title: Django Update/Delete view. Handling user permissions
body: <p>models.py</p>
  
  <pre><code>class Punch(models.Model):
  ro_number = models.IntegerField()
  flag = models.FloatField(max_length=10)
  actual = models.FloatField(max_length=10)
  description = models.CharField(max_length=100, blank=True)
  user = models.ForeignKey(User)
  created_on = models.DateTimeField(auto_now_add=True)
  
  def efficiency(self):
      return '%.2f' % (float(self.flag)/float(self.actual)*100)
  
  def __str__(self):
      return str(self.ro_number)
  </code></pre>
  
  <p>urls.py</p>
  
  <pre><code>url(r'^flags/update/(?P&lt;pk&gt;[0-9]+)/$', views.PunchEdit.as_view(), name='update_flags'),
  </code></pre>
  
  <p>view.py</p>
  
  <pre><code>class PunchEdit(views.LoginRequiredMixin,
              UpdateView,):
  model = Punch
  fields = ['ro_number', 'flag', 'actual', 'description']
  template_name = 'free/home.html'
  
  def get_success_url(self):
      pass
  </code></pre>
  
  <p>I am trying to figure out how to allow users to only edit the punch objects they created. Any time a Punch object is created it saves which user created the punch with a foreign key relation. (Accomplished in views not shown)</p>
  
  <p>Right now if you were to type in something like <strong>mywebsite.com/punch/update/(pk)/</strong> a user could write in the pk of any punch object and update its info. </p>
  
  <p>So my question is.. How, when using class based generic update/delete views, can you prevent a user from touching a punch object they did not create themselves.</p>