diff --git a/lib/questionlib.php b/lib/questionlib.php
index 6ae69e4b78a..dc3805ff8f6 100644
--- a/lib/questionlib.php
+++ b/lib/questionlib.php
@@ -1225,12 +1225,13 @@ function get_question_states(&$questions, $cmoptions, $attempt, $lastattemptid =
  * @global object
  * @param array $question The question to load the state for.
  * @param object $cmoptions Options from the specifica activity module, e.g. $quiz.
- * @param object $attempt The attempt for which the question sessions are to be loaded.
+ * @param integer $attemptid The question_attempts this is part of.
  * @param integer $stateid The id of a specific state of this question.
  * @return object the requested state. False on error.
  */
-function question_load_specific_state($question, $cmoptions, $attempt, $stateid) {
+function question_load_specific_state($question, $cmoptions, $attemptid, $stateid) {
     global $DB;
+
     // Load specified states for the question.
     // sess.sumpenalty is probably wrong here shoul really be a sum of penalties from before the one we are asking for.
     $sql = 'SELECT st.*, sess.sumpenalty, sess.manualcomment, sess.manualcommentformat,
@@ -1241,7 +1242,7 @@ function question_load_specific_state($question, $cmoptions, $attempt, $stateid)
                AND sess.attemptid = st.attempt
                AND st.question = ?
                AND sess.questionid = st.question';
-    $state = $DB->get_record_sql($sql, array($stateid, $attempt->id, $question->id));
+    $state = $DB->get_record_sql($sql, array($stateid, $attemptid, $question->id));
     if (!$state) {
         return false;
     }
@@ -1258,7 +1259,7 @@ function question_load_specific_state($question, $cmoptions, $attempt, $stateid)
                AND sess.questionid = st.question
                AND st.event IN ('.QUESTION_EVENTS_GRADED.') '.
            'ORDER BY st.seq_number DESC';
-    $gradedstates = $DB->get_records_sql($sql, array($state->seq_number, $attempt->id, $question->id), 0, 1);
+    $gradedstates = $DB->get_records_sql($sql, array($state->seq_number, $attemptid, $question->id), 0, 1);
     if (empty($gradedstates)) {
         $state->last_graded = clone($state);
     } else {
@@ -1534,7 +1535,7 @@ function regrade_question_in_attempt($question, $attempt, $cmoptions, $verbose=f
         $attempt->sumgrades -= $states[count($states)-1]->grade;
 
         // Initialise the replaystate
-        $replaystate = question_load_specific_state($question, $cmoptions, $attempt, $states[0]->id);
+        $replaystate = question_load_specific_state($question, $cmoptions, $attempt->uniqueid, $states[0]->id);
         $replaystate->sumpenalty = 0;
         $replaystate->last_graded->sumpenalty = 0;
 
diff --git a/mod/quiz/attemptlib.php b/mod/quiz/attemptlib.php
index 7580482a41d..caff90452c0 100644
--- a/mod/quiz/attemptlib.php
+++ b/mod/quiz/attemptlib.php
@@ -536,7 +536,7 @@ class quiz_attempt extends quiz {
     public function load_specific_question_state($questionid, $stateid) {
         global $DB;
         $state = question_load_specific_state($this->questions[$questionid],
-                $this->quiz, $this->attempt, $stateid);
+                $this->quiz, $this->attempt->uniqueid, $stateid);
         if ($state === false) {
             throw new moodle_quiz_exception($this, 'invalidstateid');
         }
diff --git a/mod/quiz/reviewquestion.php b/mod/quiz/reviewquestion.php
index ec13e04d41a..48d87edecb5 100644
--- a/mod/quiz/reviewquestion.php
+++ b/mod/quiz/reviewquestion.php
@@ -20,6 +20,7 @@
         $url->param('state', $stateid);
     }
     $PAGE->set_url($url);
+    $PAGE->set_pagelayout('popup');
 
     $attemptobj = quiz_attempt::create($attemptid);
 
@@ -27,23 +28,37 @@
     require_login($attemptobj->get_courseid(), false, $attemptobj->get_cm());
     $attemptobj->check_review_capability();
 
+/// Create an object to manage all the other (non-roles) access rules.
+    $accessmanager = $attemptobj->get_access_manager(time());
+    $options = $attemptobj->get_review_options();
+
 /// Permissions checks for normal users who do not have quiz:viewreports capability.
     if (!$attemptobj->has_capability('mod/quiz:viewreports')) {
     /// Can't review during the attempt - send them back to the attempt page.
         if (!$attemptobj->is_finished()) {
+            echo $OUTPUT->header();
             echo $OUTPUT->notification(get_string('cannotreviewopen', 'quiz'));
             echo $OUTPUT->close_window_button();
+            echo $OUTPUT->footer();
+            die;
         }
     /// Can't review other users' attempts.
         if (!$attemptobj->is_own_attempt()) {
+            echo $OUTPUT->header();
             echo $OUTPUT->notification(get_string('notyourattempt', 'quiz'));
             echo $OUTPUT->close_window_button();
+            echo $OUTPUT->footer();
+            die;
         }
+
     /// Can't review unless Students may review -> Responses option is turned on.
         if (!$options->responses) {
             $accessmanager = $attemptobj->get_access_manager(time());
+            echo $OUTPUT->header();
             echo $OUTPUT->notification($accessmanager->cannot_review_message($attemptobj->get_review_options()));
             echo $OUTPUT->close_window_button();
+            echo $OUTPUT->footer();
+            die;
         }
     }
 
diff --git a/question/type/questiontype.php b/question/type/questiontype.php
index 5aaf4d323d8..1b03478a335 100644
--- a/question/type/questiontype.php
+++ b/question/type/questiontype.php
@@ -1087,12 +1087,11 @@ class default_questiontype {
             return '';
         }
 
-        $params = array('aid' => $state->attempt);
         if (isset($question->randomquestionid)) {
-            $params['qid'] = $question->randomquestionid;
+            $actualquestionid = $question->randomquestionid;
             $randomprefix = 'random' . $question->id . '-';
         } else {
-            $params['qid'] = $question->id;
+            $actualquestionid = $question->id;
             $randomprefix = '';
         }
         if ($options->history == 'all') {
@@ -1101,7 +1100,8 @@ class default_questiontype {
             $eventtest = 'event IN (' . QUESTION_EVENTS_GRADED . ')';
         }
         $states = $DB->get_records_select('question_states',
-                'attempt = :aid AND question = :qid AND ' . $eventtest, $params, 'seq_number ASC');
+                'attempt = :aid AND question = :qid AND ' . $eventtest,
+                array('aid' => $state->attempt, 'qid' => $actualquestionid), 'seq_number,id');
         if (count($states) <= 1) {
             return '';
         }
@@ -1131,7 +1131,7 @@ class default_questiontype {
                 $link = '<b>' . $st->seq_number . '</b>';
             } else if (isset($options->questionreviewlink)) {
                 $reviewlink = new moodle_url($options->questionreviewlink);
-                $reviewlink->params(array('state'=>$st->id,'question'=>$question->id));
+                $reviewlink->params(array('state' => $st->id,'question' => $actualquestionid));
                 $link = new moodle_url($reviewlink);
                 $action = new popup_action('click', $link, 'reviewquestion', array('height' => 450, 'width' => 650));
                 $link = $OUTPUT->action_link($link, $st->seq_number, $action, array('title'=>$strreviewquestion));