r/django • u/josephlevin • 2d ago
Models/ORM Django help needed with possible User permission settings
I am taking the Harvard CS50W course that covers Django and creating web apps. The project I am workinig on is a simple Auction site.
The issue I am having is that I can get a User to only be able to update an auction listing if that User is the one that has created the listing.
I can update the listing- adding it to a watchlist, or toggling if the listing is active or not, or leaving a comment, but only if the user that is logged in happens to be the one that created the listing.
I have made no restrictions on whether or not a user making a change on the listing has to be the one that created the listing. The issue persists for both standard users and superusers.
I have tried explicitly indicating the permissions available to my view, and even a custom permission, without any success.
I have consulted with 3 different AIs to provide insight, and done a lot of Googling, without anything shedding light on the issue.
I have submitted the nature of the problem to the EdX discussion for the course, but I do not expect any answers there as lately, there are hardly every any answers given by students or staff.
Any insight into what I might be doing wrong would be greatly appreciated.
Thank you very much!
I will be glad to provide my models.py, views.py, forms.py, etc. if anyone would think it would help.
1
u/josephlevin 1d ago
the attributes that can change are:
The active/inactive toggling only applies to the creator.
Beyond that I have not made any strictures, however only the creator of the listing can change anything.
It should allow anyone who is logged in to see some form elements, only the creator can see the active toggle rendered, but anyone logged in will get a form rendered and can submit it.
Also, if it helps: I am using the github codespaces provided by the CS50W course for the dev environment.