From 8691868bd87640dfb7fc00e6077ff1a9641cad55 Mon Sep 17 00:00:00 2001 From: Ross Date: Sun, 12 Dec 2021 13:52:21 +0000 Subject: [PATCH] . --- generic/models.py | 3 +++ generic/views.py | 6 +++++- rad/urls.py | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/generic/models.py b/generic/models.py index 03914582..73480de2 100644 --- a/generic/models.py +++ b/generic/models.py @@ -204,6 +204,9 @@ class CidUser(models.Model): def __str__(self) -> str: return str(self.cid) + def check_passcode(self, passcode) -> bool: + return self.passcode == passcode + class CidUserExam(models.Model): content_type = models.ForeignKey(ContentType, on_delete=models.CASCADE) object_id = models.PositiveIntegerField() diff --git a/generic/views.py b/generic/views.py index b8a1edfa..0da6e501 100644 --- a/generic/views.py +++ b/generic/views.py @@ -613,6 +613,11 @@ class ExamViews(View, LoginRequiredMixin): active_exams = {"exams": []} + if cid is not None: + cid_user = CidUser.objects.filter(cid=cid).first() + if not cid_user or cid_user.passcode != passcode: + return JsonResponse({"status": "invalid"}, status=401) + for exam in exams: if exam.active or self.check_user_access(request.user, exam.pk): if not exam.check_cid_user(cid, passcode): @@ -966,7 +971,6 @@ def manage_cid_users(request): selected_cids = json.loads(request.POST.get("selected_cids")) - number_to_create = int(request.POST.get("number_to_create")) delete = request.POST.get("delete") diff --git a/rad/urls.py b/rad/urls.py index 20ae7e92..47240645 100644 --- a/rad/urls.py +++ b/rad/urls.py @@ -60,7 +60,7 @@ urlpatterns = [ path("cid/", views.cid_selector, name="cid_selector"), # Global url that registers RTS compatible exams path("exam/json/", views.active_exams, name="active_exams"), - path("exam/json//", views.active_exams, name="active_exams_cid"), + path("exam/json//", views.active_exams, name="active_exams_cid"), path("exam/json/unbased", views.active_exams_unbased, name="active_exams_unbased"), path("exam/submit", views.exam_submit, name="global_exam_answers_submit"), #path('', include('generic.urls')),