CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Fix pretix_event_access (custom domain) sessions for staff users (#4158)

Browse Source
This commit is contained in:
Mira
2024-05-21 13:26:12 +02:00
committed by GitHub
parent e95d551711
commit 9a807df158
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/pretix/base/models/auth.py
View File

@@ -418,18 +418,22 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
else:
return set()
def has_event_permission(self, organizer, event, perm_name=None, request=None) -> bool:
def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
"""
Checks if this user is part of any team that grants access of type ``perm_name``
to the event ``event``.
Either ``request`` or ``session_key`` are required to detect staff sessions properly.
:param organizer: The organizer of the event
:param event: The event to check
:param perm_name: The permission, e.g. ``can_change_teams``
:param request: The current request (optional). Required to detect staff sessions properly.
:param request: The current request (optional)
:param session_key: The current session key (optional)
:return: bool
"""
if request and self.has_active_staff_session(request.session.session_key):
assert not (session_key and request)
if (session_key or request) and self.has_active_staff_session(session_key or request.session.session_key):
return True
teams = self._get_teams_for_event(organizer, event)
if teams: