CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Require correct permission for refunds in all cases

Browse Source
This commit is contained in:
Raphael Michel
2018-04-04 12:52:36 +02:00
parent ded15ecc3f
commit 7baabcef96
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/pretix/plugins/paypal/views.py
View File

@@ -177,7 +177,7 @@ def webhook(request, *args, **kwargs):
return HttpResponse(status=200) return HttpResponse(status=200)
@event_permission_required('can_view_orders') @event_permission_required('can_change_orders')
@require_POST @require_POST
def refund(request, **kwargs): def refund(request, **kwargs):
with transaction.atomic(): with transaction.atomic():

2
src/pretix/plugins/stripe/views.py
View File

@@ -276,7 +276,7 @@ def oauth_disconnect(request, **kwargs):
})) }))
@event_permission_required('can_view_orders') @event_permission_required('can_change_orders')
@require_POST @require_POST
def refund(request, **kwargs): def refund(request, **kwargs):
with transaction.atomic(): with transaction.atomic():