Cfrgtkky

I would like to update a instance of a model only if the request author is same than instance author.

I guess can do it in the update method:

def update(self, request, *args, **kwargs):

    if request.user == self.get_object().user

        do_things()

How can I do it? Is it obligatory to write an update en every ModelViewSet or ListAPIView? or is there a method to write a custom permission to accomplish this.

You can implement a custom permission. The following example is from the docs, modified to fit your use case:

from rest_framework import permissions



class IsOwnerOrReadOnly(permissions.BasePermission):

    """

    Object-level permission to only allow owners of an object to edit it.

    Assumes the model instance has an `user` attribute.

    """



    def has_object_permission(self, request, view, obj):

        # Read permissions are allowed to any request,

        # so we'll always allow GET, HEAD or OPTIONS requests.

        if request.method in permissions.SAFE_METHODS:

            return True



        # Instance must have an attribute named `user`.

        return obj.user == request.user