Django 2 by Example

Restricting access to class-based views

We are going to restrict access to the views so that only users with the appropriate permissions can add, change, or delete Course objects. We are going to use the following two mixins provided by django.contrib.auth to limit access to views:

• LoginRequiredMixin: Replicates the login_required decorator's functionality.
• PermissionRequiredMixin: Grants access to the view to users that have a specific permission. Remember that superusers automatically have all permissions.

Edit the views.py file of the courses application and add the following import:

from django.contrib.auth.mixins import LoginRequiredMixin, \                                       PermissionRequiredMixin

Make OwnerCourseMixin inherit LoginRequiredMixin like this:

class OwnerCourseMixin(OwnerMixin, ...