.

generic/views.py

@@ -198,8 +198,13 @@ class ExamViews(View, LoginRequiredMixin):
 
     @method_decorator(login_required)
     def exam_list(self, request):
-        if not request.user.groups.filter(name='rapid_checker').exists():
+        if request.user not in exam.author.all():
-            raise PermissionDenied
+            if self.app_name == "rapids" and not request.user.groups.filter(name='rapid_checker').exists():
+                raise PermissionDenied
+            if self.app_name == "anatomy" and not request.user.groups.filter(name='anatomy_checker').exists():
+                raise PermissionDenied
+            if self.app_name == "longs" and not request.user.groups.filter(name='longs_checker').exists():
+                raise PermissionDenied
         exams = self.Exam.objects.all()
         return render(request, "{}/exam_list.html".format(self.app_name), {"exams": exams})
 
@@ -211,8 +216,13 @@ class ExamViews(View, LoginRequiredMixin):
         #print("test", Exam.objects.all().get(id=pk))
         exam = get_object_or_404(self.Exam, pk=pk)
 
-        if self.app_name == "rapids" and request.user not in exam.author.all() and not request.user.groups.filter(name='rapid_checker').exists():
+        if request.user not in exam.author.all():
-            raise PermissionDenied
+            if self.app_name == "rapids" and not request.user.groups.filter(name='rapid_checker').exists():
+                raise PermissionDenied
+            if self.app_name == "anatomy" and not request.user.groups.filter(name='anatomy_checker').exists():
+                raise PermissionDenied
+            if self.app_name == "longs" and not request.user.groups.filter(name='longs_checker').exists():
+                raise PermissionDenied
 
         questions = exam.exam_questions.all()
 
@@ -280,8 +290,14 @@ class ExamViews(View, LoginRequiredMixin):
     def mark_overview(self, request, pk):
         exam = get_object_or_404(self.Exam, pk=pk)
 
-        if request.user not in exam.author.all() and not request.user.groups.filter(name='rapid_checker').exists():
+        if request.user not in exam.author.all():
-            raise PermissionDenied
+            if self.app_name == "rapids" and not request.user.groups.filter(name='rapid_checker').exists():
+                raise PermissionDenied
+            if self.app_name == "anatomy" and not request.user.groups.filter(name='anatomy_checker').exists():
+                raise PermissionDenied
+            if self.app_name == "longs" and not request.user.groups.filter(name='longs_checker').exists():
+                raise PermissionDenied
+
 
         questions = exam.exam_questions.all()
 
@@ -302,8 +318,14 @@ class ExamViews(View, LoginRequiredMixin):
     def exam_question_detail(self, request, pk, sk):
         exam = get_object_or_404(self.Exam, pk=pk)
 
-        if request.user not in exam.author.all() and not request.user.groups.filter(name='rapid_checker').exists():
+        if request.user not in exam.author.all():
-            raise PermissionDenied
+            if self.app_name == "rapids" and not request.user.groups.filter(name='rapid_checker').exists():
+                raise PermissionDenied
+            if self.app_name == "anatomy" and not request.user.groups.filter(name='anatomy_checker').exists():
+                raise PermissionDenied
+            if self.app_name == "longs" and not request.user.groups.filter(name='longs_checker').exists():
+                raise PermissionDenied
+
 
         question = exam.exam_questions.all()[sk]
 

longs/filters.py

@@ -9,7 +9,19 @@ class LongFilter(django_filters.FilterSet):
         fields = (#"site", 
         "created_date", "exams", "author")
 
+    def __init__(self, data=None, queryset=None, prefix=None, strict=None, user=None, request=None):
+        if not request.user.groups.filter(name="longs_checker").exists():
+            queryset = queryset.filter(open_access=True) | queryset.filter(author__id=request.user.id)
+        super(LongFilter, self).__init__(data=data, queryset=queryset, prefix=prefix, request=request)
+        pass
+
 class LongSeriesFilter(django_filters.FilterSet):
     class Meta:
         model = LongSeries
-        fields = ("modality","long", "examination", "author")
+        fields = ("modality","long", "examination", "author")
+
+    def __init__(self, data=None, queryset=None, prefix=None, strict=None, user=None, request=None):
+        if not request.user.groups.filter(name="longs_checker").exists():
+            queryset = queryset.filter(open_access=True) | queryset.filter(author__id=request.user.id)
+        super(LongSeriesFilter, self).__init__(data=data, queryset=queryset, prefix=prefix, request=request)
+        pass

rapids/filters.py

@@ -10,3 +10,9 @@ class RapidFilter(django_filters.FilterSet):
                   "laterality", 
                   #"site", 
                   "created_date", "author")
+
+    def __init__(self, data=None, queryset=None, prefix=None, strict=None, user=None, request=None):
+        if not request.user.groups.filter(name="rapid_checker").exists():
+            queryset = queryset.filter(open_access=True) | queryset.filter(author__id=request.user.id)
+        super(RapidFilter, self).__init__(data=data, queryset=queryset, prefix=prefix, request=request)
+        pass

rapids/views.py

@@ -91,6 +91,8 @@ class AuthorOrCheckerRequiredMixin(object):
 def question_detail(request, pk):
     rapid = get_object_or_404(Rapid, pk=pk)
 
+    if not request.user.groups.filter(name="rapid_checker").exists() and request.user not in question.author.all():
+        raise PermissionDenied()
     # if request.user not in rapid.author.all():
     #    raise PermissionDenied
 
@@ -103,6 +105,9 @@ def question_detail(request, pk):
 def rapid_split(request, pk):
     rapid = get_object_or_404(Rapid, pk=pk)
 
+    if not request.user.groups.filter(name="rapid_checker").exists() and request.user not in question.author.all():
+        raise PermissionDenied()
+
     images = rapid.images.all()
 
     old_abnormality = rapid.abnormality.all()
@@ -420,6 +425,9 @@ def rapid_scrap(request, pk):
     except Rapid.DoesNotExist:
         raise Http404("Rapid does not exist")
 
+    if not request.user.groups.filter(name="rapid_checker").exists() and request.user not in question.author.all():
+        raise PermissionDenied()
+
     rapid.scrapped = not rapid.scrapped
     rapid.save()
     return HttpResponseRedirect(reverse("rapids:question_detail", args=(pk,)))