From f9c57de929ef2e6bcfbeeac036e24426a788ee7c Mon Sep 17 00:00:00 2001 From: Ross Date: Fri, 7 Jan 2022 12:01:15 +0000 Subject: [PATCH] . --- generic/views.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/generic/views.py b/generic/views.py index 43cae551..fc1de060 100644 --- a/generic/views.py +++ b/generic/views.py @@ -559,10 +559,12 @@ class ExamViews(View, LoginRequiredMixin): }, ) - @method_decorator(user_is_cid_user_manager) def exam_cids(self, request, exam_id): exam = get_object_or_404(self.Exam, pk=exam_id) + if not request.user.groups.filter(name="cid_user_manager").exists(): + raise PermissionDenied + if request.user not in exam.author.all(): if not self.check_user_access(request.user, exam_id): raise PermissionDenied