CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Fix permission for access to root event resource

Browse Source
This commit is contained in:
Raphael Michel
2018-09-27 10:01:57 +02:00
parent 6e53990845
commit 0369deb72d
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/pretix/api/auth/permission.py
View File

@@ -75,7 +75,7 @@ class EventCRUDPermission(EventPermission):
return False return False
elif view.action == 'destroy' and 'can_change_event_settings' not in request.eventpermset: elif view.action == 'destroy' and 'can_change_event_settings' not in request.eventpermset:
return False return False
elif view.action in ['retrieve', 'update', 'partial_update'] \ elif view.action in ['update', 'partial_update'] \
and 'can_change_event_settings' not in request.eventpermset: and 'can_change_event_settings' not in request.eventpermset:
return False return False

1
src/tests/api/test_permissions.py
View File

@@ -6,6 +6,7 @@ from django.test import override_settings
from pretix.base.models import Organizer from pretix.base.models import Organizer
event_urls = [ event_urls = [
(None, ''),
(None, 'categories/'), (None, 'categories/'),
('can_view_orders', 'invoices/'), ('can_view_orders', 'invoices/'),
(None, 'items/'), (None, 'items/'),