From d4ae7dbf6c4ceb7735686a318557ccccfada8801 Mon Sep 17 00:00:00 2001
From: Ross <xkjq@ymail.com>
Date: Thu, 29 Apr 2021 23:18:40 +0100
Subject: [PATCH] .

---
 anatomy/decorators.py | 13 +++++++++++++
 anatomy/views.py      |  4 +++-
 rapids/decorators.py  |  2 +-
 3 files changed, 17 insertions(+), 2 deletions(-)
 create mode 100755 anatomy/decorators.py

diff --git a/anatomy/decorators.py b/anatomy/decorators.py
new file mode 100755
index 00000000..d22f1adc
--- /dev/null
+++ b/anatomy/decorators.py
@@ -0,0 +1,13 @@
+from django.core.exceptions import PermissionDenied
+from .models import Exam, AnatomyQuestion
+
+def user_is_author_or_anatomy_checker(function):
+    def wrap(request, *args, **kwargs):
+        question = AnatomyQuestion.objects.get(pk=kwargs['pk'])
+        if request.user in question.author.all() or request.user.groups.filter(name='anatomy_checker').exists():
+            return function(request, *args, **kwargs)
+        else:
+            raise PermissionDenied
+    wrap.__doc__ = function.__doc__
+    wrap.__name__ = function.__name__
+    return wrap
diff --git a/anatomy/views.py b/anatomy/views.py
index 018c9e6b..a1b1c7a0 100644
--- a/anatomy/views.py
+++ b/anatomy/views.py
@@ -48,6 +48,8 @@ from .models import (
 from generic.models import Examination
 from generic.views import ExamViews
 
+from .decorators import user_is_author_or_anatomy_checker
+
 from .tables import AnatomyQuestionTable, AnatomyUserAnswerTable
 from .filters import AnatomyQuestionFilter, AnatomyUserAnswerFilter
 
@@ -962,7 +964,7 @@ class AnatomyUserAnswerView(LoginRequiredMixin, SingleTableMixin, FilterView):
 
     filterset_class = AnatomyUserAnswerFilter
 
-
+@user_is_author_or_anatomy_checker
 def question_save_annotation(request, pk):
     if request.is_ajax() and request.method == "POST":
         question = get_object_or_404(AnatomyQuestion, pk=pk)
diff --git a/rapids/decorators.py b/rapids/decorators.py
index c37c63c9..59021f9e 100755
--- a/rapids/decorators.py
+++ b/rapids/decorators.py
@@ -1,5 +1,5 @@
 from django.core.exceptions import PermissionDenied
-from .models import Exam
+from .models import Exam, Rapid
 
 def user_is_author_or_rapid_checker(function):
     def wrap(request, *args, **kwargs):