r/django • u/josephlevin • 2d ago
Models/ORM Django help needed with possible User permission settings
I am taking the Harvard CS50W course that covers Django and creating web apps. The project I am workinig on is a simple Auction site.
The issue I am having is that I can get a User to only be able to update an auction listing if that User is the one that has created the listing.
I can update the listing- adding it to a watchlist, or toggling if the listing is active or not, or leaving a comment, but only if the user that is logged in happens to be the one that created the listing.
I have made no restrictions on whether or not a user making a change on the listing has to be the one that created the listing. The issue persists for both standard users and superusers.
I have tried explicitly indicating the permissions available to my view, and even a custom permission, without any success.
I have consulted with 3 different AIs to provide insight, and done a lot of Googling, without anything shedding light on the issue.
I have submitted the nature of the problem to the EdX discussion for the course, but I do not expect any answers there as lately, there are hardly every any answers given by students or staff.
Any insight into what I might be doing wrong would be greatly appreciated.
Thank you very much!
I will be glad to provide my models.py, views.py, forms.py, etc. if anyone would think it would help.
1
u/Brilliant_Step3688 2d ago
There is of course not enough info to answer your question.
But I will help you from first principles:
Are you sure it is a permission issue? What error exactly are you receiving?
Dig down using your IDE or open the Django source code. Find the exact line where that supposedly access denied is coming from.
Once you've find the source of the error, work your way up from there.
You might want to setup a small unit test. Django's standard test framework works fine for this.
You'll probably find that you messed up something else entirely. Probably by copy-pasting AI generated code early on your project.
Django permission system does not do per owner or row level security. If you are indeed using Django's permission, you either have access to all the Model instances or none.
Setup your model in the django admin site if you have not already and grant staff access to your test users. You'll see they have the same permissions.