from django.contrib.auth.decorators import login_required
from django.http import HttpResponse
from django.template import RequestContext
from django.shortcuts import render_to_response
from django.contrib import messages

try:
    from django.views.decorators.csrf import csrf_exempt
except ImportError:
    from django.contrib.csrf.middleware import csrf_exempt

from .forms import DashboardPreferencesForm
from .models import DashboardPreferences


@login_required
@csrf_exempt
def set_preferences(request, dashboard_id):
    """
    This view serves and validates a preferences form.
    """
    try:
        preferences = DashboardPreferences.objects.get(
            user=request.user,
            dashboard_id=dashboard_id
        )
    except DashboardPreferences.DoesNotExist:
        preferences = None
    if request.method == "POST":
        form = DashboardPreferencesForm(
            user=request.user,
            dashboard_id=dashboard_id,
            data=request.POST,
            instance=preferences
        )
        if form.is_valid():
            preferences = form.save()
            if request.is_ajax():
                return HttpResponse('true')
            messages.success(request, 'Preferences saved')
        elif request.is_ajax():
            return HttpResponse('false')
    else:
        form = DashboardPreferencesForm(
            user=request.user,
            dashboard_id=dashboard_id,
            instance=preferences
        )
    return render_to_response('admin_tools/dashboard/preferences_form.html',
                              RequestContext(request, {'form': form}))

from django.contrib.admin.views.decorators import staff_member_required
from django.http import HttpResponse
from django.template import RequestContext
from django.shortcuts import render_to_response
from django.contrib import messages

try:
    from django.views.decorators.csrf import csrf_exempt
except ImportError:
    from django.contrib.csrf.middleware import csrf_exempt

from .forms import DashboardPreferencesForm
from .models import DashboardPreferences


@staff_member_required
@csrf_exempt
def set_preferences(request, dashboard_id):
    """
    This view serves and validates a preferences form.
    """
    try:
        preferences = DashboardPreferences.objects.get(
            user=request.user,
            dashboard_id=dashboard_id
        )
    except DashboardPreferences.DoesNotExist:
        preferences = None
    if request.method == "POST":
        form = DashboardPreferencesForm(
            user=request.user,
            dashboard_id=dashboard_id,
            data=request.POST,
            instance=preferences
        )
        if form.is_valid():
            preferences = form.save()
            if request.is_ajax():
                return HttpResponse('true')
            messages.success(request, 'Preferences saved')
        elif request.is_ajax():
            return HttpResponse('false')
    else:
        form = DashboardPreferencesForm(
            user=request.user,
            dashboard_id=dashboard_id,
            instance=preferences
        )
    return render_to_response('admin_tools/dashboard/preferences_form.html',
                              RequestContext(request, {'form': form}))

Use @staff_member_required decorator for the dashboard view as well
Use @staff_member_required decorator for the dashboard view as well

- from django.contrib.auth.decorators import login_required
+ from django.contrib.admin.views.decorators import staff_member_required
  from django.http import HttpResponse
  from django.template import RequestContext
  from django.shortcuts import render_to_response
  from django.contrib import messages
  
  try:
      from django.views.decorators.csrf import csrf_exempt
  except ImportError:
      from django.contrib.csrf.middleware import csrf_exempt
  
  from .forms import DashboardPreferencesForm
  from .models import DashboardPreferences
  
  
- @login_required
+ @staff_member_required
  @csrf_exempt
  def set_preferences(request, dashboard_id):
      """
      This view serves and validates a preferences form.
      """
      try:
          preferences = DashboardPreferences.objects.get(
              user=request.user,
              dashboard_id=dashboard_id
          )
      except DashboardPreferences.DoesNotExist:
          preferences = None
      if request.method == "POST":
          form = DashboardPreferencesForm(
              user=request.user,
              dashboard_id=dashboard_id,
              data=request.POST,
              instance=preferences
          )
          if form.is_valid():
              preferences = form.save()
              if request.is_ajax():
                  return HttpResponse('true')
              messages.success(request, 'Preferences saved')
          elif request.is_ajax():
              return HttpResponse('false')
      else:
          form = DashboardPreferencesForm(
              user=request.user,
              dashboard_id=dashboard_id,
              instance=preferences
          )
      return render_to_response('admin_tools/dashboard/preferences_form.html',
                                RequestContext(request, {'form': form}))
  
Use @staff_member_required decorator for the dashboard view as well
## Code Before:
from django.contrib.auth.decorators import login_required
from django.http import HttpResponse
from django.template import RequestContext
from django.shortcuts import render_to_response
from django.contrib import messages

try:
    from django.views.decorators.csrf import csrf_exempt
except ImportError:
    from django.contrib.csrf.middleware import csrf_exempt

from .forms import DashboardPreferencesForm
from .models import DashboardPreferences


@login_required
@csrf_exempt
def set_preferences(request, dashboard_id):
    """
    This view serves and validates a preferences form.
    """
    try:
        preferences = DashboardPreferences.objects.get(
            user=request.user,
            dashboard_id=dashboard_id
        )
    except DashboardPreferences.DoesNotExist:
        preferences = None
    if request.method == "POST":
        form = DashboardPreferencesForm(
            user=request.user,
            dashboard_id=dashboard_id,
            data=request.POST,
            instance=preferences
        )
        if form.is_valid():
            preferences = form.save()
            if request.is_ajax():
                return HttpResponse('true')
            messages.success(request, 'Preferences saved')
        elif request.is_ajax():
            return HttpResponse('false')
    else:
        form = DashboardPreferencesForm(
            user=request.user,
            dashboard_id=dashboard_id,
            instance=preferences
        )
    return render_to_response('admin_tools/dashboard/preferences_form.html',
                              RequestContext(request, {'form': form}))

## Instruction:
Use @staff_member_required decorator for the dashboard view as well
## Code After:
from django.contrib.admin.views.decorators import staff_member_required
from django.http import HttpResponse
from django.template import RequestContext
from django.shortcuts import render_to_response
from django.contrib import messages

try:
    from django.views.decorators.csrf import csrf_exempt
except ImportError:
    from django.contrib.csrf.middleware import csrf_exempt

from .forms import DashboardPreferencesForm
from .models import DashboardPreferences


@staff_member_required
@csrf_exempt
def set_preferences(request, dashboard_id):
    """
    This view serves and validates a preferences form.
    """
    try:
        preferences = DashboardPreferences.objects.get(
            user=request.user,
            dashboard_id=dashboard_id
        )
    except DashboardPreferences.DoesNotExist:
        preferences = None
    if request.method == "POST":
        form = DashboardPreferencesForm(
            user=request.user,
            dashboard_id=dashboard_id,
            data=request.POST,
            instance=preferences
        )
        if form.is_valid():
            preferences = form.save()
            if request.is_ajax():
                return HttpResponse('true')
            messages.success(request, 'Preferences saved')
        elif request.is_ajax():
            return HttpResponse('false')
    else:
        form = DashboardPreferencesForm(
            user=request.user,
            dashboard_id=dashboard_id,
            instance=preferences
        )
    return render_to_response('admin_tools/dashboard/preferences_form.html',
                              RequestContext(request, {'form': form}))
