title: Django Rest Framework owner permissions
body: <p>I use Django Rest Framework and in my one of my viewsets class I have <strong>partial_update</strong> method (PATCH) for update my user profile. I want to create a permission for one user can update <em><strong>only his profile</strong></em>.</p>
  <pre><code>class ProfileViewSet(viewsets.ModelViewSet):
  &quot;&quot;&quot;
  API endpoint that allows profiles to be viewed, added,
  deleted or edited
  &quot;&quot;&quot;
  queryset = Profile.objects.all()
  # serializer_class = ProfileSerializer
  permission_classes = (IsAuthenticated,)
  http_method_names = ['get', 'patch']
  
  def get_queryset(self):
      user = self.request.user
      return self.queryset.filter(user=user)
  
  def get_serializer_class(self):
      if self.action == 'list':
          return ListingMyProfileSerializer
      if self.action == 'retrieve':
          return ListingMyProfileSerializer
      if self.action == 'update':
          return ProfileSerializer
      return ProfileSerializer
  
  def get_permissions(self):
      # Your logic should be all here
      if self.request.method == 'GET':
          self.permission_classes = (IsAuthenticated,)
      if self.request.method == 'PATCH':
          self.permission_classes = (IsAuthenticated, IsOwnerOrReject)
      return super(ProfileViewSet, self).get_permissions()
  
  def partial_update(self, request, pk=None):
      ...
      ...
  </code></pre>
  <p>Now one user can update his profile and any other profile.
  I tried to create a permission class: <strong>IsOwnerOrReject</strong> but I don't know exactly what I must to do.</p>