From 396c558b25d5b985076e2bea1d308dbfa8203927 Mon Sep 17 00:00:00 2001
From: Raphael Michel <mail@raphaelmichel.de>
Date: Wed, 17 May 2017 15:47:06 +0200
Subject: [PATCH] Fix critical bug in item creation

---
 src/pretix/control/forms/item.py | 19 +++++++++++++++++--
 src/pretix/control/views/item.py | 14 +-------------
 2 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/src/pretix/control/forms/item.py b/src/pretix/control/forms/item.py
index cbb3d33d4..31d629be8 100644
--- a/src/pretix/control/forms/item.py
+++ b/src/pretix/control/forms/item.py
@@ -2,6 +2,7 @@ import copy
 
 from django import forms
 from django.core.exceptions import ValidationError
+from django.db.models import Max
 from django.forms import BooleanField, ModelMultipleChoiceField
 from django.forms.formsets import DELETION_FIELD_NAME
 from django.utils.translation import ugettext as __, ugettext_lazy as _
@@ -120,7 +121,20 @@ class ItemCreateForm(I18nModelForm):
         )
 
     def save(self, *args, **kwargs):
+        if self.cleaned_data.get('copy_from'):
+            self.instance.description = self.cleaned_data['copy_from'].description
+            self.instance.active = self.cleaned_data['copy_from'].active
+            self.instance.available_from = self.cleaned_data['copy_from'].available_from
+            self.instance.available_until = self.cleaned_data['copy_from'].available_until
+            self.instance.require_voucher = self.cleaned_data['copy_from'].require_voucher
+            self.instance.hide_without_voucher = self.cleaned_data['copy_from'].hide_without_voucher
+            self.instance.allow_cancel = self.cleaned_data['copy_from'].allow_cancel
+            self.instance.min_per_order = self.cleaned_data['copy_from'].min_per_order
+            self.instance.max_per_order = self.cleaned_data['copy_from'].max_per_order
+            self.instance.position = (self.event.items.aggregate(p=Max('position'))['p'] or 0) + 1
+
         instance = super().save(*args, **kwargs)
+
         if self.cleaned_data.get('has_variations'):
             if self.cleaned_data.get('copy_from') and self.cleaned_data.get('copy_from').has_variations:
                 for variation in self.cleaned_data['copy_from'].variations.all():
@@ -131,8 +145,9 @@ class ItemCreateForm(I18nModelForm):
                     item=instance, value=__('Standard')
                 )
 
-        for question in Question.objects.filter(items=self.cleaned_data.get('copy_from')):
-            question.items.add(instance)
+        if self.cleaned_data.get('copy_from'):
+            for question in self.cleaned_data['copy_from'].questions.all():
+                question.items.add(instance)
 
         return instance
 
diff --git a/src/pretix/control/views/item.py b/src/pretix/control/views/item.py
index 03385015c..835a38fde 100644
--- a/src/pretix/control/views/item.py
+++ b/src/pretix/control/views/item.py
@@ -4,7 +4,7 @@ from django.contrib import messages
 from django.core.files import File
 from django.core.urlresolvers import resolve, reverse
 from django.db import transaction
-from django.db.models import Count, F, Max, Q
+from django.db.models import Count, F, Q
 from django.forms.models import ModelMultipleChoiceField, inlineformset_factory
 from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import redirect
@@ -792,18 +792,6 @@ class ItemCreate(EventPermissionRequiredMixin, CreateView):
     @transaction.atomic
     def form_valid(self, form):
         messages.success(self.request, _('Your changes have been saved.'))
-        if form.cleaned_data['copy_from']:
-            form.instance.description = form.cleaned_data['copy_from'].description
-            form.instance.active = form.cleaned_data['copy_from'].active
-            form.instance.available_from = form.cleaned_data['copy_from'].available_from
-            form.instance.available_until = form.cleaned_data['copy_from'].available_until
-            form.instance.require_voucher = form.cleaned_data['copy_from'].require_voucher
-            form.instance.hide_without_voucher = form.cleaned_data['copy_from'].hide_without_voucher
-            form.instance.allow_cancel = form.cleaned_data['copy_from'].allow_cancel
-            form.instance.min_per_order = form.cleaned_data['copy_from'].min_per_order
-            form.instance.max_per_order = form.cleaned_data['copy_from'].max_per_order
-
-        form.instance.position = (self.request.event.items.aggregate(p=Max('position'))['p'] or 0) + 1
 
         ret = super().form_valid(form)
         form.instance.log_action('pretix.event.item.added', user=self.request.user, data={