From eb06e63f775b678400cb8b5772f173de1df1975b Mon Sep 17 00:00:00 2001
From: Ross <xkjq@ymail.com>
Date: Mon, 8 Dec 2025 11:18:47 +0000
Subject: [PATCH] .

---
 generic/views.py | 62 +++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 59 insertions(+), 3 deletions(-)

diff --git a/generic/views.py b/generic/views.py
index a85b56ef..d9c7db91 100644
--- a/generic/views.py
+++ b/generic/views.py
@@ -6132,10 +6132,35 @@ def exam_search_widget(request):
                     rqs = m.objects.none()
             for o in rqs:
                 results.append(o)
-        # Render combined results
+        # Render combined results, but restrict to exams the user can access
+        def user_can_view_exam(exam, user):
+            try:
+                if user.is_superuser:
+                    return True
+            except Exception:
+                pass
+            try:
+                if exam.open_access:
+                    return True
+            except Exception:
+                pass
+            try:
+                authors = exam.get_author_objects()
+                if user in authors:
+                    return True
+            except Exception:
+                pass
+            try:
+                if hasattr(exam, "markers") and user in exam.markers.all():
+                    return True
+            except Exception:
+                pass
+            return False
+
         rendered_results = []
         for o in results[:50]:
-            rendered_results.append({"id": getattr(o, "pk", None), "text": str(o)})
+            if user_can_view_exam(o, request.user):
+                rendered_results.append({"id": getattr(o, "pk", None), "text": str(o)})
         return render(request, "generic/partials/exam_search_widget_results.html", {"results": rendered_results, "field": field, "q": q_raw})
 
     # Limit results
@@ -6145,9 +6170,40 @@ def exam_search_widget(request):
     except Exception:
         qs = qs[:limit]
 
+    # Restrict results to exams the requesting user can access
+    def user_can_view_exam(exam, user):
+        try:
+            if user.is_superuser:
+                return True
+        except Exception:
+            pass
+        try:
+            if getattr(exam, "open_access", False) and getattr(exam, "active", False):
+                return True
+        except Exception:
+            pass
+        try:
+            authors = exam.get_author_objects()
+            if user in authors:
+                return True
+        except Exception:
+            pass
+        try:
+            if hasattr(exam, "cid_user_exam") and exam.cid_user_exam.filter(user_user=user).exists():
+                return True
+        except Exception:
+            pass
+        try:
+            if hasattr(exam, "markers") and user in exam.markers.all():
+                return True
+        except Exception:
+            pass
+        return False
+
     results = []
     for e in qs:
-        results.append({"id": e.pk, "text": str(e)})
+        if user_can_view_exam(e, request.user):
+            results.append({"id": e.pk, "text": str(e)})
 
     return render(request, "generic/partials/exam_search_widget_results.html", {"results": results, "field": field, "q": q_raw})