Order changing permissions, list of ordered items

src/pretix/base/migrations/0021_auto_20150320_1622.py

@@ -0,0 +1,30 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.db import models, migrations
+import django.core.validators
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0020_auto_20150319_1044'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='eventpermission',
+            name='can_change_orders',
+            field=models.BooleanField(default=True, verbose_name='Can change orders'),
+        ),
+        migrations.AddField(
+            model_name='eventpermission',
+            name='can_view_orders',
+            field=models.BooleanField(default=True, verbose_name='Can view orders'),
+        ),
+        migrations.AlterField(
+            model_name='event',
+            name='slug',
+            field=models.SlugField(verbose_name='Slug', validators=[django.core.validators.RegexValidator(message='The slug may only contain letters, numbers, dots and dashes.', regex='^[a-zA-Z0-9.-]+$')], help_text='Should be short, only contain lowercase letters and numbers, and must be unique among your events. This is being used in addresses and bank transfer references.'),
+        ),
+    ]

src/pretix/base/models.py

@@ -535,6 +535,10 @@ class EventPermission(Versionable):
     :type can_change_settings: bool
     :param can_change_items: If ``True``, the user can change and add items and related objects for this event.
     :type can_change_items: bool
+    :param can_view_orders: If ``True``, the user can inspect details of all orders.
+    :type can_view_orders: bool
+    :param can_change_orders: If ``True``, the user can change details of orders
+    :type can_change_orders: bool
     """
 
     event = VersionedForeignKey(Event)
@@ -547,6 +551,14 @@ class EventPermission(Versionable):
         default=True,
         verbose_name=_("Can change product settings")
     )
+    can_view_orders = models.BooleanField(
+        default=True,
+        verbose_name=_("Can view orders")
+    )
+    can_change_orders = models.BooleanField(
+        default=True,
+        verbose_name=_("Can change orders")
+    )
 
     class Meta:
         verbose_name = _("Event permission")