如何使用 detailview 类限制对对象的访问 [英] How to restrict access to objects using detailview class

问题描述

我试图将显示对象限制为创建它的用户.是在对象模型中使用外键完成的吗?

Im trying to limit the display objects to the user who created it. Is it done using a foreign key in the object model?

例如:用户 1 可以访问对象 1用户 2 可以访问对象 2

Ex: User 1 may access object 1 User 2 may access object 2

此时任何用户都可以访问任何对象，只需输入该对象的正确 URL.

At this moment any user can access any object just entering the correct URL to that object.

文件views.py

from django.shortcuts import render
from django.http.response import Http404
from .models import Host
from django.views.generic.detail import DetailView
from django.views.generic.list import ListView
from django.contrib.auth.decorators import login_required
# Create your views here.


def index(request):
    return render(request, 'index.html')


class HostDetail(DetailView):

    model = Host

    def get_context_data(self, **kwargs):
        context = super(HostDetail, self).get_context_data(**kwargs)
        return context


class HostList(ListView):

    model = Host

    def get_queryset(self, **kwargs):

        qs = super(HostList, self).get_queryset(**kwargs).filter(perfil=self.request.user.perfil.id)
        return qs

文件models.py

File models.py

class Perfil(models.Model):

    usuario = models.OneToOneField(User, on_delete=models.CASCADE)
    zbx_user = models.CharField(max_length=255, null=False)
    pwd = models.CharField(max_length=255, null=False)
    nome = models.CharField(max_length=255, null=False)
    grupo = models.CharField(max_length=255, null=False)
    numero_hosts = models.IntegerField(null=True)

    def __str__(self):

        return self.nome

class Host(models.Model):

    host_name = models.CharField(max_length=120)
    templateid = models.PositiveIntegerField()
    tipo = models.PositiveIntegerField()
    ip = models.GenericIPAddressField()
    dns = models.CharField(max_length=120, default="")
    host_id = models.PositiveIntegerField()
    # Relacionamento 1 pra N com Perfil
    perfil = models.ForeignKey(Perfil, on_delete=models.CASCADE)

    def __str__(self):
        return self.host_name

文件 urls.py

from django.conf.urls import url
from . import views
from django.conf.urls.static import static
from django.conf import settings
from .views import HostDetail, HostList

urlpatterns = [

    # Rota para index perfis
    url(r'^$', views.index, name='index'),
    url(r'^host/(?P<pk>d+)$', HostDetail.as_view(), name='HostDetail'),
    url(r'^host/$', HostList.as_view(), name='HostList'),

谢谢

推荐答案

使用与用于 ListView 相同的方法.使用 self.request.user 过滤查询集.

Use the same approach as you use for the ListView. Filter the queryset using self.request.user.

您可能还想在两个视图上使用 LoginRequiredMixin，以便只有登录用户才能访问这些视图.

You may also want to use LoginRequiredMixin on both views, so that only logged-in users can access the views.

from django.contrib.auth.mixins import LoginRequiredMixin

class HostDetail(LoginRequiredMixin, DetailView):
    model = Host

    def get_queryset(self):
        qs = super(HostList, self).get_queryset().filter(perfil=self.request.user.perfil_id)
        return qs

    ...

这篇关于如何使用 detailview 类限制对对象的访问的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！