Install django-scopes

src/pretix/base/models/checkin.py

@@ -3,6 +3,7 @@ from django.db.models import Case, Count, F, OuterRef, Q, Subquery, When
 from django.db.models.functions import Coalesce
 from django.utils.timezone import now
 from django.utils.translation import pgettext_lazy, ugettext_lazy as _
+from django_scopes import ScopedManager
 
 from pretix.base.models import LoggedModel
 
@@ -20,6 +21,8 @@ class CheckinList(LoggedModel):
                                                       'order have not been paid. This only works with pretixdesk '
                                                       '0.3.0 or newer or pretixdroid 1.9 or newer.'))
 
+    objects = ScopedManager(organizer='event__organizer')
+
     class Meta:
         ordering = ('subevent__date_from', 'name')
 
@@ -167,6 +170,8 @@ class Checkin(models.Model):
         'pretixbase.CheckinList', related_name='checkins', on_delete=models.PROTECT,
     )
 
+    objects = ScopedManager(organizer='position__order__event__organizer')
+
     class Meta:
         unique_together = (('list', 'position'),)
 

src/pretix/base/models/devices.py

@@ -4,6 +4,7 @@ from django.db import models
 from django.db.models import Max
 from django.utils.crypto import get_random_string
 from django.utils.translation import ugettext_lazy as _
+from django_scopes import ScopedManager
 
 from pretix.base.models import LoggedModel
 
@@ -71,6 +72,8 @@ class Device(LoggedModel):
         null=True, blank=True
     )
 
+    objects = ScopedManager(organizer='organizer')
+
     class Meta:
         unique_together = (('organizer', 'device_id'),)
 

src/pretix/base/models/event.py

@@ -2,6 +2,7 @@ import string
 import uuid
 from collections import OrderedDict
 from datetime import datetime, time, timedelta
+from django_scopes import ScopedManager
 from operator import attrgetter
 
 import pytz
@@ -336,6 +337,8 @@ class Event(EventMixin, LoggedModel):
         default=False
     )
 
+    objects = ScopedManager(organizer='organizer')
+
     class Meta:
         verbose_name = _("Event")
         verbose_name_plural = _("Events")
@@ -875,6 +878,8 @@ class SubEvent(EventMixin, LoggedModel):
     items = models.ManyToManyField('Item', through='SubEventItem')
     variations = models.ManyToManyField('ItemVariation', through='SubEventItemVariation')
 
+    objects = ScopedManager(organizer='event__organizer')
+
     class Meta:
         verbose_name = _("Date in event series")
         verbose_name_plural = _("Dates in event series")

src/pretix/base/models/invoices.py

@@ -9,6 +9,7 @@ from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
 from django.utils.translation import pgettext
 from django_countries.fields import CountryField
+from django_scopes import ScopedManager
 
 
 def invoice_filename(instance, filename: str) -> str:
@@ -107,6 +108,8 @@ class Invoice(models.Model):
     file = models.FileField(null=True, blank=True, upload_to=invoice_filename, max_length=255)
     internal_reference = models.TextField(blank=True)
 
+    objects = ScopedManager(organizer='event__organizer')
+
     @staticmethod
     def _to_numeric_invoice_number(number):
         return '{:05d}'.format(int(number))

src/pretix/base/models/items.py

@@ -3,6 +3,7 @@ import uuid
 from collections import Counter
 from datetime import date, datetime, time
 from decimal import Decimal, DecimalException
+from django_scopes import ScopedManager
 from typing import Tuple
 
 import dateutil.parser
@@ -155,28 +156,41 @@ class SubEventItemVariation(models.Model):
             self.subevent.event.cache.clear()
 
