.

generic/views.py

@@ -6132,9 +6132,34 @@ def exam_search_widget(request):
                     rqs = m.objects.none()
             for o in rqs:
                 results.append(o)
-        # Render combined results
+        # Render combined results, but restrict to exams the user can access
+        def user_can_view_exam(exam, user):
+            try:
+                if user.is_superuser:
+                    return True
+            except Exception:
+                pass
+            try:
+                if exam.open_access:
+                    return True
+            except Exception:
+                pass
+            try:
+                authors = exam.get_author_objects()
+                if user in authors:
+                    return True
+            except Exception:
+                pass
+            try:
+                if hasattr(exam, "markers") and user in exam.markers.all():
+                    return True
+            except Exception:
+                pass
+            return False
+
         rendered_results = []
         for o in results[:50]:
+            if user_can_view_exam(o, request.user):
                 rendered_results.append({"id": getattr(o, "pk", None), "text": str(o)})
         return render(request, "generic/partials/exam_search_widget_results.html", {"results": rendered_results, "field": field, "q": q_raw})
 
@@ -6145,8 +6170,39 @@ def exam_search_widget(request):
     except Exception:
         qs = qs[:limit]
 
+    # Restrict results to exams the requesting user can access
+    def user_can_view_exam(exam, user):
+        try:
+            if user.is_superuser:
+                return True
+        except Exception:
+            pass
+        try:
+            if getattr(exam, "open_access", False) and getattr(exam, "active", False):
+                return True
+        except Exception:
+            pass
+        try:
+            authors = exam.get_author_objects()
+            if user in authors:
+                return True
+        except Exception:
+            pass
+        try:
+            if hasattr(exam, "cid_user_exam") and exam.cid_user_exam.filter(user_user=user).exists():
+                return True
+        except Exception:
+            pass
+        try:
+            if hasattr(exam, "markers") and user in exam.markers.all():
+                return True
+        except Exception:
+            pass
+        return False
+
     results = []
     for e in qs:
+        if user_can_view_exam(e, request.user):
             results.append({"id": e.pk, "text": str(e)})
 
     return render(request, "generic/partials/exam_search_widget_results.html", {"results": results, "field": field, "q": q_raw})