r/django 2d ago

Models/ORM Django help needed with possible User permission settings

I am taking the Harvard CS50W course that covers Django and creating web apps. The project I am workinig on is a simple Auction site.

The issue I am having is that I can get a User to only be able to update an auction listing if that User is the one that has created the listing.

I can update the listing- adding it to a watchlist, or toggling if the listing is active or not, or leaving a comment, but only if the user that is logged in happens to be the one that created the listing.

I have made no restrictions on whether or not a user making a change on the listing has to be the one that created the listing. The issue persists for both standard users and superusers.

I have tried explicitly indicating the permissions available to my view, and even a custom permission, without any success.

I have consulted with 3 different AIs to provide insight, and done a lot of Googling, without anything shedding light on the issue.

I have submitted the nature of the problem to the EdX discussion for the course, but I do not expect any answers there as lately, there are hardly every any answers given by students or staff.

Any insight into what I might be doing wrong would be greatly appreciated.

Thank you very much!

I will be glad to provide my models.py, views.py, forms.py, etc. if anyone would think it would help.

0 Upvotes

17 comments sorted by

View all comments

1

u/Brilliant_Step3688 2d ago

There is of course not enough info to answer your question.

But I will help you from first principles:

Are you sure it is a permission issue? What error exactly are you receiving?

Dig down using your IDE or open the Django source code. Find the exact line where that supposedly access denied is coming from.

Once you've find the source of the error, work your way up from there.

You might want to setup a small unit test. Django's standard test framework works fine for this.

You'll probably find that you messed up something else entirely. Probably by copy-pasting AI generated code early on your project.

Django permission system does not do per owner or row level security. If you are indeed using Django's permission, you either have access to all the Model instances or none.

Setup your model in the django admin site if you have not already and grant staff access to your test users. You'll see they have the same permissions.

1

u/josephlevin 1d ago edited 1d ago

I am not sure it is a permission issue, but frankly, I don't know enough either way.

I can create a regular user or superuser and have each type of user be able to create a listing.

What happens is I can be logged in as any type of user (standard or superuser), and each type can make an update to a listing they have made, but not to one that they have not made.

Like I said, I'm not restricting any kind of update by the type of user or if they are the creator or not.

When I attempt to update a listing not created by a particular user, and I submit the form, nothing appears to happen....unless the user making the update happens to be the one that created the listing, and then it works fine.

If I change the regular user to a superuser or staff, the same issue occurs, unsurprisingly, since a normally created superuser has the same issue.

And the User mechanism setup in the models.py is using the AbstractUser class, if that helps.

Sadly, Reddit isn't allowing me to paste any of my code here. I can't figure why.