diff --git a/generic/views.py b/generic/views.py index 43cae551..fc1de060 100644 --- a/generic/views.py +++ b/generic/views.py @@ -559,10 +559,12 @@ class ExamViews(View, LoginRequiredMixin): }, ) - @method_decorator(user_is_cid_user_manager) def exam_cids(self, request, exam_id): exam = get_object_or_404(self.Exam, pk=exam_id) + if not request.user.groups.filter(name="cid_user_manager").exists(): + raise PermissionDenied + if request.user not in exam.author.all(): if not self.check_user_access(request.user, exam_id): raise PermissionDenied