.

anatomy/views.py

@@ -1015,11 +1015,11 @@ GenericExamViews = ExamViews(
 )
 
 
-class UserAnswerView(LoginRequiredMixin, DetailView):
+class UserAnswerView(SuperuserRequiredMixin, DetailView):
     model = CidUserAnswer
 
 
-class UserAnswerTableView(LoginRequiredMixin, SingleTableMixin, FilterView):
+class UserAnswerTableView(SuperuserRequiredMixin, SingleTableMixin, FilterView):
     model = CidUserAnswer
     table_class = AnatomyUserAnswerTable
     template_name = "anatomy/user_answer_question_view.html"

generic/views.py

@@ -367,8 +367,13 @@ class ExamViews(View, LoginRequiredMixin):
     def exam_toggle_results_published(self, request, pk):
         if request.is_ajax() and request.method == "POST":
 
+            if not self.check_user_edit_access(request.user):
+                data = {"status": "error, insufficient permission"}
+                return JsonResponse(data, status=400)
+
             exam = get_object_or_404(self.Exam, pk=pk)
 
+
             exam.publish_results = (
                 True if request.POST.get("publish_results") == "true" else False
             )
@@ -388,6 +393,10 @@ class ExamViews(View, LoginRequiredMixin):
     def exam_toggle_active(self, request, pk):
         if request.is_ajax() and request.method == "POST":
 
+            if not self.check_user_edit_access(request.user):
+                data = {"status": "error, insufficient permission"}
+                return JsonResponse(data, status=400)
+
             exam = get_object_or_404(self.Exam, pk=pk)
 
             exam.active = True if request.POST.get("active") == "true" else False