 
-class ItemQuerySet(models.QuerySet):
-    def filter_available(self, channel='web', voucher=None, allow_addons=False):
-        q = (
-            # IMPORTANT: If this is updated, also update the ItemVariation query
-            # in models/event.py: EventMixin.annotated()
+def filter_available(qs, channel='web', voucher=None, allow_addons=False):
+    q = (
+        # IMPORTANT: If this is updated, also update the ItemVariation query
+        # in models/event.py: EventMixin.annotated()
             Q(active=True)
             & Q(Q(available_from__isnull=True) | Q(available_from__lte=now()))
             & Q(Q(available_until__isnull=True) | Q(available_until__gte=now()))
             & Q(sales_channels__contains=channel) & Q(require_bundling=False)
-        )
-        if not allow_addons:
-            q &= Q(Q(category__isnull=True) | Q(category__is_addon=False))
-        qs = self.filter(q)
+    )
+    if not allow_addons:
+        q &= Q(Q(category__isnull=True) | Q(category__is_addon=False))
+    qs = qs.filter(q)
 
-        vouchq = Q(hide_without_voucher=False)
-        if voucher:
-            if voucher.item_id:
-                vouchq |= Q(pk=voucher.item_id)
-                qs = qs.filter(pk=voucher.item_id)
-            elif voucher.quota_id:
-                qs = qs.filter(quotas__in=[voucher.quota_id])
-        return qs.filter(vouchq)
+    vouchq = Q(hide_without_voucher=False)
+    if voucher:
+        if voucher.item_id:
+            vouchq |= Q(pk=voucher.item_id)
+            qs = qs.filter(pk=voucher.item_id)
+        elif voucher.quota_id:
+            qs = qs.filter(quotas__in=[voucher.quota_id])
+    return qs.filter(vouchq)
+
+
+class ItemQuerySet(models.QuerySet):
+    def filter_available(self, channel='web', voucher=None, allow_addons=False):
+        return filter_available(self)
+
+
+class ItemQuerySetManager(ScopedManager(organizer='event__organizer').__class__):
+    def __init__(self):
+        super().__init__()
+        self._queryset_class = ItemQuerySet
+
+    def filter_available(self, channel='web', voucher=None, allow_addons=False):
+        return filter_available(self.get_queryset())
 
 
 class Item(LoggedModel):
@@ -226,7 +240,7 @@ class Item(LoggedModel):
     :type sales_channels: bool
     """
 
-    objects = ItemQuerySet.as_manager()
+    objects = ItemQuerySetManager()
 
     event = models.ForeignKey(
         Event,
@@ -377,6 +391,7 @@ class Item(LoggedModel):
     # !!! Attention: If you add new fields here, also add them to the copying code in
     # pretix/control/forms/item.py if applicable.
 
+
     class Meta:
         verbose_name = _("Product")
         verbose_name_plural = _("Products")
@@ -591,6 +606,8 @@ class ItemVariation(models.Model):
                     'discounted one. This is just a cosmetic setting and will not actually impact pricing.')
     )
 
+    objects = ScopedManager(organizer='item__event__organizer')
+
     class Meta:
         verbose_name = _("Product variation")
         verbose_name_plural = _("Product variations")
@@ -985,6 +1002,8 @@ class Question(LoggedModel):
     )
     dependency_value = models.TextField(null=True, blank=True)
 
+    objects = ScopedManager(organizer='event__organizer')
+
     class Meta:
         verbose_name = _("Question")
         verbose_name_plural = _("Questions")
@@ -1234,6 +1253,8 @@ class Quota(LoggedModel):
     cached_availability_paid_orders = models.PositiveIntegerField(null=True, blank=True)
     cached_availability_time = models.DateTimeField(null=True, blank=True)
 
+    objects = ScopedManager(organizer='event__organizer')
+
     class Meta:
         verbose_name = _("Quota")
         verbose_name_plural = _("Quotas")

src/pretix/base/models/orders.py

@@ -6,6 +6,7 @@ import os
 import string
 from datetime import datetime, time, timedelta
 from decimal import Decimal
+from django_scopes import ScopedManager
 from typing import Any, Dict, List, Union
 
 import dateutil
@@ -186,6 +187,8 @@ class Order(LockModel, LoggedModel):
         verbose_name=_('E-mail address verified')
     )
 
