fix a few major permission holes

generic/views.py

@@ -2327,6 +2327,10 @@ class GenericViewBase:
 class ExamCloneMixin:
     def get_initial(self):
         old_object = get_object_or_404(self.model, pk=self.kwargs["exam_id"])
+
+        if self.request.user not in old_object.get_author_objects() and not self.request.user.is_superuser:
+            raise PermissionDenied()  # or Http404
+
         initial_data = model_to_dict(old_object, exclude=["id"])
 
         # We manually transfer the forign keys / m2m relationships