How to restrict access to certain user to an UpdateView?

Question

I have a schema like this:

models.py:

class Evento(models.Model):
    [...]
    user = ForeignKey(model=User)

forms.py:

class EventoForm(forms.ModelForm):
    class Meta:
        model = Evento

and a subclass of generic view UpdateView. I want to restrict access to that view to the user specified in that Evento instance. Where is the best approach to of that?

Answer 1

After calling dispatch, all your data is saved, no matter whether the user has permission. You must check permission before calling dispatch. Look at this snippets http://djangosnippets.org/snippets/2426/. But the better way redefine get_object method:

def get_object(self, *args, **kwargs):
    obj = super(EditarEvento, self).get_object(*args, **kwargs)
    if obj.user != self.request.user:
        raise PermissionDenied() #or Http404
    return obj