title: Restrict `UpdateView` dataset for authenticated user in Class Based Views
body: <p>I have a Django project where I extended the User to have a Profile using a OneToOneField. I'm using CBV UpdateView which allows users to update their profile. The URL they visit for this is ../profile/<strong><em>user</em></strong>/update. The issue I have is that if a user types in another users name they can edit the other persons profile. How can I restrict the UpdateView so the authenticated user can only update their profile. I was trying to do something to make sure user.get_username == profile.user but having no luck.</p>
  
  <p>Models.py</p>
  
  <pre><code>from django.db import models
  from django.contrib.auth.models import User
  from django.db.models.signals import post_save
  from django.core.urlresolvers import reverse
  
  class Profile(models.Model):
      # This field is required.
      SYSTEM_CHOICES = (
          ('Xbox', 'Xbox'),
          ('PS4', 'PS4'),
      )
      system = models.CharField(max_length=5,
                                      choices=SYSTEM_CHOICES,
                                        default='Xbox')
      user = models.OneToOneField(User)
      slug = models.SlugField(max_length=50)
      gamertag = models.CharField("Gamertag", max_length=50, blank=True)
      f_name = models.CharField("First Name", max_length=50, blank=True)
      l_name = models.CharField("Last Name", max_length=50, blank=True)
      twitter = models.CharField("Twitter Handle", max_length=50, blank=True)
      video = models.CharField("YouTube URL", max_length=50, default='JhBAc6DYiys', help_text="Only the extension!", blank=True)
      mugshot = models.ImageField(upload_to='mugshot', blank=True)
  
      def __unicode__(self):
              return u'%s' % (self.user)
  
      def create_user_profile(sender, instance, created, **kwargs):
          if created:
              Profile.objects.create(user=instance, slug=instance)
  
      post_save.connect(create_user_profile, sender=User)
  
      def get_absolute_url(self):
          return reverse('profile-detail', kwargs={'slug': self.slug})
  </code></pre>
  
  <p>Views.py</p>
  
  <pre><code>from django.shortcuts import render
  from django.views.generic import DetailView
  from django.views.generic.edit import UpdateView
  from django.views.generic.list import ListView
  
  from profiles.models import Profile
  
  
  class ProfileDetail(DetailView):
  
      model = Profile
  
      def get_context_data(self, **kwargs):
          context = super(ProfileDetail, self).get_context_data(**kwargs)
          return context
  
  class ProfileList(ListView):
      model = Profile
      queryset = Profile.objects.all()[:3]
  
      def get_context_data(self, **kwargs):
          context = super(ProfileList, self).get_context_data(**kwargs)
          return context
  
  class ProfileUpdate(UpdateView):
      model = Profile
      fields = ['gamertag', 'system', 'f_name', 'l_name', 'twitter', 'video', 'mugshot']
      template_name_suffix = '_update'
  
      def get_context_data(self, **kwargs):
          context = super(ProfileUpdate, self).get_context_data(**kwargs)
          return context
  </code></pre>
  
  <p>Admin.py</p>
  
  <pre><code>from django.contrib import admin
  from models import Profile
  
  class ProfileAdmin(admin.ModelAdmin):
      prepopulated_fields = {'slug': ('user',), }
  
  admin.site.register(Profile, ProfileAdmin)
  </code></pre>
  
  <p>Urls.py for Profiles app</p>
  
  <pre><code>from django.conf.urls import patterns, url
  from django.contrib.auth.decorators import login_required
  from profiles.views import ProfileDetail, ProfileUpdate
  
  urlpatterns = patterns('',
      url(r'^(?P&lt;slug&gt;[-_\w]+)/$', login_required(ProfileDetail.as_view()), name='profile-detail'),
      url(r'^(?P&lt;slug&gt;[-_\w]+)/update/$', login_required(ProfileUpdate.as_view()), name='profile-update'),
  )
  </code></pre>
  
  <p>Profile_update.html</p>
  
  <pre><code>{% extends "base.html" %} {% load bootstrap %}
  
  {% block content %}
  
  {% if user.is_authenticated %}
  
    &lt;h1&gt;Update your profile&lt;/h1&gt;
  
    &lt;div class="col-sm-4 col-sm-offset-4"&gt;
      &lt;div class="alert alert-info alert-dismissible" role="alert"&gt;
        &lt;button type="button" class="close" data-dismiss="alert" aria-label="Close"&gt;
          &lt;span aria-hidden="true"&gt;&amp;times;&lt;/span&gt;
        &lt;/button&gt;
        &lt;strong&gt;Heads up!&lt;/strong&gt; Other users can find you easier if you have a completed profile.
      &lt;/div&gt;
      &lt;form enctype="multipart/form-data" method="post" action=""&gt;{% csrf_token %}
        {{ form|bootstrap }}
        &lt;input class="btn btn-default" type="submit" value="Update" /&gt;
      &lt;/form&gt;
    &lt;/div&gt;
  
  
  {% else %}
  &lt;h1&gt;You can't update someone elses profile.&lt;/h1&gt;
  {% endif %}
  
  {% endblock %}
  </code></pre>