staging changes

generic/models.py

@@ -203,6 +203,7 @@ class ExamBase(models.Model):
         return authors
 
     def check_cid_user(self, cid: int|None, passcode: str|None, request: HttpRequest|None=None, user_id: int|None=None, allow_authors: bool=True):
+        print(f"Check cid user: {cid=}, {passcode=}, exam_id={self.pk}")
         if request is not None and request.user.is_superuser:
             return True
 

generic/views.py

@@ -1704,13 +1704,22 @@ class ExamViews(View, LoginRequiredMixin):
     def exam_question_json_unbased_cid(self, request, pk, sk, cid, passcode):
         return self.exam_question_json_unbased(request, pk, sk, cid, passcode)
 
-    def exam_question_json_unbased(self, request, pk, sk):
+    def exam_question_json_unbased(self, request, pk, sk, cid=None, passcode=None):
         question = get_object_or_404(self.Question, pk=sk)
         exam = get_object_or_404(self.Exam, pk=pk)
 
         if not exam.active and not self.check_user_access(request.user, pk):
             raise Http404("No available exam")
 
+        # Check access for users
+        if request.user.is_anonymous:
+            user_id = None
+        else:
+            user_id = request.user.pk
+        if not exam.check_cid_user(cid, passcode, request, user_id):
+            raise Http404("No available exam")
+
+
         return redirect("{}:question_json_unbased".format(self.app_name), pk=sk)
         redirect()