.

generic/views.py

@@ -500,6 +500,9 @@ class ExamViews(View, LoginRequiredMixin):
             if exam.authors_only:
                 return False
 
+            if exam.open_access:
+                return True
+
         if user.groups.filter(name="cid_user_manager").exists():
             return True
 
@@ -697,8 +700,8 @@ class ExamViews(View, LoginRequiredMixin):
         return self.exam_list(request, all=True)
 
     def order_questions(self, request, exam_id):
-        if not self.check_user_edit_access(request.user):
-            raise PermissionDenied
+        if not self.check_user_edit_access(request.user, exam_id=exam_id):
+            return HttpResponse("Permission denied")
 
         exam = get_object_or_404(self.Exam, pk=exam_id)
 
@@ -1518,7 +1521,7 @@ class ExamViews(View, LoginRequiredMixin):
             exams = self.Exam.objects.all()
             filter = self.ExtraExamFilter(request.GET, queryset=exams)
         else:
-            exams = self.Exam.objects.filter(author__id=request.user.id)
+            exams = self.Exam.objects.filter(author__id=request.user.id) | self.Exam.objects.filter(open_access=True)
             filter = self.BasicExamFilter(request.GET, queryset=exams)
 
         return render(