.

sbas/views.py

@@ -179,7 +179,7 @@ def exam_scores_cid(request, pk):
     )
 
 
-def exam_scores_cid_user(request, pk, sk):
+def exam_scores_cid_user(request, pk, sk, passcode):
     exam = get_object_or_404(Exam, pk=pk)
 
     # TODO:Need some kind of test for cid
@@ -229,6 +229,7 @@ def exam_scores_cid_user(request, pk, sk):
         {
             "exam": exam,
             "cid": cid,
+            "passcode" : passcode,
             "questions": questions,
             "answers": answers,
             "answers_marks": answers_marks,
@@ -253,9 +254,12 @@ def exam_start(request, pk):
         },
     )
 
-def exam_finish(request, pk, cid):
+def exam_finish(request, pk, cid, passcode):
     exam = get_object_or_404(Exam, pk=pk)
 
+    if not exam.check_cid_user(cid, passcode):
+        raise Http404("Error accessing exam")
+
     questions = exam.exam_questions.all()
 
     answers = CidUserAnswer.objects.filter(
@@ -286,17 +290,21 @@ def exam_finish(request, pk, cid):
             "question_answer_tuples": question_answer_tuples,
             "answer_count": answer_count,
             "exam_length": len(questions),
+            "passcode": passcode,
         },
     )
 
 
-def exam_take(request, pk, sk, cid):
+def exam_take(request, pk, sk, cid, passcode):
 
     exam = get_object_or_404(Exam, pk=pk)
 
     if not exam.active:
         raise Http404("Exam not found")
 
+    if not exam.check_cid_user(cid, passcode):
+        raise Http404("Error accessing exam")
+
     question = exam.exam_questions.all()[sk]
 
     exam_length = len(exam.exam_questions.all())
@@ -318,14 +326,17 @@ def exam_take(request, pk, sk, cid):
             answer.exam = exam
             # answer.published_date = timezone.now()
             answer.save()
+
+        kwargs = {"pk": pk, "cid": cid, "passcode": passcode}
+
         if "next" in request.POST:
-            return redirect("sbas:exam_take", pk=pk, sk=pos + 1, cid=cid)
+            return redirect("sbas:exam_take", sk=pos + 1, **kwargs)
         elif "previous" in request.POST:
-            return redirect("sbas:exam_take", pk=pk, sk=pos - 1, cid=cid)
+            return redirect("sbas:exam_take", sk=pos - 1, **kwargs)
         elif "finish" in request.POST:
-            return redirect("sbas:exam_finish", pk=pk, cid=cid)
+            return redirect("sbas:exam_finish", **kwargs)
         elif "goto" in request.POST:
-            return redirect("sbas:exam_take", pk=pk, sk=int(request.POST.get("goto")), cid=cid)
+            return redirect("sbas:exam_take", sk=int(request.POST.get("goto")), **kwargs)
     else:
         form = CidUserAnswerForm(instance=answer)
 
@@ -354,6 +365,7 @@ def exam_take(request, pk, sk, cid):
             "exam_length": exam_length,
             "pos": pos,
             "saved_answer": saved_answer,
+            "passcode": passcode,
         },
     )