From 943fe8b1859fa8bd948daade2709d74a1a0db3bf Mon Sep 17 00:00:00 2001
From: Raphael Michel <michel@pretix.eu>
Date: Tue, 28 Jul 2026 13:59:23 +0200
Subject: [PATCH] API: Disable endpoints that should have never existed

---
 src/pretix/api/views/event.py |  3 ++-
 src/tests/api/test_events.py  | 16 ++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/pretix/api/views/event.py b/src/pretix/api/views/event.py
index 604300b30..630988aac 100644
--- a/src/pretix/api/views/event.py
+++ b/src/pretix/api/views/event.py
@@ -45,6 +45,7 @@ from rest_framework.exceptions import (
     NotFound, PermissionDenied, ValidationError,
 )
 from rest_framework.generics import get_object_or_404
+from rest_framework.mixins import UpdateModelMixin
 from rest_framework.response import Response
 
 from pretix.api.auth.permission import EventCRUDPermission
@@ -711,7 +712,7 @@ class SeatFilter(FilterSet):
         fields = ('zone_name', 'row_name', 'row_label', 'seat_number', 'seat_label', 'seat_guid', 'blocked',)
 
 
-class SeatViewSet(ConditionalListView, viewsets.ModelViewSet):
+class SeatViewSet(ConditionalListView, UpdateModelMixin, viewsets.ReadOnlyModelViewSet):
     serializer_class = SeatSerializer
     queryset = Seat.objects.none()
     write_permission = 'event.settings.general:write'
diff --git a/src/tests/api/test_events.py b/src/tests/api/test_events.py
index 56b714d70..9838a3d50 100644
--- a/src/tests/api/test_events.py
+++ b/src/tests/api/test_events.py
@@ -1164,6 +1164,22 @@ def test_event_update_seating(token_client, organizer, event, item, seatingplan)
     assert all(seat['product'] == item.pk for seat in resp.data['results'])
 
 
+@pytest.mark.django_db
+def test_event_no_create_or_delete_seats(token_client, organizer, event, item, seatingplan):
+    resp = token_client.post(
+        '/api/v1/organizers/{}/events/{}/seats/'.format(organizer.slug, event.slug),
+        {
+            'blocked': False,
+        },
+        format='json'
+    )
+    assert resp.status_code == 405
+    resp = token_client.delete(
+        '/api/v1/organizers/{}/events/{}/seats/3/'.format(organizer.slug, event.slug),
+    )
+    assert resp.status_code == 405
+
+
 @pytest.mark.django_db
 def test_event_update_seating_invalid_product(token_client, organizer, event, item, seatingplan):
     resp = token_client.patch(