An authenticated user is a visitor whose identity has been verified through a logged-in account. In a Django application, the current user is available as request.user and can control which actions and records are visible. section 7.2.5
Use authentication to make user-specific application decisions:
- Show a New Ad link only when request.user.is_authenticated is true. section 7.2.5
- Show Edit links only when an advertisement owner matches request.user. section 7.2.5
- Restrict edited records by passing owner=request.user when retrieving them. section 7.2.5
Listing 7.12 View for displaying and submitting SeekingAdForm
# RiffMates/content/views.py
...
from django.shortcuts import render, redirect, get_object_or_404
...
@login_required
def seeking_ad(request, ad_id=0): #1
if request.method == 'GET':
if ad_id == 0: #2
form = SeekingAdForm()
else:
ad = get_object_or_404(SeekingAd, id=ad_id,
owner=request.user) #3
form = SeekingAdForm(instance=ad) #4
else: # POST
if ad_id == 0:
form = SeekingAdForm(request.POST) #5
else:
ad = get_object_or_404(SeekingAd, id=ad_id,
owner=request.user) #6
form = SeekingAdForm(request.POST,
instance=ad) #7
...
Trace how request.user participates in creating and editing advertisements, including ownership checks and form population. section 7.2.5
