We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
When editing an application user can select capabilities not allowed by his groups


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `apps/dot_ext/views/application.py`
Content:
```
1 from django.core.urlresolvers import reverse_lazy
2 from django.forms.models import modelform_factory
3 from django.views.generic import CreateView, DetailView, DeleteView, ListView, UpdateView
4 
5 from braces.views import LoginRequiredMixin
6 
7 from oauth2_provider.models import get_application_model
8 
9 
10 class ApplicationOwnerIsUserMixin(LoginRequiredMixin):
11     """
12     This mixin is used to provide an Application queryset filtered by the current request.user.
13     """
14     fields = '__all__'
15 
16     def get_queryset(self):
17         return get_application_model().objects.filter(user=self.request.user)
18 
19 
20 class ApplicationRegistration(LoginRequiredMixin, CreateView):
21     """
22     View used to register a new Application for the request.user
23     """
24     template_name = "application_registration_form.html"
25 
26     def get_form_class(self):
27         """
28         Returns the form class for the application model
29         """
30         
31         mff = modelform_factory(
32             get_application_model(),
33             fields=('name', 'client_id', 'client_secret', 'client_type',
34                     'authorization_grant_type', 'scope', 'redirect_uris', )
35         )
36         return mff
37     
38     
39 
40     def form_valid(self, form):
41         form.instance.user = self.request.user
42         return super(ApplicationRegistration, self).form_valid(form)
43 
44 
45 class ApplicationDetail(ApplicationOwnerIsUserMixin, DetailView):
46     """
47     Detail view for an application instance owned by the request.user
48     """
49     context_object_name = 'application'
50     template_name = "application_detail.html"
51 
52 
53 class ApplicationList(ApplicationOwnerIsUserMixin, ListView):
54     """
55     List view for all the applications owned by the request.user
56     """
57     context_object_name = 'applications'
58     template_name = "application_list.html"
59 
60 
61 class ApplicationDelete(ApplicationOwnerIsUserMixin, DeleteView):
62     """
63     View used to delete an application owned by the request.user
64     """
65     context_object_name = 'application'
66     success_url = reverse_lazy('dote_list')
67     template_name = "application_confirm_delete.html"
68 
69 
70 class ApplicationUpdate(ApplicationOwnerIsUserMixin, UpdateView):
71     """
72     View used to update an application owned by the request.user
73     """
74     context_object_name = 'application'
75     template_name = "application_form.html"
76
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/apps/dot_ext/views/application.py b/apps/dot_ext/views/application.py
--- a/apps/dot_ext/views/application.py
+++ b/apps/dot_ext/views/application.py
@@ -6,6 +6,8 @@
 
 from oauth2_provider.models import get_application_model
 
+from ..forms import CustomRegisterApplicationForm
+
 
 class ApplicationOwnerIsUserMixin(LoginRequiredMixin):
     """
@@ -27,15 +29,15 @@
         """
         Returns the form class for the application model
         """
-        
+
         mff = modelform_factory(
             get_application_model(),
             fields=('name', 'client_id', 'client_secret', 'client_type',
                     'authorization_grant_type', 'scope', 'redirect_uris', )
         )
         return mff
-    
-    
+
+
 
     def form_valid(self, form):
         form.instance.user = self.request.user
@@ -73,3 +75,15 @@
     """
     context_object_name = 'application'
     template_name = "application_form.html"
+
+    fields = None
+    form_class = CustomRegisterApplicationForm
+
+    def get_form_kwargs(self):
+        """
+        Add `user` to kwargs because it is required by the constructor of
+        CustomRegisterApplicationForm class.
+        """
+        kwargs = super(ApplicationUpdate, self).get_form_kwargs()
+        kwargs['user'] = self.request.user
+        return kwargs

{"golden_diff": "diff --git a/apps/dot_ext/views/application.py b/apps/dot_ext/views/application.py\n--- a/apps/dot_ext/views/application.py\n+++ b/apps/dot_ext/views/application.py\n@@ -6,6 +6,8 @@\n \n from oauth2_provider.models import get_application_model\n \n+from ..forms import CustomRegisterApplicationForm\n+\n \n class ApplicationOwnerIsUserMixin(LoginRequiredMixin):\n     \"\"\"\n@@ -27,15 +29,15 @@\n         \"\"\"\n         Returns the form class for the application model\n         \"\"\"\n-        \n+\n         mff = modelform_factory(\n             get_application_model(),\n             fields=('name', 'client_id', 'client_secret', 'client_type',\n                     'authorization_grant_type', 'scope', 'redirect_uris', )\n         )\n         return mff\n-    \n-    \n+\n+\n \n     def form_valid(self, form):\n         form.instance.user = self.request.user\n@@ -73,3 +75,15 @@\n     \"\"\"\n     context_object_name = 'application'\n     template_name = \"application_form.html\"\n+\n+    fields = None\n+    form_class = CustomRegisterApplicationForm\n+\n+    def get_form_kwargs(self):\n+        \"\"\"\n+        Add `user` to kwargs because it is required by the constructor of\n+        CustomRegisterApplicationForm class.