.

generic/views.py

@@ -283,6 +283,8 @@ class ExamViews(View, LoginRequiredMixin):
         if request.user not in exam.author.all():
             if not self.check_user_access(request.user):
                 raise PermissionDenied
+        
+        can_edit = self.check_user_edit_access(request.user)
 
         questions = exam.exam_questions.all()
 
@@ -291,7 +293,7 @@ class ExamViews(View, LoginRequiredMixin):
         return render(
             request,
             "{}/exam_overview.html".format(self.app_name),
-            {"exam": exam, "questions": questions, "question_number": question_number},
+            {"exam": exam, "questions": questions, "question_number": question_number, "can_edit": can_edit},
         )
 
     @method_decorator(login_required)

longs/templates/longs/exam_overview.html

@@ -63,6 +63,9 @@
         {{ author }},
         {% endfor %}
     </div>
+    
+    {% if can_edit %}
+        
     <p><button id='button-edit-order'>Edit exam order</button></p>
     <div>
         JSON creation time: {{exam.json_creation_time}} ({{exam.json_creation_time|date:"c"}}),
@@ -75,6 +78,7 @@
 
     <button id='button-open-access'>Make questions open access</button>
     <button id='button-closed-access'>Make questions closed access</button>
+    {% endif %}
 
 </div>
 <script type="text/javascript">