diff --git a/server.py b/server.py
index f596486..75359a1 100644
--- a/server.py
+++ b/server.py
@@ -15,9 +15,9 @@ import db_classes
 import timeout as tmo
 
 # Simple config
-GET_ONLY_FOR_VIP = True
+GET_ONLY_FOR_VIP = False
 POST_ONLY_FOR_VIP = True
-VERSION = "20240503.1"
+VERSION = "20240503.2"
 
 CHARSET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
 
@@ -141,6 +141,8 @@ def parse_request(r):
         rtype = results['type']
         test_id = results['id']
         user_id = results['uid']
+        stud_id = results['sid']
+        data = db.read(f"tests.{test_id}", None)
         blacklist = db.read('users.blacklist', set())
         vip = db.read('users.vip', set())
         if user_id not in vip and POST_ONLY_FOR_VIP:
@@ -149,6 +151,16 @@ def parse_request(r):
             return 403
         match rtype:
             case "test_results":
+                if 'access' in data:
+                    if len(data['access']) > 0:
+                        if f"{user_id}{stud_id}" in data['access']:
+                            pass
+                        elif user_id in data['access']:
+                            data['access'].remove(user_id)
+                            data['access'].append(f"{user_id}{stud_id}")
+                            db.write(f"tests.{test_id}", data)
+                        else:
+                            return 403
                 answers = results['answers']
                 all_answ = int(results['all'])
                 while len(answers) != all_answ:
@@ -281,6 +293,33 @@ class S(BaseHTTPRequestHandler):
                     self.send_header('Content-Length', len(data))
                     self.end_headers()
                     self.wfile.write(data)
+            case "/add_access":
+                user = parameters.get('uid', "")
+                target_user = parameters.get('tuid', "")
+                test_id = parameters.get('test', "")
+                if user not in db.read('users.vip'):
+                    self._set_response(403)
+                    self.end_headers()
+                    self.wfile.write("403 Forbidden".encode('utf-8'))
+                    return
+                if len(target_user) != 36:
+                    self._set_response(400)
+                    self.end_headers()
+                    self.wfile.write("400 Bad request".encode('utf-8'))
+                    return
+                data = db.read(f'tests.{test_id}', None)
+                if data is None:
+                    self._set_response(400)
+                    self.end_headers()
+                    self.wfile.write("400 Bad request".encode('utf-8'))
+                    return
+                if 'access' not in data:
+                    data['access'] = []
+                data['access'].append(target_user)
+                db.write(f'tests.{test_id}', data)
+                self._set_response(200)
+                self.end_headers()
+                self.wfile.write("200 OK".encode('utf-8'))
             case _:
                 db_path = 'tests.' + '.'.join(self_path[1:].split('/'))
                 data = db.read(db_path, None)
@@ -301,8 +340,8 @@ class S(BaseHTTPRequestHandler):
                         if f"{user}{stud}" in data['access']:
                             pass
                         elif user in data['access']:
-                            data.remove(user)
-                            data.append(f"{user}{stud}")
+                            data['access'].remove(user)
+                            data['access'].append(f"{user}{stud}")
                             db.write(db_path, data)
                         else:
                             self._set_response(403)
diff --git a/user.js b/user.js
index 4ba3e66..7d8bf4d 100644
--- a/user.js
+++ b/user.js
@@ -2,7 +2,7 @@
 // @name           Sorryops
 // @name:ru        Сориупс
 // @namespace      https://git.disroot.org/electromagneticcyclone/sorryops
-// @version        20240503.1
+// @version        20240503.2
 // @description    Collect and reuse ORIOKS test answers
 // @description:ru Скрипт для сбора и переиспользования ответов на тесты ОРИОКС
 // @icon           https://sorryops.ru/favicon.ico
@@ -20,12 +20,12 @@
 // @require        https://openuserjs.org/src/libs/sizzle/GM_config.js
 // @connect        sorryops.ru
 // @run-at         document-start
-// @downloadURL https://update.greasyfork.org/scripts/481036/Sorryops.user.js
-// @updateURL https://update.greasyfork.org/scripts/481036/Sorryops.meta.js
+// @downloadURL    https://update.greasyfork.org/scripts/481036/Sorryops.user.js
+// @updateURL      https://update.greasyfork.org/scripts/481036/Sorryops.meta.js
 // ==/UserScript==
 
 /* Version */
-const VERSION = "20240503.1";
+const VERSION = "20240503.2";
 /* End Version */
 
 /* Charset */
@@ -299,7 +299,7 @@ function send_to_server(results) {
 function fetch_from_server(path, func) {
     var server = config.get('server');
     var fetched_data = GM_getValue('fetched_data');
-    if (fetched_data == undefined) {
+    if ((fetched_data == undefined) || (fetched_data.forbidden == true)) {
         fetched_data = {};
     }
     if ((server != '') && (Object.keys(fetched_data).length == 0)) {
@@ -313,6 +313,11 @@ function fetch_from_server(path, func) {
                     fetched_data = {version: VERSION};
                     GM_setValue('fetched_data', fetched_data);
                     func(fetched_data);
+                } else if (response.status == 403) {
+                    fetched_data = {version: VERSION, forbidden: true};
+                    forbidden = true;
+                    GM_setValue('fetched_data', fetched_data);
+                    func(fetched_data);
                 } else if (!text.includes("{")) {
                     func({});
                 } else {
@@ -387,6 +392,7 @@ var answers = [];
 var sorted_objects_value = [];
 var variant, hash, type, correct, incorrect, version;
 var student_name = "";
+var forbidden = false;
 var prev_new_answer_f = false;
 var new_answer_f = false;
 var testID = (() => {
@@ -543,6 +549,8 @@ function update_variant() {
         } else {
             status = "<span style='color: red;'>Нет соединения</span>";
         }
+    } else if (forbidden) {
+        status = "<span style='color: red;'>Доступ запрещён</span>";
     } else if (chosen_answer == correct) {
         status = "<span style='color: green;'>Верно</span>";
         new_answer_f = false;