.

generic/views.py

@@ -2,6 +2,7 @@ from django.shortcuts import render, get_object_or_404, redirect
 
 from django.contrib.auth.decorators import login_required, user_passes_test
 from django.views.decorators.csrf import csrf_exempt
+from django.core.exceptions import PermissionDenied
 
 from django.http import Http404, JsonResponse
 from django.http import HttpResponseRedirect, HttpResponse
@@ -197,6 +198,8 @@ class ExamViews(View, LoginRequiredMixin):
 
     @method_decorator(login_required)
     def exam_list(self, request):
+        if not request.user.groups.filter(name='rapid_checker').exists():
+            raise PermissionDenied
         exams = self.Exam.objects.all()
         return render(request, "{}/exam_list.html".format(self.app_name), {"exams": exams})
 
@@ -277,6 +280,9 @@ class ExamViews(View, LoginRequiredMixin):
     def mark_overview(self, request, pk):
         exam = get_object_or_404(self.Exam, pk=pk)
 
+        if request.user not in exam.author.all() and not request.user.groups.filter(name='rapid_checker').exists():
+            raise PermissionDenied
+
         questions = exam.exam_questions.all()
 
         return render(
@@ -292,6 +298,9 @@ class ExamViews(View, LoginRequiredMixin):
     def exam_question_detail(self, request, pk, sk):
         exam = get_object_or_404(self.Exam, pk=pk)
 
+        if request.user not in exam.author.all() and not request.user.groups.filter(name='rapid_checker').exists():
+            raise PermissionDenied
+
         question = exam.exam_questions.all()[sk]
 
         exam_length = len(exam.exam_questions.all())