How can I only allow authors to edit their own entires via front-end?

Question

I have a front-end form that registered users can log into and edit entries.

I am checking for the correct user group, then also checking for the permission:

{% if currentUser.isInGroup('myGroup') %}

    {# Get the entry #}
    {% set request = craft.app.request.segment(3) %}
    {% set entry = craft.entries.section('mySection').slug(request).one() %}

    {% if entry|length > 0 %}
        {% if currentUser.can('editEntries:7') %}
          {# user can edit the current entry #}
        {% endif %}
    {% endif %}

{% endif %}

All is fine, but if I change the url to another valid url (where the logged in user is not the author) I am still able to see the entry.

Is there a way to prevent that? Is it as easy as just checking/comparing authors? Or is there a more eloquent way? I do have other permissions disabled...

Thank you for any suggestions!

Answer 1

You can check if the current entry's author is the currentUser.

{% if entry.author.id == currentUser.id %}
    {# User can edit entry #}
{% endif %}