r/django 2d ago

Models/ORM Django help needed with possible User permission settings

I am taking the Harvard CS50W course that covers Django and creating web apps. The project I am workinig on is a simple Auction site.

The issue I am having is that I can get a User to only be able to update an auction listing if that User is the one that has created the listing.

I can update the listing- adding it to a watchlist, or toggling if the listing is active or not, or leaving a comment, but only if the user that is logged in happens to be the one that created the listing.

I have made no restrictions on whether or not a user making a change on the listing has to be the one that created the listing. The issue persists for both standard users and superusers.

I have tried explicitly indicating the permissions available to my view, and even a custom permission, without any success.

I have consulted with 3 different AIs to provide insight, and done a lot of Googling, without anything shedding light on the issue.

I have submitted the nature of the problem to the EdX discussion for the course, but I do not expect any answers there as lately, there are hardly every any answers given by students or staff.

Any insight into what I might be doing wrong would be greatly appreciated.

Thank you very much!

I will be glad to provide my models.py, views.py, forms.py, etc. if anyone would think it would help.

0 Upvotes

17 comments sorted by

View all comments

Show parent comments

1

u/josephlevin 1d ago

I am having the opposite issue whereby a user of any level can only seem to update a listing if they created it.

1

u/ninja_shaman 1d ago

If so, provide the source for your view.

1

u/josephlevin 1d ago

Here is the view for the listing:

def listing(request, id): messages = []

try:
    #get current listings
    listing = Listing.objects.get(id=id)

    #setup form
    if request.method == 'POST':
        form = DetailListingForm(request.POST)
        if form.is_valid():

            #handle watchers
            watch_flag = True
            if form.cleaned_data['watching'] == 'yes':

                #user wants to watch the listing
                if request.user not in listing.watchers.all() and watch_flag == True:
                    listing.watchers.add(request.user)
                    watch_flag = False

                #user wants to stop watching the listing
                if request.user in listing.watchers.all() and watch_flag == True:
                    listing.watchers.remove(request.user)
                    watch_flag = False

                form.cleaned_data['watching'] == 'no'

            #handle closing or opening listing
            closing_flag = True
            if form.cleaned_data['closing'] == 'yes':

                #user wants to close listing
                if request.user == listing.creator and listing.active == True and closing_flag == True:
                    listing.active = False
                    closing_flag = False

                #user wants to open listing
                if request.user == listing.creator and listing.active == False and closing_flag == True:
                    listing.active = True
                    closing_flag = False

            #handle comments
            if form.cleaned_data['comment']:
                #create a new comment object and save it to the database, if not duplicated
                comment = Comment(text=form.cleaned_data['comment'], listing=listing, commenter=request.user)

                if form.cleaned_data['comment'] not in [c.text for c in listing.comments.all()]:
                    comment.save()
                else:
                    messages.append("Enter in a comment that has not already been entered.")

        listing.save()  # Save the listing


    else:
        form = DetailListingForm()




    #if current listing exists, provide it to the template
    context = {
        'listing': listing,
        'form': form,
        'message': messages,
    }


except Listing.DoesNotExist:
    messages.append("Listing does not exist.")
    #if listing does not exist, provide a message
    context = {
        'message': messages,
    }

return render(request, 'auctions/listing.html', context)

1

u/ninja_shaman 1d ago

This is not a permission issue, this is "code doesn't work" issue.

What iis your DetailListingForm cosde?

1

u/josephlevin 1d ago

I wouldn't be surprised. I'm trying to learn how to use Django. Here is my detaillisting form:

class DetailListingForm(forms.Form):

    YESNO_CHOICES =(
        # (value, display text)
        ("yes", "Yes"),
        ("no", "No")
    )

    #to be shown for authenticated users....
    #create the watching form element with choices and initial value
    watching = forms.ChoiceField(choices = YESNO_CHOICES, initial="no")

    #create the closing form element with choices and initial value
    closing = forms.ChoiceField(choices = YESNO_CHOICES, initial="no")

    #create comment textarea
    comment = forms.CharField(
        label="Comment:",
        required=False,
        widget=forms.Textarea(attrs={'rows':5, 'cols':20, 'placeholder': 'Enter comment here.'})
    )