From 15d4a39550d93e44be81f0d87d4f3917d60b7618 Mon Sep 17 00:00:00 2001
From: Ross <xkjq@ymail.com>
Date: Sat, 1 May 2021 13:10:00 +0100
Subject: [PATCH] .

---
 generic/views.py | 33 ++++++++++++++++++---------------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/generic/views.py b/generic/views.py
index a2cb4da1..30f572cd 100644
--- a/generic/views.py
+++ b/generic/views.py
@@ -272,21 +272,6 @@ class ExamViews(View, LoginRequiredMixin):
                 data = {"status": "success"}
                 return JsonResponse(data, status=200)
 
-            if "set_open_access" in request.POST:
-                if request.POST.get("set_open_access") == "true":
-                    state = True
-                else:
-                    state = False
-
-                questions_changed = []
-                for q in exam.exam_questions.all():
-                    q.open_access = state
-                    q.save()
-                    questions_changed.append(q.pk)
-
-                data = {"status": "success", "questions": questions_changed, "state": state}
-                return JsonResponse(data, status=200)
-
             if "set_exam_order" in request.POST:
                 new_order = json.loads(request.POST.get("set_exam_order"))
 
@@ -303,6 +288,24 @@ class ExamViews(View, LoginRequiredMixin):
                 return JsonResponse(data, status=200)
 
 
+            if not self.check_user_access(request.user):
+                raise PermissionDenied
+
+            if "set_open_access" in request.POST:
+                if request.POST.get("set_open_access") == "true":
+                    state = True
+                else:
+                    state = False
+
+                questions_changed = []
+                for q in exam.exam_questions.all():
+                    q.open_access = state
+                    q.save()
+                    questions_changed.append(q.pk)
+
+                data = {"status": "success", "questions": questions_changed, "state": state}
+                return JsonResponse(data, status=200)
+
             data = {"status": "error, unknown request"}
             return JsonResponse(data, status=400)
         else: