.

generic/views.py

@@ -613,6 +613,11 @@ class ExamViews(View, LoginRequiredMixin):
 
         active_exams = {"exams": []}
 
+        if cid is not None:
+            cid_user = CidUser.objects.filter(cid=cid).first()
+            if not cid_user or cid_user.passcode != passcode:
+                return JsonResponse({"status": "invalid"}, status=401)
+
         for exam in exams:
             if exam.active or self.check_user_access(request.user, exam.pk):
                 if not exam.check_cid_user(cid, passcode):
@@ -966,7 +971,6 @@ def manage_cid_users(request):
 
         selected_cids = json.loads(request.POST.get("selected_cids"))
 
-
         number_to_create = int(request.POST.get("number_to_create"))
 
         delete = request.POST.get("delete")