tutors can now only access participants from their groups again.

core/tests/test_student_reviewer_viewset.py

@@ -93,10 +93,10 @@ class StudentPageTests(APITestCase):
         self.assertEqual(3, len(self.rev_response.data))
 
     @override_config(EXERCISE_MODE=True)
-    def test_tutor_can_only_see_students_when_in_exercise_mode(self):
+    def test_tutor_can_only_see_group_members_when_in_exercise_mode(self):
         force_authenticate(self.request, user=self.tutor)
         response = self.view(self.request)
-        self.assertEqual(3, len(response.data))
+        self.assertEqual(2, len(response.data))
 
     def test_submissions_score_is_included(self):
         res_with_sub = None

core/views/common_views.py

@@ -82,7 +82,10 @@ class StudentReviewerApiViewSet(viewsets.ReadOnlyModelViewSet):
             return queryset
 
         elif self.request.user.is_tutor() and config.EXERCISE_MODE:
-            return queryset
+            return queryset.filter(
+                user__exercise_groups__in=self.request.user.exercise_groups.all()
+            )
+
 
         else:
             return []