def has_object_permission(self, request, view, obj):
user = request.user<EOL>if not user.is_authenticated:<EOL><INDENT>return False<EOL><DEDENT>elif user.is_staff or user.is_superuser:<EOL><INDENT>return True<EOL><DEDENT>return user == obj.user<EOL>
Allow staff or superusers, and the owner of the object itself.