.

2022-01-07 11:33:19 +00:00
parent 055286d192
commit 4be1611c31
2 changed files with 11 additions and 2 deletions
@@ -367,8 +367,13 @@ class ExamViews(View, LoginRequiredMixin):
    def exam_toggle_results_published(self, request, pk):
        if request.is_ajax() and request.method == "POST":

+            if not self.check_user_edit_access(request.user):
+                data = {"status": "error, insufficient permission"}
+                return JsonResponse(data, status=400)
+
            exam = get_object_or_404(self.Exam, pk=pk)

+
            exam.publish_results = (
                True if request.POST.get("publish_results") == "true" else False
            )
@@ -388,6 +393,10 @@ class ExamViews(View, LoginRequiredMixin):
    def exam_toggle_active(self, request, pk):
        if request.is_ajax() and request.method == "POST":

+            if not self.check_user_edit_access(request.user):
+                data = {"status": "error, insufficient permission"}
+                return JsonResponse(data, status=400)
+
            exam = get_object_or_404(self.Exam, pk=pk)

            exam.active = True if request.POST.get("active") == "true" else False