.id))
page_number = request.GET.get('page_number', 1)
#mimic SO's 100 per-page
per_page = request.GET.get("per_page", 30)
....
How could I set that each user can exclusively read contents posted by oneself?
The article model
class Article(models.Model):
STATUS = (
(1, 'normal'),
(0, 'deleted'),
)
tags = models.ManyToManyField(Tag, blank=True)
owner = models.ForeignKey(User, on_delete=models.CASCADE)
block = models.ForeignKey(Block, on_delete=models.CASCADE)
title = models.CharField(max_length=100)
content = models.TextField() # set the widget
status = models.IntegerField(choices=STATUS, default=1)
date_created = models.DateTimeField(auto_now_add=True)
date_updated = models.DateTimeField(auto_now=True)
class Meta:
ordering = ("-date_created",)
def __str__(self):
return self.title

Answer 1

Just add one more criteria (owner) in your query:
article = get_object_or_404(Article, pk=pk, owner=request.user)
If the request user is NOT the article owner, then 404 will be returned.
You can also return 403 permission denied error with following codes which is more meaningful to the client:
from from django.http.response import HttpResponseForbidden
article = get_object_or_404(Article, pk=pk)
if article.owner.pk != request.user.pk:
return HttpResponseForbidden()
... # permission checking pass, so other code goes here