How can I restrict user from accessing some specific urls? - django

Question

I have created a view which allow user to delete a specific Booking provided with id but I dont want other user except the user associated with the Booking object to delete it. How I can restrict user to access urls which delete booking they not own.
The urls:
path('manage/', views.ManageView, name='manage'),
path('manage/delete_booking/(?P<pk>\d+)', views.delete_booking, name='delete_booking'),
The views:
#login_required
def delete_booking(request, pk):
booking = Booking.objects.get(pk=pk)
booking.delete()
return redirect('manage')
#login_required
def ManageView(request):
bookings = Booking.objects.filter(user=request.user)
context = {
'user': request.user,
'bookings': bookings
}
return render(request, 'timetable/manage.html', context)
Template:
<div class="w3-content">
<div class="w3-third w3-padding w3-center">
<h4 class="bg-color">Infomation</h4>
<p>Student ID: {{ user.profile.student_id }}</p>
<p>Full name: {{ user.last_name }} {{ user.first_name }}</p>
</div>
<div class="w3-two w3-padding w3-center">
<h4 class="bg-color">Booking</h4>
{% if not bookings.exists %}
<p>You don't have any booking</p>
{% else %}
{% for booking in bookings %}
<p>{{ booking.room }} {{ booking.date }} {{ booking.lesson.number }} Delete</p>
{% endfor %}
{% endif %}
</div>

Answer 1

You can add a check in the view, for example:
#login_required
def delete_booking(request, pk):
booking = get_object_or_404(Booking, pk=pk, user=request.user)
booking.delete()
return redirect('manage')
Here it will raise a 404 error (not found) in case it can not find an object with that pk, or the user is not request.user.
You can also check:
#login_required
def delete_booking(request, pk):
booking = get_object_or_404(Booking, pk=pk)
if booking.user_id != request.user.id:
return HttpResponse('Unauthorized', status=401)
booking.delete()
return redirect('manage')
This will return a 401 error (not authorized).
Both methods have its merits. For example by raising a 401, you give a "hint" that there exists an object with this pk. A malicious user could then try to access (view, alter, or delete) the object through another way. On the other hand a 401 describes better what the problem is: the user can not view/update/change the object. The frontend can give a more informative message. For example if a certain administrator has not enough rights to handle a certain object.
Note: usually only POST, PATCH, PUT, and DELETE methods should have side-effects. So you might want to omit the request.method == 'GET' case as well. Robots like search engines typically "assume" that GET requests are safe (well actually they should be safe). So by not checking the method, a search engine could "trigger" removal, updates, etc.