[Django]-How to restrict website users from seeing other user profiles?

by

4👍

The LoginRequiredMixin will ensure that you can only see the page if you are logged in, but that does not mean you have to be that user.

However if you can only see your own profile, it does not make much sense to add a primary key in the url anyway, you can just define the url as:

url(r'^user_detail/$', views.UserDetailView.as_view(), name='user_detail'),

In the view you then return the logged in user for the .get_object() method [Django-doc]:

class UserDetailView(LoginRequiredMixin,DetailView):
    context_object_name='user_detail'
    model=models.User
    template_name='basicapp/user_detail.html'

    def get_object(self, *args, **kwargs):
        return self.request.user

Or you can restrict users by filtering the queryset:

path('^user_detail/<int:pk>/', views.UserDetailView.as_view(), name='user_detail'),
class UserDetailView(LoginRequiredMixin,DetailView):
    context_object_name='user_detail'
    model=models.User
    template_name='basicapp/user_detail.html'

    def get_queryset(self, *args, **kwargs):
        qs = super().get_queryset(*args, **kwargs)
        if not self.request.user.is_superuser:
            qs = qs.filter(pk=self.request.user.pk)
        return qs
👤willeM_ Van Onsem

Leave a comment