.

anatomy/decorators.py

@@ -0,0 +1,13 @@
+from django.core.exceptions import PermissionDenied
+from .models import Exam, AnatomyQuestion
+
+def user_is_author_or_anatomy_checker(function):
+    def wrap(request, *args, **kwargs):
+        question = AnatomyQuestion.objects.get(pk=kwargs['pk'])
+        if request.user in question.author.all() or request.user.groups.filter(name='anatomy_checker').exists():
+            return function(request, *args, **kwargs)
+        else:
+            raise PermissionDenied
+    wrap.__doc__ = function.__doc__
+    wrap.__name__ = function.__name__
+    return wrap

anatomy/views.py

@@ -48,6 +48,8 @@ from .models import (
 from generic.models import Examination
 from generic.views import ExamViews
 
+from .decorators import user_is_author_or_anatomy_checker
+
 from .tables import AnatomyQuestionTable, AnatomyUserAnswerTable
 from .filters import AnatomyQuestionFilter, AnatomyUserAnswerFilter
 
@@ -962,7 +964,7 @@ class AnatomyUserAnswerView(LoginRequiredMixin, SingleTableMixin, FilterView):
 
     filterset_class = AnatomyUserAnswerFilter
 
-
+@user_is_author_or_anatomy_checker
 def question_save_annotation(request, pk):
     if request.is_ajax() and request.method == "POST":
         question = get_object_or_404(AnatomyQuestion, pk=pk)

rapids/decorators.py

@@ -1,5 +1,5 @@
 from django.core.exceptions import PermissionDenied
-from .models import Exam
+from .models import Exam, Rapid
 
 def user_is_author_or_rapid_checker(function):
     def wrap(request, *args, **kwargs):