.

generic/views.py

@@ -98,6 +98,29 @@ def generic_exam_json_edit(request):
             data = {"status": "success"}
             return JsonResponse(data, status=200)
 
+        if "set_exam_order" in request.POST:
+            new_order = json.loads(request.POST.get("set_exam_order"))
+
+            preserved = Case(*[When(pk=pk, then=pos) for pos, pk in enumerate(new_order)])
+            objects = Question.objects.filter(pk__in=new_order).order_by(preserved)
+
+            if len(objects) != exam.exam_questions.count():
+                data = {"status": "error, count does not match"}
+                return JsonResponse(data, status=400)
+
+            exam.exam_questions.set(objects)
+            exam.save()
+            data = {"status": "success"}
+            return JsonResponse(data, status=200)
+
+        # Only checkers can do the following
+        if question_type == "rapids" and not request.user.groups.filter(name='rapid_checker').exists():
+            raise PermissionDenied
+        if question_type == "anatomy" and not request.user.groups.filter(name='anatomy_checker').exists():
+            raise PermissionDenied
+        if question_type == "longs" and not request.user.groups.filter(name='long_checker').exists():
+            raise PermissionDenied
+
         if "set_open_access" in request.POST:
             if request.POST.get("set_open_access") == "true":
                 state = True
@@ -113,20 +136,6 @@ def generic_exam_json_edit(request):
             data = {"status": "success", "questions": questions_changed, "state": state}
             return JsonResponse(data, status=200)
 
-        if "set_exam_order" in request.POST:
-            new_order = json.loads(request.POST.get("set_exam_order"))
-
-            preserved = Case(*[When(pk=pk, then=pos) for pos, pk in enumerate(new_order)])
-            objects = Question.objects.filter(pk__in=new_order).order_by(preserved)
-
-            if len(objects) != exam.exam_questions.count():
-                data = {"status": "error, count does not match"}
-                return JsonResponse(data, status=400)
-
-            exam.exam_questions.set(objects)
-            exam.save()
-            data = {"status": "success"}
-            return JsonResponse(data, status=200)
 
 
         data = {"status": "error, unknown request"}