From 112c96dc002e2f4ea8c5a42cf24c5450e91281f6 Mon Sep 17 00:00:00 2001 From: Ross Date: Mon, 29 Dec 2025 09:41:45 +0000 Subject: [PATCH] Restrict ExamCollectionList to authenticated users and filter by current user as author --- generic/views.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/generic/views.py b/generic/views.py index f18203ef..6bfe8dce 100644 --- a/generic/views.py +++ b/generic/views.py @@ -5734,7 +5734,7 @@ class SupervisorList(CidManagerRequiredMixin, SingleTableMixin, FilterView): filterset_class = SupervisorFilter -class ExamCollectionList(AuthorRequiredMixin, ListView): +class ExamCollectionList(ListView): model = ExamCollection def get_queryset(self): @@ -5742,7 +5742,12 @@ class ExamCollectionList(AuthorRequiredMixin, ListView): # allow toggling whether archived collections are included via ?show_archived=1 show_archived = self.request.GET.get("show_archived") - base_qs = ExamCollection.objects.all() + # If user is anonymous return empty set; otherwise limit to collections + # where the current user is listed as an author. + if not self.request.user.is_authenticated: + return ExamCollection.objects.none() + + base_qs = ExamCollection.objects.filter(author=self.request.user) if not show_archived: base_qs = base_qs.filter(archive=False)