Django用户资料更新：如何仅修改字段时校验值唯一性？

Hey there, I see the frustrating issue you're stuck on—your current validation is popping up errors even when users are just saving their existing username/email, which makes total sense because you’re checking if any user has that value, including the one you’re trying to update. Let’s fix this so validation only triggers when:

• The username/email is actually being changed, OR
• The person making the update isn’t the owner of the profile

Step 1: Update Your Form Validation Logic #

First, we’ll rewrite the clean_email method and add a clean_username method to handle uniqueness checks correctly. We’ll use self.instance (the user being updated) to compare against existing values, and also pass in the current request user to distinguish between self-edits and admin/other-user edits.

Updated forms.py

class UpdateUserProfile(forms.ModelForm):
    first_name = forms.CharField(
        required=True, label='First Name', max_length=32,
    )
    last_name = forms.CharField(
        required=True, label='Last Name', max_length=32,
    )
    email = forms.EmailField(
        required=True, label='Email (You will login with this)', max_length=32,
    )
    username = forms.CharField(
        required=True, label='Display Name', max_length=32,
    )

    class Meta:
        model = User
        fields = ('username', 'email', 'first_name', 'last_name')

    # Add support to pass the current request user to the form
    def __init__(self, *args, **kwargs):
        self.request_user = kwargs.pop('request_user', None)
        super().__init__(*args, **kwargs)

    def clean_email(self):
        email = self.cleaned_data.get('email')
        current_user = self.instance

        # Case 1: If the updater isn't the profile owner, enforce full uniqueness
        if self.request_user != current_user:
            if User.objects.exclude(pk=current_user.pk).filter(email=email).exists():
                raise forms.ValidationError('This email address is already in use. Please supply a different email address.')
            return email
        
        # Case 2: If it's the owner, only check if they actually changed the email
        if email != current_user.email:
            if User.objects.exclude(pk=current_user.pk).filter(email=email).exists():
                raise forms.ValidationError('This email address is already in use. Please supply a different email address.')
        
        return email

    def clean_username(self):
        username = self.cleaned_data.get('username')
        current_user = self.instance

        # Replicate the same logic for username uniqueness
        if self.request_user != current_user:
            if User.objects.exclude(pk=current_user.pk).filter(username=username).exists():
                raise forms.ValidationError('This display name is already in use. Please choose a different one.')
            return username
        
        if username != current_user.username:
            if User.objects.exclude(pk=current_user.pk).filter(username=username).exists():
                raise forms.ValidationError('This display name is already in use. Please choose a different one.')
        
        return username

    def save(self, commit=True):
        user = super().save(commit=False)
        user.email = self.cleaned_data['email']
        user.username = self.cleaned_data['username']
        if commit:
            user.save()
        return user, user.username

Step 2: Adjust the View to Pass the Request User #

In your view, we need to pass the request_user to the form so it can check who’s making the update. Also, we’ll fix the instance loading to use the username URL parameter (right now you’re always using request.user, which breaks if admins need to edit other users’ profiles).

Updated views.py

from django.shortcuts import get_object_or_404
from django.contrib.auth.decorators import login_required

@login_required
def update_user_profile(request, username):
    args = {}
    # Get the user whose profile is being updated (from the URL parameter)
    target_user = get_object_or_404(User, username=username)

    # Optional: Add permission check (e.g., only allow self-edits or admin access)
    if request.user != target_user and not request.user.is_staff:
        # Redirect back to profile if user doesn't have permission to edit
        return HttpResponseRedirect(reverse('user-profile', kwargs={'username': username}))

    if request.method == 'POST':
        # Pass both the target user instance and request user to the form
        form = UpdateUserProfile(request.POST, instance=target_user, request_user=request.user)
        if form.is_valid():
            form.save()
            return HttpResponseRedirect(reverse('user-profile', kwargs={'username': form.save()[1]}))
    else:
        form = UpdateUserProfile(instance=target_user, request_user=request.user)
    
    args['form'] = form
    return render(request, 'storytime/update_user_profile.html', args)

Key Changes Explained #

• self.request_user in the form: Lets us know who’s making the update, so we can treat self-edits differently from admin edits.
• exclude(pk=current_user.pk): Ensures we don’t count the current user’s own username/email when checking for duplicates.
• Field change check: For self-edits, we only validate uniqueness if the user actually modified the username/email field.
• Permission check in view: Adds a basic guard to prevent unauthorized users from editing others’ profiles (adjust this to match your app’s permission rules).

Why Your Previous exclude Attempt Failed #

Most likely, you missed two critical pieces:

1. Not specifically excluding the current user (using their primary key) from the duplicate check
2. Not verifying if the field was actually changed before running the validation

This setup should eliminate the constant validation errors while still enforcing uniqueness when it matters.

内容的提问来源于stack exchange，提问作者Neemaximo