title: Owner of the data and superuser should only be able to update the data using CBV
body: <p>This is my UpdateView. As i have just started django. I am a newbie</p>
  
  <p><strong>views.py</strong></p>
  
  <pre><code>@method_decorator(login_required, name='dispatch')
  class ProductUpdateView(UpdateView):
      fields = ('product_name', 'product_cost')
      model = Product
      def form_valid(self, form):
      product = get_object_or_404(Product, pk=self.object.pk)
      user = self.request.user
      if user == product.created_by or user.is_superuser:
          pass
      else:
          raise Http404()    #I tried this but it didn't work
  </code></pre>
  
  <p>I have created a superuser and a user. Superuser should be able to update all the product of both his and everyone else's but user should be only be able to update his product only.</p>
  
  <p><strong>urls.py</strong></p>
  
  <pre><code>urlpatterns = [
      url(r'^product/(?P&lt;pk&gt;\d+)/update/$',
              login_required(ProductUpdateView.as_view()), name='product_update'),
  ]
  </code></pre>
  
  <p>I have a created a product using superuser, which has pk = 1. When i login with some user (Which not superuser) and visit the above url. This user is able to update superuser's product.</p>
  
  <p><strong>models.py</strong></p>
  
  <pre><code>class Product(models.Model):
      product_name
      product_cost # This two fields and created_by
      created_by = models.ForeignKey(
      User, on_delete=models.CASCADE, related_name="Product", null=True)
  </code></pre>
  
  <p>Is there any way that own of the data can update that data and if user tries to access someone else's data it should Http404.</p>