Don't show "Review this attempt" when review is not allowed

Somehow, the logic about showing the "Review this attempt" button on the
student's attempts listing disappeared, allowing them to review attempts
before the "allow review from" date.

This commit also makes the RunAttemptView throw a "permission denied"
error when a student tries to review an attempt but it's not allowed.

Author: christianp

numbas_lti/templates/numbas_lti/show_attempts.html

@@ -87,9 +87,11 @@ <h1>
                     </td>
                     <td>
                         {% if attempt.completed %}
+                            {% if review_allowed %}
                             <a title="{% blocktranslate with start_time=attempt.start_time %}Review attempt started at {{start_time}}{% endblocktranslate %}" class="button info" href="{% url_with_lti 'run_attempt' pk=attempt.pk %}">
                                 {% icon 'play' %} {% translate "Review this attempt" %}
                             </a>
+                            {% endif %}
 
                             {% if attempt.student_can_reopen %}
                             <form action="{% url_with_lti 'reopen_attempt' attempt.pk %}" method="POST">

numbas_lti/views/attempt.py

@@ -269,6 +269,8 @@ def get_mode(self):
                 raise PermissionDenied(gettext("You're not allowed to review this attempt."))
 
         if attempt.completed():
+            if not attempt.review_allowed():
+                raise PermissionDenied(gettext("You're not allowed to review this attempt."))
             return 'review'
         else:
             return 'normal'