Django how to restrict staff-user to edit or delete others staff-user post from django admin panel

Question

Right now my all django staff-user can edit or delete others staff-user post. I want they only can able to be edit or delete their own post from django admin panel. How to restrict them to edit or delete others user post? here is my code:

views.py:

 class BlogPublishView(PermissionRequiredMixin,CreateView):
      raise_exception = True
      permission_required = "blog.add_post"
      model = Post
      form_class = BlogPost
      template_name = "blog_post.html"
      #fields = ['title','author','body']
      
      
                   
class BlogUpdateView(PermissionRequiredMixin,UpdateView):
      raise_exception = True
      permission_required = "blog.change_post"
      model = Post
      template_name = "blog_update_post.html"
      form_class = BlogPost
     
     
 class BlogDeleteView(PermissionRequiredMixin,DeleteView):
      raise_exception = True
      permission_required = "blog.delete_post"
      model = Post
      template_name = "delete_blog_post.html"
      success_url = reverse_lazy('blog')

urls.py

path('blog-post', BlogPublishView.as_view(), name='blog-post'),
path('blog-update/<slug:slug>', BlogUpdateView.as_view(), name='blog-update'),
path('blog-delete/<slug:slug>', BlogDeleteView.as_view(), name='blog-delete'),

html

 {% if user.is_authenticated %}{% if user.id == post.author.id %} <a href="{% url 'blog-update' post.slug %}"><b>(Edit Blog)</b></a>&nbsp;<a href="{% url 'blog-delete' post.slug %}"><b>(Delete Blog)</b> </a>{% endif %}{% endif %}

Let you explain little bit more if you still now don't understand my problem. Assume I have three user in my djano admin panel "A", "B" and "C". User "A" is Admin and user "B" and "C" is staff-user. User "B" and "C" have permission only edit, delete and publish post from admin panel. The problem is user "A" can edit and delete user "B" post and also user "B" can edit or delete user "A" post. I want to restrict both of staff-user to edit, delete and view each others post from django admin panel. They can only be view, edit and delete their own post from django admin panel.

See realpython.com/manage-users-in-django-admin

Abdul Aziz Barkat
– Abdul Aziz Barkat

2021-05-12 14:40:52 +00:00
Commented May 12, 2021 at 14:40 — Abdul Aziz Barkat
– Abdul Aziz Barkat, Commented May 12, 2021 at 14:40

boyenec · Accepted Answer · 2021-05-12 19:41:10Z

After lot of research I find the solution. I solved the problems After using "get_queryset" method in my django admin model. here is the code:

def get_queryset(self, request):
        qs = super().get_queryset(request)
        if request.user.is_superuser:
            return qs
        return qs.filter(author=request.user)

You can read more details here. Before apply get_queryset user "A" and user "B" can view, edit and delete each others post from django admin panel. See the picture where user "A" logged in django admin panel and he aslo can edit user "B" and others member post.

after apply get_queryset method I restricted user "A" to view, edit and delete post of user "B". Now user "A" can only view, edit and delete his own post. see the picture

If you apply this get_queryset method in your admin model then except admin nobody can view, edit and delete others user post.

Collectives™ on Stack Overflow

Django how to restrict staff-user to edit or delete others staff-user post from django admin panel

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related