fix

Main/models/userinfo.py

@@ -1,6 +1,6 @@
 from functools import cached_property
 
-from django.contrib.auth.models import User, Group
+from django.contrib.auth.models import User
 from django.db import models
 from django.db.models import Q
 from django.utils import timezone

Main/views/MainView.py

@@ -30,3 +30,7 @@ class MainView(BaseView):
         new_tasks = set(Task.objects.filter(public=True)) - set(all_tasks)
         self.context['new_tasks'] = sample(new_tasks, k=min(5, len(new_tasks)))
         self.context['groups'] = Group.objects.filter(Q(editors__in=self.request.user.username) | Q(creator=self.request.user) | Q(users=self.request.user)).distinct()
+
+    def post(self):
+        group = Group.objects.create(name=self.request.POST['name'], creator=self.request.user)
+        return '/group?group_id=' + str(group.id)

Main/views/TaskView.py

@@ -2,7 +2,7 @@ import io
 from zipfile import ZipFile
 
 from Main.models import Solution, Progress, SolutionFile
-from SprintLib.BaseView import BaseView
+from SprintLib.BaseView import BaseView, AccessError
 from SprintLib.queue import send_testing
 from SprintLib.utils import write_bytes
 
@@ -23,6 +23,9 @@ class TaskView(BaseView):
         if hasattr(self.entities, 'setTask'):
             self.entities.add('task', self.entities.setTask.task)
             self.entities.add('set', self.entities.setTask.set)
+        else:
+            if not self.entities.task.public and not self.entities.task.creator == self.request.user and not self.request.user.username in self.entities.task.editors:
+                raise AccessError()
         if self.request.method == "GET":
             return
         self.solution = Solution.objects.create(