Question

When I was using function-based views, I used to do this a lot:

def my_view(request, username):
  user = get_object_or_404(User, username = username)
  if user != request.user:
    return HttpRequestForbidden()

This coded made sure that only user john could access pages like /users/john/edit/.

How can I do the same using class-based views?

Answer 1

My question seems to be a duplicate of Example of Django Class-Based DeleteView

This is how to do it:

def get_object(self, queryset=None):
    """ Hook to ensure object is owned by request.user. """
    obj = super(MyDeleteView, self).get_object()
    if not obj.owner == self.request.user:
        raise Http404
    return obj