.

generic/models.py

@@ -204,6 +204,9 @@ class CidUser(models.Model):
     def __str__(self) -> str:
         return str(self.cid)
 
+    def check_passcode(self, passcode) -> bool:
+        return self.passcode == passcode
+
 class CidUserExam(models.Model):
     content_type = models.ForeignKey(ContentType, on_delete=models.CASCADE)
     object_id = models.PositiveIntegerField()

generic/views.py

@@ -613,6 +613,11 @@ class ExamViews(View, LoginRequiredMixin):
 
         active_exams = {"exams": []}
 
+        if cid is not None:
+            cid_user = CidUser.objects.filter(cid=cid).first()
+            if not cid_user or cid_user.passcode != passcode:
+                return JsonResponse({"status": "invalid"}, status=401)
+
         for exam in exams:
             if exam.active or self.check_user_access(request.user, exam.pk):
                 if not exam.check_cid_user(cid, passcode):
@@ -966,7 +971,6 @@ def manage_cid_users(request):
 
         selected_cids = json.loads(request.POST.get("selected_cids"))
 
-
         number_to_create = int(request.POST.get("number_to_create"))
 
         delete = request.POST.get("delete")

rad/urls.py

@@ -60,7 +60,7 @@ urlpatterns = [
     path("cid/", views.cid_selector, name="cid_selector"),
     # Global url that registers RTS compatible exams
     path("exam/json/", views.active_exams, name="active_exams"),
-    path("exam/json/<int:pk>/<str:passcode>", views.active_exams, name="active_exams_cid"),
+    path("exam/json/<int:cid>/<str:passcode>", views.active_exams, name="active_exams_cid"),
     path("exam/json/unbased", views.active_exams_unbased, name="active_exams_unbased"),
     path("exam/submit", views.exam_submit, name="global_exam_answers_submit"),
     #path('', include('generic.urls')),