.

generic/views.py

@@ -272,21 +272,6 @@ class ExamViews(View, LoginRequiredMixin):
                 data = {"status": "success"}
                 return JsonResponse(data, status=200)
 
-            if "set_open_access" in request.POST:
-                if request.POST.get("set_open_access") == "true":
-                    state = True
-                else:
-                    state = False
-
-                questions_changed = []
-                for q in exam.exam_questions.all():
-                    q.open_access = state
-                    q.save()
-                    questions_changed.append(q.pk)
-
-                data = {"status": "success", "questions": questions_changed, "state": state}
-                return JsonResponse(data, status=200)
-
             if "set_exam_order" in request.POST:
                 new_order = json.loads(request.POST.get("set_exam_order"))
 
@@ -303,6 +288,24 @@ class ExamViews(View, LoginRequiredMixin):
                 return JsonResponse(data, status=200)
 
 
+            if not self.check_user_access(request.user):
+                raise PermissionDenied
+
+            if "set_open_access" in request.POST:
+                if request.POST.get("set_open_access") == "true":
+                    state = True
+                else:
+                    state = False
+
+                questions_changed = []
+                for q in exam.exam_questions.all():
+                    q.open_access = state
+                    q.save()
+                    questions_changed.append(q.pk)
+
+                data = {"status": "success", "questions": questions_changed, "state": state}
+                return JsonResponse(data, status=200)
+
             data = {"status": "error, unknown request"}
             return JsonResponse(data, status=400)
         else: