.

rapids/forms.py

@@ -83,7 +83,8 @@ class RapidForm(ModelForm):
         # Adding this javascript is crucial
         js = ["jsi18n.js", "tesseract.min.js"]
 
-    def __init__(self, *args, **kwargs):
+    def __init__(self, user, *args, **kwargs):
+        self.user = kwargs.pop('user')  # To get request.user. Do not use kwargs.pop('user', None) due to potential security hole
         if kwargs.get("instance"):
             # We get the 'initial' keyword argument or initialize it
             # as a dict if it didn't exist.
@@ -118,11 +119,10 @@ class RapidForm(ModelForm):
             choices=Rapid.LATERALITY_CHOICES, required=False, widget=RadioSelect()
         )
 
-        user = self.request.user
+        if self.user.groups.filter(name="rapid_checker").exists():
-        if user.groups.filter(name="rapid_checker").exists():
             return Exam.objects.all()
         
-        exam_queryset =  Exam.objects.filter(author__id=user.id)
+        exam_queryset =  Exam.objects.filter(author__id=self.user.id)
 
         self.fields["exams"] = ModelMultipleChoiceField(
             required=False,

rapids/views.py

@@ -270,6 +270,12 @@ class RapidCreateBase(LoginRequiredMixin, CreateView):
     model = Rapid
     form_class = RapidForm
 
+    # Sending user object to the form, to verify which fields to display/remove (depending on group)
+    def get_form_kwargs(self):
+        kwargs = super(RapidCreateBase, self).get_form_kwargs()
+        kwargs.update({'user': self.request.user})
+        return kwargs
+
     def get_context_data(self, **kwargs):
         context = super(RapidCreateBase, self).get_context_data(**kwargs)
         if self.request.POST: