From e42906278ba6b2317fea350f914ba63682009c7d Mon Sep 17 00:00:00 2001
From: Ross <xkjq@ymail.com>
Date: Thu, 22 Apr 2021 13:24:05 +0100
Subject: [PATCH] .

---
 generic/views.py                  | 9 +++++++++
 rapids/templates/rapids/base.html | 3 ++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/generic/views.py b/generic/views.py
index 550ec3a8..7d9c8d38 100644
--- a/generic/views.py
+++ b/generic/views.py
@@ -2,6 +2,7 @@ from django.shortcuts import render, get_object_or_404, redirect
 
 from django.contrib.auth.decorators import login_required, user_passes_test
 from django.views.decorators.csrf import csrf_exempt
+from django.core.exceptions import PermissionDenied
 
 from django.http import Http404, JsonResponse
 from django.http import HttpResponseRedirect, HttpResponse
@@ -197,6 +198,8 @@ class ExamViews(View, LoginRequiredMixin):
 
     @method_decorator(login_required)
     def exam_list(self, request):
+        if not request.user.groups.filter(name='rapid_checker').exists():
+            raise PermissionDenied
         exams = self.Exam.objects.all()
         return render(request, "{}/exam_list.html".format(self.app_name), {"exams": exams})
 
@@ -277,6 +280,9 @@ class ExamViews(View, LoginRequiredMixin):
     def mark_overview(self, request, pk):
         exam = get_object_or_404(self.Exam, pk=pk)
 
+        if request.user not in exam.author.all() and not request.user.groups.filter(name='rapid_checker').exists():
+            raise PermissionDenied
+
         questions = exam.exam_questions.all()
 
         return render(
@@ -292,6 +298,9 @@ class ExamViews(View, LoginRequiredMixin):
     def exam_question_detail(self, request, pk, sk):
         exam = get_object_or_404(self.Exam, pk=pk)
 
+        if request.user not in exam.author.all() and not request.user.groups.filter(name='rapid_checker').exists():
+            raise PermissionDenied
+
         question = exam.exam_questions.all()[sk]
 
         exam_length = len(exam.exam_questions.all())
diff --git a/rapids/templates/rapids/base.html b/rapids/templates/rapids/base.html
index 9b974595..5c59947d 100755
--- a/rapids/templates/rapids/base.html
+++ b/rapids/templates/rapids/base.html
@@ -17,7 +17,8 @@ Rapids
 {% block navigation %}
 Rapids: 
 {% if request.user.is_authenticated %}
-<a href="{% url 'rapids:exam_list' %}">Exams</a> /
+<a href="{% url 'rapids:index' %}">Exams</a> /
+<a href="{% url 'rapids:exam_list' %}">Active Exams</a> /
 <a href="{% url 'rapids:rapid_view' %}">Questions</a> /
 <a href="{% url 'rapids:rapid_create' %}" title="Create a new question">Create Question</a>
 {% endif %}