Fixed problems with middleware order

src/pretix/base/middleware.py

@@ -24,6 +24,9 @@ class LocaleMiddleware:
 
     def process_request(self, request: HttpRequest):
         language = get_language_from_request(request)
+        # Normally, this middleware runs *before* the event is set. However, on event frontend pages it
+        # might be run a second time by pretix.presale.EventMiddleware and in this case the event is already
+        # set and can be taken into account for the decision.
         if hasattr(request, 'event') and not request.path.startswith(get_script_prefix() + 'control'):
             if language not in request.event.settings.locales:
                 firstpart = language.split('-')[0]

src/pretix/presale/middleware.py

@@ -6,6 +6,7 @@ from django.http import Http404
 from django.shortcuts import redirect
 from django.utils.translation import ugettext_lazy as _
 
+from pretix.base.middleware import LocaleMiddleware
 from pretix.base.models import Event, EventPermission, Organizer
 from pretix.multidomain.urlreverse import get_domain
 
@@ -55,10 +56,14 @@ class EventMiddleware:
                         path = request.get_full_path().split("/", 2)[-1]
                         return redirect(urljoin('%s://%s' % (request.scheme, domain), path))
 
-                if hasattr(request, 'event') and not request.event.live:
+                if hasattr(request, 'event'):
-                    if not request.user.is_authenticated() or not EventPermission.objects.filter(
+                    # Restrict locales to the ones available for this event
-                            event=request.event, user=request.user).exists():
+                    LocaleMiddleware().process_request(request)
-                        raise PermissionDenied(_('The selected ticket shop is currently not available.'))
+
+                    if not request.event.live:
+                        if not request.user.is_authenticated() or not EventPermission.objects.filter(
+                                event=request.event, user=request.user).exists():
+                            raise PermissionDenied(_('The selected ticket shop is currently not available.'))
 
             except IndexError:
                 raise Http404(_('The selected event or organizer was not found.'))

src/pretix/settings.py

@@ -188,8 +188,8 @@ MIDDLEWARE_CLASSES = [
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'pretix.control.middleware.PermissionMiddleware',
-    'pretix.presale.middleware.EventMiddleware',
     'pretix.base.middleware.LocaleMiddleware',
+    'pretix.presale.middleware.EventMiddleware',
     'pretix.base.middleware.SecurityMiddleware',
 ]