.

generic/models.py

@@ -204,6 +204,9 @@ class CidUser(models.Model):
     def __str__(self) -> str:
         return str(self.cid)
 
+    def check_passcode(self, passcode) -> bool:
+        return self.passcode == passcode
+
 class CidUserExam(models.Model):
     content_type = models.ForeignKey(ContentType, on_delete=models.CASCADE)
     object_id = models.PositiveIntegerField()

generic/views.py

@@ -613,6 +613,11 @@ class ExamViews(View, LoginRequiredMixin):
 
         active_exams = {"exams": []}
 
+        if cid is not None:
+            cid_user = CidUser.objects.filter(cid=cid).first()
+            if not cid_user or cid_user.passcode != passcode:
+                return JsonResponse({"status": "invalid"}, status=401)
+
         for exam in exams:
             if exam.active or self.check_user_access(request.user, exam.pk):
                 if not exam.check_cid_user(cid, passcode):
@@ -966,7 +971,6 @@ def manage_cid_users(request):
 
         selected_cids = json.loads(request.POST.get("selected_cids"))
 
-
         number_to_create = int(request.POST.get("number_to_create"))
 
         delete = request.POST.get("delete")