.

rapids/forms.py

@@ -83,7 +83,8 @@ class RapidForm(ModelForm):
         # Adding this javascript is crucial
         js = ["jsi18n.js", "tesseract.min.js"]
 
-    def __init__(self, *args, **kwargs):
+    def __init__(self, user, *args, **kwargs):
+        self.user = kwargs.pop('user')  # To get request.user. Do not use kwargs.pop('user', None) due to potential security hole
         if kwargs.get("instance"):
             # We get the 'initial' keyword argument or initialize it
             # as a dict if it didn't exist.
@@ -118,11 +119,10 @@ class RapidForm(ModelForm):
             choices=Rapid.LATERALITY_CHOICES, required=False, widget=RadioSelect()
         )
 
-        user = self.request.user
-        if user.groups.filter(name="rapid_checker").exists():
+        if self.user.groups.filter(name="rapid_checker").exists():
             return Exam.objects.all()
         
-        exam_queryset =  Exam.objects.filter(author__id=user.id)
+        exam_queryset =  Exam.objects.filter(author__id=self.user.id)
 
         self.fields["exams"] = ModelMultipleChoiceField(
             required=False,