如何使用detailview类限制对对象的访问 [英] How to restrict access to objects using detailview class

问题描述

我试图将显示对象限制为创建它的用户。
是在对象​​模型中使用外键完成的吗？

Im trying to limit the display objects to the user who created it. Is it done using a foreign key in the object model?

例如：
用户1可以访问对象1
用户2可以访问对象2

Ex: User 1 may access object 1 User 2 may access object 2

此刻，任何用户只要输入正确的URL即可访问该对象。

At this moment any user can access any object just entering the correct URL to that object.

文件views.py

File views.py

from django.shortcuts import render
from django.http.response import Http404
from .models import Host
from django.views.generic.detail import DetailView
from django.views.generic.list import ListView
from django.contrib.auth.decorators import login_required
# Create your views here.


def index(request):
    return render(request, 'index.html')


class HostDetail(DetailView):

    model = Host

    def get_context_data(self, **kwargs):
        context = super(HostDetail, self).get_context_data(**kwargs)
        return context


class HostList(ListView):

    model = Host

    def get_queryset(self, **kwargs):

        qs = super(HostList, self).get_queryset(**kwargs).filter(perfil=self.request.user.perfil.id)
        return qs

文件models.py

File models.py

class Perfil(models.Model):

    usuario = models.OneToOneField(User, on_delete=models.CASCADE)
    zbx_user = models.CharField(max_length=255, null=False)
    pwd = models.CharField(max_length=255, null=False)
    nome = models.CharField(max_length=255, null=False)
    grupo = models.CharField(max_length=255, null=False)
    numero_hosts = models.IntegerField(null=True)

    def __str__(self):

        return self.nome

class Host(models.Model):

    host_name = models.CharField(max_length=120)
    templateid = models.PositiveIntegerField()
    tipo = models.PositiveIntegerField()
    ip = models.GenericIPAddressField()
    dns = models.CharField(max_length=120, default="")
    host_id = models.PositiveIntegerField()
    # Relacionamento 1 pra N com Perfil
    perfil = models.ForeignKey(Perfil, on_delete=models.CASCADE)

    def __str__(self):
        return self.host_name

文件urls.py

from django.conf.urls import url
from . import views
from django.conf.urls.static import static
from django.conf import settings
from .views import HostDetail, HostList

urlpatterns = [

    # Rota para index perfis
    url(r'^$', views.index, name='index'),
    url(r'^host/(?P<pk>\d+)$', HostDetail.as_view(), name='HostDetail'),
    url(r'^host/$', HostList.as_view(), name='HostList'),

谢谢

推荐答案

使用与 ListView 相同的方法。使用 self.request.user 过滤查询集。

Use the same approach as you use for the ListView. Filter the queryset using self.request.user.

您可能还想使用在两个视图上都使用LoginRequiredMixin ，以便只有登录用户才能访问视图。

You may also want to use LoginRequiredMixin on both views, so that only logged-in users can access the views.

from django.contrib.auth.mixins import LoginRequiredMixin

class HostDetail(LoginRequiredMixin, DetailView):
    model = Host

    def get_queryset(self):
        qs = super(HostList, self).get_queryset().filter(perfil=self.request.user.perfil_id)
        return qs

    ...

这篇关于如何使用detailview类限制对对象的访问的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！