From 1521c0cfcd0a28ee456d0ce878f17f080d4529fa Mon Sep 17 00:00:00 2001 From: luelista Date: Tue, 23 Jun 2026 18:34:31 +0200 Subject: [PATCH] Fix URL matching in EventQRCode (Z#23237781) (#6304) --- src/pretix/control/views/event.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/pretix/control/views/event.py b/src/pretix/control/views/event.py index 322c0761c..7ff3aa8bd 100644 --- a/src/pretix/control/views/event.py +++ b/src/pretix/control/views/event.py @@ -41,7 +41,7 @@ from collections import OrderedDict, defaultdict from decimal import Decimal from io import BytesIO from itertools import groupby -from urllib.parse import urlparse, urlsplit +from urllib.parse import urlsplit from zoneinfo import ZoneInfo import bleach @@ -64,7 +64,6 @@ from django.shortcuts import get_object_or_404, redirect from django.urls import NoReverseMatch, reverse from django.utils.functional import cached_property from django.utils.html import conditional_escape, format_html -from django.utils.http import url_has_allowed_host_and_scheme from django.utils.safestring import mark_safe from django.utils.timezone import now from django.utils.translation import gettext, gettext_lazy as _, gettext_noop @@ -1742,7 +1741,7 @@ class EventQRCode(EventPermissionRequiredMixin, View): url = eventreverse_absolute(request.event, 'presale:event.index') if "url" in request.GET: - if url_has_allowed_host_and_scheme(request.GET["url"], allowed_hosts=[urlparse(url).netloc]): + if request.GET["url"].startswith(url): url = request.GET["url"] else: raise PermissionDenied("Untrusted URL")