From 8b784669253d4b7c3a463d03f7654672ec8d05dd Mon Sep 17 00:00:00 2001
From: Ross <xkjq@ymail.com>
Date: Thu, 30 Sep 2021 22:56:59 +0100
Subject: [PATCH] .

---
 physics/decorators.py | 25 +++++++++++++++++++++++++
 physics/views.py      |  3 +++
 rapids/decorators.py  |  4 ++--
 3 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100755 physics/decorators.py

diff --git a/physics/decorators.py b/physics/decorators.py
new file mode 100755
index 00000000..cbfc6fb7
--- /dev/null
+++ b/physics/decorators.py
@@ -0,0 +1,25 @@
+from django.core.exceptions import PermissionDenied
+from .models import Exam, Question
+
+def user_is_author_or_physics_checker(function):
+    def wrap(request, *args, **kwargs):
+        question = Question.objects.get(pk=kwargs['pk'])
+        if request.user in question.author.all() or request.user.groups.filter(name='physics_checker').exists():
+            return function(request, *args, **kwargs)
+        else:
+            raise PermissionDenied
+    wrap.__doc__ = function.__doc__
+    wrap.__name__ = function.__name__
+    return wrap
+
+
+def user_is_exam_author_or_physics_checker(function):
+    def wrap(request, *args, **kwargs):
+        exam = Exam.objects.get(pk=kwargs['pk'])
+        if request.user in exam.author.all() or request.user.groups.filter(name='physics_checker').exists():
+            return function(request, *args, **kwargs)
+        else:
+            raise PermissionDenied
+    wrap.__doc__ = function.__doc__
+    wrap.__name__ = function.__name__
+    return wrap
\ No newline at end of file
diff --git a/physics/views.py b/physics/views.py
index cdb187d6..ab5cc735 100644
--- a/physics/views.py
+++ b/physics/views.py
@@ -1,3 +1,4 @@
+from physics.decorators import user_is_author_or_physics_checker
 from physics.filters import QuestionFilter, UserAnswerFilter
 from generic.mixins import SuperuserRequiredMixin
 from physics.tables import QuestionTable, UserAnswerTable
@@ -46,6 +47,7 @@ from rest_framework.pagination import PageNumberPagination
 from django.core.exceptions import PermissionDenied
 
 from .forms import ExamForm
+from .decorators import user_is_author_or_physics_checker, user_is_exam_author_or_physics_checker
 
 class AuthorOrCheckerRequiredMixin(object):
     def get_object(self, *args, **kwargs):
@@ -62,6 +64,7 @@ def question_list(request):
 
 
 @login_required
+@user_is_author_or_physics_checker
 def question_detail(request, pk):
     question = get_object_or_404(Question, pk=pk)
     return render(request, "physics/question_detail.html", {"question": question})
diff --git a/rapids/decorators.py b/rapids/decorators.py
index 59021f9e..76c88174 100755
--- a/rapids/decorators.py
+++ b/rapids/decorators.py
@@ -3,8 +3,8 @@ from .models import Exam, Rapid
 
 def user_is_author_or_rapid_checker(function):
     def wrap(request, *args, **kwargs):
-        rapid = Rapid.objects.get(pk=kwargs['pk'])
-        if request.user in rapid.author.all() or request.user.groups.filter(name='rapid_checker').exists():
+        question = Rapid.objects.get(pk=kwargs['pk'])
+        if request.user in question.author.all() or request.user.groups.filter(name='rapid_checker').exists():
             return function(request, *args, **kwargs)
         else:
             raise PermissionDenied