fix a few major permission holes

atlas/decorators.py

@@ -37,9 +37,13 @@ def user_is_author_or_atlas_series_checker(function):
     return wrap
 
 
-def user_is_author_or_atlas_editor_or_atlas_marker(function):
+def user_has_case_view_access(function):
     def wrap(request, *args, **kwargs):
         atlas = Case.objects.get(pk=kwargs["pk"])
+
+        # If open access everyone can view
+        if atlas.open_access:
+            return function(request, *args, **kwargs)
         if (
             request.user in atlas.author.all()
             or request.user.groups.filter(name="atlas_editor").exists()