\n+        \"\"\"\n+        kwargs = super(ApplicationUpdate, self).get_form_kwargs()\n+        kwargs['user'] = self.request.user\n+        return kwargs\n", "issue": "When editing an application user can select capabilities not allowed by his groups\n\n", "before_files": [{"content": "from django.core.urlresolvers import reverse_lazy\nfrom django.forms.models import modelform_factory\nfrom django.views.generic import CreateView, DetailView, DeleteView, ListView, UpdateView\n\nfrom braces.views import LoginRequiredMixin\n\nfrom oauth2_provider.models import get_application_model\n\n\nclass ApplicationOwnerIsUserMixin(LoginRequiredMixin):\n    \"\"\"\n    This mixin is used to provide an Application queryset filtered by the current request.user.\n    \"\"\"\n    fields = '__all__'\n\n    def get_queryset(self):\n        return get_application_model().objects.filter(user=self.request.user)\n\n\nclass ApplicationRegistration(LoginRequiredMixin, CreateView):\n    \"\"\"\n    View used to register a new Application for the request.user\n    \"\"\"\n    template_name = \"application_registration_form.html\"\n\n    def get_form_class(self):\n        \"\"\"\n        Returns the form class for the application model\n        \"\"\"\n        \n        mff = modelform_factory(\n            get_application_model(),\n            fields=('name', 'client_id', 'client_secret', 'client_type',\n                    'authorization_grant_type', 'scope', 'redirect_uris', )\n        )\n        return mff\n    \n    \n\n    def form_valid(self, form):\n        form.instance.user = self.request.user\n        return super(ApplicationRegistration, self).form_valid(form)\n\n\nclass ApplicationDetail(ApplicationOwnerIsUserMixin, DetailView):\n    \"\"\"\n    Detail view for an application instance owned by the request.user\n    \"\"\"\n    context_object_name = 'application'\n    template_name = \"application_detail.html\"\n\n\nclass ApplicationList(ApplicationOwnerIsUserMixin, ListView):\n    \"\"\"\n    List view for all the applications owned by the request.user\n    \"\"\"\n    context_object_name = 'applications'\n    template_name = \"application_list.html\"\n\n\nclass ApplicationDelete(ApplicationOwnerIsUserMixin, DeleteView):\n    \"\"\"\n    View used to delete an application owned by the request.user\n    \"\"\"\n    context_object_name = 'application'\n    success_url = reverse_lazy('dote_list')\n    template_name = \"application_confirm_delete.html\"\n\n\nclass ApplicationUpdate(ApplicationOwnerIsUserMixin, UpdateView):\n    \"\"\"\n    View used to update an application owned by the request.user\n    \"\"\"\n    context_object_name = 'application'\n    template_name = \"application_form.html\"\n", "path": "apps/dot_ext/views/application.py"}], "after_files": [{"content": "from django.core.urlresolvers import reverse_lazy\nfrom django.forms.models import modelform_factory\nfrom django.views.generic import CreateView, DetailView, DeleteView, ListView, UpdateView\n\nfrom braces.views import LoginRequiredMixin\n\nfrom oauth2_provider.models import get_application_model\n\nfrom ..forms import CustomRegisterApplicationForm\n\n\nclass ApplicationOwnerIsUserMixin(LoginRequiredMixin):\n    \"\"\"\n    This mixin is used to provide an Application queryset filtered by the current request.user.\n    \"\"\"\n    fields = '__all__'\n\n    def get_queryset(self):\n        return get_application_model().objects.filter(user=self.request.user)\n\n\nclass ApplicationRegistration(LoginRequiredMixin, CreateView):\n    \"\"\"\n    View used to register a new Application for the request.user\n    \"\"\"\n    template_name = \"application_registration_form.html\"\n\n    def get_form_class(self):\n        \"\"\"\n        Returns the form class for the application model\n        \"\"\"\n\n        mff = modelform_factory(\n            get_application_model(),\n            fields=('name', 'client_id', 'client_secret', 'client_type',\n                    'authorization_grant_type', 'scope', 'redirect_uris', )\n        )\n        return mff\n\n\n\n    def form_valid(self, form):\n        form.instance.user = self.request.user\n        return super(ApplicationRegistration, self).form_valid(form)\n\n\nclass ApplicationDetail(ApplicationOwnerIsUserMixin, DetailView):\n    \"\"\"\n    Detail view for an application instance owned by the request.user\n    \"\"\"\n    context_object_name = 'application'\n    template_name = \"application_detail.html\"\n\n\nclass ApplicationList(ApplicationOwnerIsUserMixin, ListView):\n    \"\"\"\n    List view for all the applications owned by the request.user\n    \"\"\"\n    context_object_name = 'applications'\n    template_name = \"application_list.html\"\n\n\nclass ApplicationDelete(ApplicationOwnerIsUserMixin, DeleteView):\n    \"\"\"\n    View used to delete an application owned by the request.user\n    \"\"\"\n    context_object_name = 'application'\n    success_url = reverse_lazy('dote_list')\n    template_name = \"application_confirm_delete.html\"\n\n\nclass ApplicationUpdate(ApplicationOwnerIsUserMixin, UpdateView):\n    \"\"\"\n    View used to update an application owned by the request.user\n    \"\"\"\n    context_object_name = 'application'\n    template_name = \"application_form.html\"\n\n    fields = None\n    form_class = CustomRegisterApplicationForm\n\n    def get_form_kwargs(self):\n        \"\"\"\n        Add `user` to kwargs because it is required by the constructor of\n        CustomRegisterApplicationForm class.\n        \"\"\"\n        kwargs = super(ApplicationUpdate, self).get_form_kwargs()\n        kwargs['user'] = self.request.user\n        return kwargs\n", "path": "apps/dot_ext/views/application.py"}]}