mardi 14 juin 2016

Preventing the user to access the data of another user by typing the slug in the url


If user 1 creat this ticket : mywebsite/manager/tickets/ticket-from-user-1/

And user 2 create that : mywebsite/manager/tickets/ticket-from-user-2/

How can I prevent user 1 to access the ticket from user 2 or other users by typing it in the url?

views.py

class TicketDisplay(LoginRequiredMixin, DetailView):
    model = Ticket
    template_name = 'ticket_detail.html'
    context_object_name = 'ticket'
    slug_field = 'slug'

    def get_context_data(self, **kwargs):
        context = super(TicketDisplay, self).get_context_data(**kwargs)
        context['form_add_comment'] = CommentForm()
        return context

url.py

url(r'^manager/tickets/(?P<slug>[-w]+)/$',views.TicketDetail.as_view(), name='ticket_detail')

Aucun commentaire:

Enregistrer un commentaire