.

anatomy/views.py

@@ -6,6 +6,7 @@ from django import forms
 # from django.contrib.auth.models import User
 from django.contrib.auth.decorators import login_required, user_passes_test
 from django.contrib.auth.models import User
+from django.core.exceptions import PermissionDenied
 
 from django.contrib.auth.mixins import LoginRequiredMixin
 
@@ -64,6 +65,14 @@ from django.template.defaulttags import register
 
 from generic.mixins import SuperuserRequiredMixin
 
+class AuthorOrCheckerRequiredMixin(object):
+    def get_object(self, *args, **kwargs):
+        obj = super().get_object(*args, **kwargs)
+        if self.request.user.groups.filter(name="anatomy_checker").exists():
+            return obj
+        if self.request.user not in obj.author.all():
+            raise PermissionDenied()  # or Http404
+        return obj
 
 @register.filter
 def get_item(dictionary, key):
@@ -948,4 +957,7 @@ AnatomyExamViews = ExamViews(Exam, "anatomy", "anatomy", loadJsonAnswer)
 
 class UserAnswerDelete(SuperuserRequiredMixin, DeleteView):
     model = CidUserAnswer
-    success_url = reverse_lazy("anatomy:anatomy_user_answer_view")
+    success_url = reverse_lazy("anatomy:anatomy_user_answer_view")
+class QuestionDelete(AuthorOrCheckerRequiredMixin, DeleteView):
+    model = AnatomyQuestion
+    success_url = reverse_lazy("anatomy:anatomy_question_view")