python - Django - 如何防止访问其他用户的对象？

Question

假设我有这样的 URL users/{id}/objects 并且我被认证为 ID 等于 1 的用户。目前我可以访问 ID 等于 2 的用户的对象， 3 等等。有谁知道我该如何防止这种情况发生？

class UserObject(GenericAPIView):

    permission_classes = [UserPermission]
    def get(self, request, user_id):

            try:
                object = Object.objects.filter(user=user_id)
            except Object.DoesNotExist:
                return Response(status=status.HTTP_404_NOT_FOUND)
            serializer = ObjectSerializer(object, many=True)
            return Response(serializer.data)


class UserPermission(permissions.BasePermission):

    def has_permission(self, request, view):
        if request.user and request.user.is_authenticated():
            return True
        return False

我这样试过:

serializer_class = ObjectSerializer
permission_classes = [IsAuthenticated, ]

def get_queryset(self):
    return Object.objects.filter(owner=self.request.user)

def get(self, request, user_id):

        try:
            object = Object.objects.filter(user=user_id)
        except Object.DoesNotExist:
            return Response(status=status.HTTP_404_NOT_FOUND)
        serializer = ObjectSerializer(object, many=True)
        return Response(serializer.data)

Answer 1

如果您重载 View 的 get_queryset 以仅返回属于当前用户的对象，那么 Django 将自行处理适当的错误和响应。例如，

class MyView(GenericAPIView):

    serializer_class = serializers.MySerializer
    permission_classes = (IsAuthenticated,)

    def get_queryset(self):
        return MyModel.objects.filter(owner=self.request.user)

另见 http://www.django-rest-framework.org/api-guide/generic-views/#attributes