start testing

2022-05-21 11:20:21 +01:00
parent 0ca980ccb6
commit 160bb13b64
18 changed files with 203 additions and 61 deletions
@@ -1039,7 +1039,38 @@ class ExamViews(View, LoginRequiredMixin):
            n = 0

            for answer in json.loads(request.POST.get("answers")):
-                ret_status, ret = self.loadJsonAnswer(answer, user=request.user)
+
+                eid = int(answer["eid"].split("/")[1])
+                uid = False
+
+                try:
+                    cid = int(answer["cid"])
+                except ValueError:
+                    if answer["cid"].startswith("u-"):
+                        cid = False
+                        uid = int(answer["cid"][2:])
+
+                        if not uid == request.user.id:
+                            return JsonResponse(
+                                {"success": False, "error": "user / uid mismatch"}
+                            )
+
+                    else:
+                        return JsonResponse(
+                            {"success": False, "error": "cid or eid or answers not defined"}
+                        )
+
+                if not uid:
+                    # As access is not restricted make sure the data appears valid
+                    if (not isinstance(cid, int)) or (
+                        not isinstance(eid, int) or (not isinstance(answer["ans"], str))
+                    ):
+                        return JsonResponse(
+                            {"success": False, "error": "cid or eid or answers not defined"}
+                        )
+
+
+                ret_status, ret = self.loadJsonAnswer(answer, cid=cid, eid=eid, uid=uid)
                # try:
                #    ret_status, ret = self.loadJsonAnswer(answer)
                # except: