[Fixed]-Django Permissions: How to make extended User only to update and view profile?

because UserProfile != User, :

class UserPermissions(permissions.BasePermission):

    def has_object_permission(self, request, view, obj):
        # obj is UserProfile instance not User instance.
        # so, this method will always return False
        return obj == request.user

others code contains UserProfile are wrong too.
about extend User you can follow the document:
https://docs.djangoproject.com/en/1.9/topics/auth/customizing/#extending-user
https://docs.djangoproject.com/en/1.9/topics/auth/customizing/#auth-custom-user