.

rapids/filters.py

@@ -10,3 +10,9 @@ class RapidFilter(django_filters.FilterSet):
                   "laterality", 
                   #"site", 
                   "created_date", "author")
+
+    def __init__(self, data=None, queryset=None, prefix=None, strict=None, user=None, request=None):
+        if not request.user.groups.filter(name="rapid_checker").exists():
+            queryset = queryset.filter(open_access=True) | queryset.filter(author__id=request.user.id)
+        super(RapidFilter, self).__init__(data=data, queryset=queryset, prefix=prefix, request=request)
+        pass

rapids/views.py

@@ -91,6 +91,8 @@ class AuthorOrCheckerRequiredMixin(object):
 def question_detail(request, pk):
     rapid = get_object_or_404(Rapid, pk=pk)
 
+    if not request.user.groups.filter(name="rapid_checker").exists() and request.user not in question.author.all():
+        raise PermissionDenied()
     # if request.user not in rapid.author.all():
     #    raise PermissionDenied
 
@@ -103,6 +105,9 @@ def question_detail(request, pk):
 def rapid_split(request, pk):
     rapid = get_object_or_404(Rapid, pk=pk)
 
+    if not request.user.groups.filter(name="rapid_checker").exists() and request.user not in question.author.all():
+        raise PermissionDenied()
+
     images = rapid.images.all()
 
     old_abnormality = rapid.abnormality.all()
@@ -420,6 +425,9 @@ def rapid_scrap(request, pk):
     except Rapid.DoesNotExist:
         raise Http404("Rapid does not exist")
 
+    if not request.user.groups.filter(name="rapid_checker").exists() and request.user not in question.author.all():
+        raise PermissionDenied()
+
     rapid.scrapped = not rapid.scrapped
     rapid.save()
     return HttpResponseRedirect(reverse("rapids:question_detail", args=(pk,)))