From 4be1611c31b89b274df86a5309e4842b0af70468 Mon Sep 17 00:00:00 2001 From: Ross Date: Fri, 7 Jan 2022 11:33:19 +0000 Subject: [PATCH] . --- anatomy/views.py | 4 ++-- generic/views.py | 9 +++++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/anatomy/views.py b/anatomy/views.py index ab4f53c6..1fc3f997 100644 --- a/anatomy/views.py +++ b/anatomy/views.py @@ -1015,11 +1015,11 @@ GenericExamViews = ExamViews( ) -class UserAnswerView(LoginRequiredMixin, DetailView): +class UserAnswerView(SuperuserRequiredMixin, DetailView): model = CidUserAnswer -class UserAnswerTableView(LoginRequiredMixin, SingleTableMixin, FilterView): +class UserAnswerTableView(SuperuserRequiredMixin, SingleTableMixin, FilterView): model = CidUserAnswer table_class = AnatomyUserAnswerTable template_name = "anatomy/user_answer_question_view.html" diff --git a/generic/views.py b/generic/views.py index e8dc58b1..89d00203 100644 --- a/generic/views.py +++ b/generic/views.py @@ -367,8 +367,13 @@ class ExamViews(View, LoginRequiredMixin): def exam_toggle_results_published(self, request, pk): if request.is_ajax() and request.method == "POST": + if not self.check_user_edit_access(request.user): + data = {"status": "error, insufficient permission"} + return JsonResponse(data, status=400) + exam = get_object_or_404(self.Exam, pk=pk) + exam.publish_results = ( True if request.POST.get("publish_results") == "true" else False ) @@ -388,6 +393,10 @@ class ExamViews(View, LoginRequiredMixin): def exam_toggle_active(self, request, pk): if request.is_ajax() and request.method == "POST": + if not self.check_user_edit_access(request.user): + data = {"status": "error, insufficient permission"} + return JsonResponse(data, status=400) + exam = get_object_or_404(self.Exam, pk=pk) exam.active = True if request.POST.get("active") == "true" else False