From 3d1d2ea481d03dad902d962dec644ed8591a1a8f Mon Sep 17 00:00:00 2001
From: Ross <xkjq@ymail.com>
Date: Sun, 17 Oct 2021 09:55:51 +0100
Subject: [PATCH] .

---
 anatomy/templates/anatomy/exam_overview.html | 10 +++++++---
 generic/views.py                             |  7 +++++++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/anatomy/templates/anatomy/exam_overview.html b/anatomy/templates/anatomy/exam_overview.html
index 54939f88..de7ba108 100644
--- a/anatomy/templates/anatomy/exam_overview.html
+++ b/anatomy/templates/anatomy/exam_overview.html
@@ -54,15 +54,19 @@
                 {{ author }},
             {% endfor %}
         </div>
-        <p><button id='button-edit-order'>Edit exam order</button></p>
+        {% if can_edit %}
+            <p><button id='button-edit-order'>Edit exam order</button></p>
+        {% endif %}
         <div>
             JSON creation time: {{exam.json_creation_time}} ({{exam.json_creation_time|date:"c"}}),
             JSON creation id: {{exam.exam_json_id}}
         </div>
         <a href="{% url 'anatomy:exam_json' pk=exam.pk %}">JSON</a>
         <a href="{% url 'anatomy:exam_json_recreate' pk=exam.pk %}">Refresh JSON cache</a>
-        <button id='button-open-access'>Make questions open access</button>
-        <button id='button-closed-access'>Make questions closed access</button>
+        {% if request.user.is_superuser %}
+            <button id='button-open-access'>Make questions open access</button>
+            <button id='button-closed-access'>Make questions closed access</button>
+        {% endif %}
 
     </div>
     <script type="text/javascript">
diff --git a/generic/views.py b/generic/views.py
index 3e38eb0a..7d08f41f 100644
--- a/generic/views.py
+++ b/generic/views.py
@@ -203,6 +203,9 @@ class ExamViews(View, LoginRequiredMixin):
         Returns:
             [boolean]: True if the user has access
         """        
+        if user in self.exam.get_author_objects():
+            return True
+
         if self.app_name == "rapids" and not user.groups.filter(name='rapid_checker').exists():
             return False
         if self.app_name == "anatomy" and not user.groups.filter(name='anatomy_checker').exists():
@@ -224,6 +227,10 @@ class ExamViews(View, LoginRequiredMixin):
         Returns:
             [boolean]: True if the user has access
         """        
+        # If a user is an exam author they should have acccess
+        if user in self.exam.get_author_objects():
+            return True
+
         if self.app_name == "rapids" and not user.groups.filter(name='rapid_checker').exists():
             return False
         if self.app_name == "anatomy" and not user.groups.filter(name='anatomy_checker').exists():