Deny access to non-admin users to other's pages

- This checks that the user making the request is the same user as the
  one logged in and prevents access to the pages of other users if its
  not admin

plinth/modules/users/views.py

@@ -19,6 +19,7 @@ from django.contrib import messages
 from django.contrib.auth import update_session_auth_hash
 from django.contrib.auth.models import User
 from django.contrib.messages.views import SuccessMessageMixin
+from django.core.exceptions import PermissionDenied
 from django.urls import reverse, reverse_lazy
 from django.views.generic.edit import (CreateView, DeleteView, UpdateView,
                                        FormView)
@@ -80,6 +81,13 @@ class UserUpdate(ContextMixin, SuccessMessageMixin, UpdateView):
     success_message = ugettext_lazy('User %(username)s updated.')
     title = ugettext_lazy('Edit User')
 
+    def dispatch(self, request, *args, **kwargs):
+        if self.request.user.get_username() != self.kwargs['slug'] \
+                and not self.request.user.groups.filter(name='admin').exists():
+            raise PermissionDenied
+
+        return super(UserUpdate, self).dispatch(request, *args, **kwargs)
+
     def get_form_kwargs(self):
         """Make the requst object available to the form."""
         kwargs = super(UserUpdate, self).get_form_kwargs()
@@ -143,6 +151,13 @@ class UserChangePassword(ContextMixin, SuccessMessageMixin, FormView):
     title = ugettext_lazy('Change Password')
     success_message = ugettext_lazy('Password changed successfully.')
 
+    def dispatch(self, request, *args, **kwargs):
+        if self.request.user.get_username() != self.kwargs['slug'] \
+                and not self.request.user.groups.filter(name='admin').exists():
+            raise PermissionDenied
+
+        return super(UserChangePassword, self).dispatch(request, *args, **kwargs)
+
     def get_form_kwargs(self):
         """Make the user object available to the form."""
         kwargs = super(UserChangePassword, self).get_form_kwargs()