.

anatomy/views.py

@@ -239,6 +239,9 @@ def loadJsonAnswer(answer):
 
     exam = get_object_or_404(Exam, pk=eid)
 
+    if not exam.check_cid_user(answer["cid"], answer["passcode"]):
+        return False, JsonResponse({"success": False, "error": "invalid cid / passcode"})
+
     # if not exam.active:
     #    return False, JsonResponse(
     #        {"success": False, "error": "No active exam: {}".format(eid)}

generic/views.py

@@ -669,12 +669,11 @@ class ExamViews(View, LoginRequiredMixin):
             n = 0
 
             for answer in json.loads(request.POST.get("answers")):
+                try:
                     ret_status, ret = self.loadJsonAnswer(answer)
-                #try:
+                except:
-                #    ret_status, ret = self.loadJsonAnswer(answer)
+                    # We catch the error here so users get an error (rather than 500)
-                #except:
+                    return JsonResponse({"success": False, "error": "Invalid data"})
-                #    # We catch the error here so users get an error (rather than 500)
-                #    return JsonResponse({"success": False, "error": "Invalid data"})
 
                 # if ret is not True:
                 #    return ret