.

generic/views.py

@@ -194,7 +194,7 @@ class ExamViews(View, LoginRequiredMixin):
         #group_map = {"rapids" : "rapid_checker", "anatomy" : "anatomy_checker", "longs":"long_checker"}
         #exam_group = group_map[self.app_name]
 
-    def check_user_access(self, user):
+    def check_user_access(self, user, exam_id):
         """Check if a user should be able to access a view
 
         Args:
@@ -203,7 +203,8 @@ class ExamViews(View, LoginRequiredMixin):
         Returns:
             [boolean]: True if the user has access
         """        
-        if user in self.Exam.get_author_objects():
+        exam = get_object_or_404(self.Exam, pk=exam_id)
+        if user in exam.get_author_objects():
             return True
 
         if self.app_name == "rapids" and not user.groups.filter(name='rapid_checker').exists():
@@ -218,7 +219,7 @@ class ExamViews(View, LoginRequiredMixin):
             return False
         return True
 
-    def check_user_edit_access(self, user):
+    def check_user_edit_access(self, user, exam_id):
         """Check if a user should be able to access a view
 
         Args:
@@ -228,7 +229,8 @@ class ExamViews(View, LoginRequiredMixin):
             [boolean]: True if the user has access
         """        
         # If a user is an exam author they should have acccess
-        if user in self.Exam.get_author_objects():
+        exam = get_object_or_404(self.Exam, pk=exam_id)
+        if user in exam.get_author_objects():
             return True
 
         if self.app_name == "rapids" and not user.groups.filter(name='rapid_checker').exists():
@@ -321,10 +323,10 @@ class ExamViews(View, LoginRequiredMixin):
         exam = get_object_or_404(self.Exam, pk=pk)
 
         if request.user not in exam.author.all():
-            if not self.check_user_access(request.user):
+            if not self.check_user_access(request.user, pk):
                 raise PermissionDenied
         
-        can_edit = self.check_user_edit_access(request.user) | request.user.is_superuser
+        can_edit = self.check_user_edit_access(request.user, pk) | request.user.is_superuser
 
         notes = []
         if can_edit:
@@ -345,7 +347,7 @@ class ExamViews(View, LoginRequiredMixin):
         exam = get_object_or_404(self.Exam, pk=pk)
 
         if request.user not in exam.author.all():
-            if not self.check_user_access(request.user):
+            if not self.check_user_access(request.user, pk):
                 raise PermissionDenied
 
         q, content_type = get_question_and_content_type(self.question_type)
@@ -362,7 +364,7 @@ class ExamViews(View, LoginRequiredMixin):
     def exam_json_edit(self, request, pk):
         if request.is_ajax() and request.method == "POST":
 
-            if not self.check_user_edit_access(request.user):
+            if not self.check_user_edit_access(request.user, exam_id=pk):
                 data = {"status": "error, invalid permisions"}
                 return JsonResponse(data, status=400)
 
@@ -394,7 +396,7 @@ class ExamViews(View, LoginRequiredMixin):
                 return JsonResponse(data, status=200)
 
 
-            if not self.check_user_access(request.user):
+            if not self.check_user_access(request.user, pk):
                 raise PermissionDenied
 
             if "set_open_access" in request.POST:
@@ -423,7 +425,7 @@ class ExamViews(View, LoginRequiredMixin):
         exam = get_object_or_404(self.Exam, pk=pk)
 
         if request.user not in exam.author.all():
-            if not self.check_user_access(request.user):
+            if not self.check_user_access(request.user, pk):
                 raise PermissionDenied
 
 
@@ -469,7 +471,7 @@ class ExamViews(View, LoginRequiredMixin):
         exam = get_object_or_404(self.Exam, pk=pk)
 
         if request.user not in exam.author.all():
-            if not self.check_user_access(request.user):
+            if not self.check_user_access(request.user, pk):
                 raise PermissionDenied
 
 
@@ -505,7 +507,7 @@ class ExamViews(View, LoginRequiredMixin):
         active_exams = {"exams": []}
 
         for exam in exams:
-            if exam.active or self.check_user_access(request.user):
+            if exam.active or self.check_user_access(request.user, exam.pk):
                 if exam.json_creation_time:
                     creation_time = exam.json_creation_time.isoformat()
                 else:
@@ -570,7 +572,7 @@ class ExamViews(View, LoginRequiredMixin):
         """
         exam = get_object_or_404(self.Exam, pk=pk)
 
-        if not exam.active and not self.check_user_access(request.user):
+        if not exam.active and not self.check_user_access(request.user, pk):
             raise Http404("No available exam")
 
         exam_json = exam.get_exam_json(based=False)
@@ -581,7 +583,7 @@ class ExamViews(View, LoginRequiredMixin):
 
         exam = get_object_or_404(self.Exam, pk=pk)
 
-        if not exam.active and not self.check_user_access(request.user):
+        if not exam.active and not self.check_user_access(request.user, pk):
             raise Http404("No available exam")
 
 
@@ -629,7 +631,7 @@ class ExamViews(View, LoginRequiredMixin):
         question = get_object_or_404(self.Question, pk=sk)
         exam = get_object_or_404(self.Exam, pk=pk)
 
-        if not exam.active and not self.check_user_access(request.user):
+        if not exam.active and not self.check_user_access(request.user, pk):
             raise Http404("No available exam")
 
 
@@ -645,7 +647,7 @@ class ExamViews(View, LoginRequiredMixin):
         question = get_object_or_404(self.Question, pk=sk)
         exam = get_object_or_404(self.Exam, pk=pk)
 
-        if not exam.active and not self.check_user_access(request.user):
+        if not exam.active and not self.check_user_access(request.user, pk):
             raise Http404("No available exam")
 
         return redirect("{}:question_json_unbased".format(self.app_name), pk=sk)