fix: for real now 💀

backend/api/permissions/submission_permissions.py

@@ -42,7 +42,7 @@ def has_permission(self, request: Request, view: APIView) -> bool:
         return True
 
     def has_object_permission(self, request: Request, view: APIView, submission: Submission) -> bool:
-        if is_student(request.user) and submission.group.students.contains(request.user):
+        if is_student(request.user) and submission.group.students.filter(id=request.user.id):
             return True
 
         if is_teacher(request.user) or is_assistant(request.user):