+    objects = ScopedManager(organizer='event__organizer')
+
     class Meta:
         verbose_name = _("Order")
         verbose_name_plural = _("Orders")
@@ -822,6 +825,8 @@ class QuestionAnswer(models.Model):
         max_length=255
     )
 
+    objects = ScopedManager(organizer='question__event__organizer')
+
     @property
     def backend_file_url(self):
         if self.file:
@@ -1145,6 +1150,8 @@ class OrderPayment(models.Model):
     )
     migrated = models.BooleanField(default=False)
 
+    objects = ScopedManager(organizer='order__event__organizer')
+
     class Meta:
         ordering = ('local_id',)
 
@@ -1501,6 +1508,8 @@ class OrderRefund(models.Model):
         null=True, blank=True
     )
 
+    objects = ScopedManager(organizer='order__event__organizer')
+
     class Meta:
         ordering = ('local_id',)
 
@@ -1562,7 +1571,7 @@ class OrderRefund(models.Model):
         super().save(*args, **kwargs)
 
 
-class ActivePositionManager(models.Manager):
+class ActivePositionManager(ScopedManager(organizer='order__event__organizer').__class__):
     def get_queryset(self):
         return super().get_queryset().filter(canceled=False)
 
@@ -1639,7 +1648,7 @@ class OrderFee(models.Model):
     )
     canceled = models.BooleanField(default=False)
 
-    all = models.Manager()
+    all = ScopedManager(organizer='order__event__organizer')
     objects = ActivePositionManager()
 
     @property
@@ -1744,7 +1753,7 @@ class OrderPosition(AbstractPosition):
     )
     canceled = models.BooleanField(default=False)
 
-    all = models.Manager()
+    all = ScopedManager(organizer='order__event__organizer')
     objects = ActivePositionManager()
 
     class Meta:
@@ -1951,6 +1960,8 @@ class CartPosition(AbstractPosition):
     )
     is_bundled = models.BooleanField(default=False)
 
+    objects = ScopedManager(organizer='event__organizer')
+
     class Meta:
         verbose_name = _("Cart position")
         verbose_name_plural = _("Cart positions")
@@ -2000,6 +2011,8 @@ class InvoiceAddress(models.Model):
         blank=True
     )
 
+    objects = ScopedManager(organizer='order__event__organizer')
+
     def save(self, **kwargs):
         if self.order:
             self.order.touch()

src/pretix/base/models/vouchers.py

@@ -8,6 +8,7 @@ from django.db.models import Q
 from django.utils.crypto import get_random_string
 from django.utils.timezone import now
 from django.utils.translation import pgettext_lazy, ugettext_lazy as _
+from django_scopes import ScopedManager
 
 from ..decimal import round_decimal
 from .base import LoggedModel
@@ -173,6 +174,8 @@ class Voucher(LoggedModel):
                     "convenience.")
     )
 
+    objects = ScopedManager(organizer='event__organizer')
+
     class Meta:
         verbose_name = _("Voucher")
         verbose_name_plural = _("Vouchers")

src/pretix/base/models/waitinglist.py

@@ -4,6 +4,7 @@ from django.core.exceptions import ValidationError
 from django.db import models, transaction
 from django.utils.timezone import now
 from django.utils.translation import pgettext_lazy, ugettext_lazy as _
+from django_scopes import ScopedManager
 
 from pretix.base.i18n import language
 from pretix.base.models import Voucher
@@ -67,6 +68,8 @@ class WaitingListEntry(LoggedModel):
     )
     priority = models.IntegerField(default=0)
 
+    objects = ScopedManager(organizer='event__organizer')
+
     class Meta:
         verbose_name = _("Waiting list entry")
         verbose_name_plural = _("Waiting list entries")

src/pretix/base/views/metrics.py

@@ -3,6 +3,7 @@ import hmac
 
 from django.conf import settings
 from django.http import HttpResponse
+from django_scopes import scopes_disabled
 
 from .. import metrics
 
@@ -15,6 +16,7 @@ def unauthed_response():
     return response
 
 
+@scopes_disabled()
 def serve_metrics(request):
     if not settings.METRICS_ENABLED:
         return unauthed_response()