From 6196a81989eec68aff0ef8d3c53ec1311e0c39a1 Mon Sep 17 00:00:00 2001 From: Ross Date: Sun, 17 Oct 2021 10:12:40 +0100 Subject: [PATCH] . --- generic/views.py | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/generic/views.py b/generic/views.py index 0c572c85..fe74457a 100644 --- a/generic/views.py +++ b/generic/views.py @@ -194,7 +194,7 @@ class ExamViews(View, LoginRequiredMixin): #group_map = {"rapids" : "rapid_checker", "anatomy" : "anatomy_checker", "longs":"long_checker"} #exam_group = group_map[self.app_name] - def check_user_access(self, user): + def check_user_access(self, user, exam_id): """Check if a user should be able to access a view Args: @@ -203,7 +203,8 @@ class ExamViews(View, LoginRequiredMixin): Returns: [boolean]: True if the user has access """ - if user in self.Exam.get_author_objects(): + exam = get_object_or_404(self.Exam, pk=exam_id) + if user in exam.get_author_objects(): return True if self.app_name == "rapids" and not user.groups.filter(name='rapid_checker').exists(): @@ -218,7 +219,7 @@ class ExamViews(View, LoginRequiredMixin): return False return True - def check_user_edit_access(self, user): + def check_user_edit_access(self, user, exam_id): """Check if a user should be able to access a view Args: @@ -228,7 +229,8 @@ class ExamViews(View, LoginRequiredMixin): [boolean]: True if the user has access """ # If a user is an exam author they should have acccess - if user in self.Exam.get_author_objects(): + exam = get_object_or_404(self.Exam, pk=exam_id) + if user in exam.get_author_objects(): return True if self.app_name == "rapids" and not user.groups.filter(name='rapid_checker').exists(): @@ -321,10 +323,10 @@ class ExamViews(View, LoginRequiredMixin): exam = get_object_or_404(self.Exam, pk=pk) if request.user not in exam.author.all(): - if not self.check_user_access(request.user): + if not self.check_user_access(request.user, pk): raise PermissionDenied - can_edit = self.check_user_edit_access(request.user) | request.user.is_superuser + can_edit = self.check_user_edit_access(request.user, pk) | request.user.is_superuser notes = [] if can_edit: @@ -345,7 +347,7 @@ class ExamViews(View, LoginRequiredMixin): exam = get_object_or_404(self.Exam, pk=pk) if request.user not in exam.author.all(): - if not self.check_user_access(request.user): + if not self.check_user_access(request.user, pk): raise PermissionDenied q, content_type = get_question_and_content_type(self.question_type) @@ -362,7 +364,7 @@ class ExamViews(View, LoginRequiredMixin): def exam_json_edit(self, request, pk): if request.is_ajax() and request.method == "POST": - if not self.check_user_edit_access(request.user): + if not self.check_user_edit_access(request.user, exam_id=pk): data = {"status": "error, invalid permisions"} return JsonResponse(data, status=400) @@ -394,7 +396,7 @@ class ExamViews(View, LoginRequiredMixin): return JsonResponse(data, status=200) - if not self.check_user_access(request.user): + if not self.check_user_access(request.user, pk): raise PermissionDenied if "set_open_access" in request.POST: @@ -423,7 +425,7 @@ class ExamViews(View, LoginRequiredMixin): exam = get_object_or_404(self.Exam, pk=pk) if request.user not in exam.author.all(): - if not self.check_user_access(request.user): + if not self.check_user_access(request.user, pk): raise PermissionDenied @@ -469,7 +471,7 @@ class ExamViews(View, LoginRequiredMixin): exam = get_object_or_404(self.Exam, pk=pk) if request.user not in exam.author.all(): - if not self.check_user_access(request.user): + if not self.check_user_access(request.user, pk): raise PermissionDenied @@ -505,7 +507,7 @@ class ExamViews(View, LoginRequiredMixin): active_exams = {"exams": []} for exam in exams: - if exam.active or self.check_user_access(request.user): + if exam.active or self.check_user_access(request.user, exam.pk): if exam.json_creation_time: creation_time = exam.json_creation_time.isoformat() else: @@ -570,7 +572,7 @@ class ExamViews(View, LoginRequiredMixin): """ exam = get_object_or_404(self.Exam, pk=pk) - if not exam.active and not self.check_user_access(request.user): + if not exam.active and not self.check_user_access(request.user, pk): raise Http404("No available exam") exam_json = exam.get_exam_json(based=False) @@ -581,7 +583,7 @@ class ExamViews(View, LoginRequiredMixin): exam = get_object_or_404(self.Exam, pk=pk) - if not exam.active and not self.check_user_access(request.user): + if not exam.active and not self.check_user_access(request.user, pk): raise Http404("No available exam") @@ -629,7 +631,7 @@ class ExamViews(View, LoginRequiredMixin): question = get_object_or_404(self.Question, pk=sk) exam = get_object_or_404(self.Exam, pk=pk) - if not exam.active and not self.check_user_access(request.user): + if not exam.active and not self.check_user_access(request.user, pk): raise Http404("No available exam") @@ -645,7 +647,7 @@ class ExamViews(View, LoginRequiredMixin): question = get_object_or_404(self.Question, pk=sk) exam = get_object_or_404(self.Exam, pk=pk) - if not exam.active and not self.check_user_access(request.user): + if not exam.active and not self.check_user_access(request.user, pk): raise Http404("No available exam") return redirect("{}:question_json_unbased".format(self.app_name), pk=sk)