From a1bfe05879c4ab1126e60a19e1ad2db68c5c70df Mon Sep 17 00:00:00 2001
From: Raphael Michel <mail@raphaelmichel.de>
Date: Thu, 28 Jan 2021 21:34:30 +0100
Subject: [PATCH] Correctly pass query string when redirecting to sudo page

---
 src/pretix/base/templates/403.html                   | 2 +-
 src/pretix/base/templates/404.html                   | 2 +-
 src/pretix/control/permissions.py                    | 9 ++++++++-
 src/pretix/control/templates/pretixcontrol/base.html | 2 +-
 4 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/pretix/base/templates/403.html b/src/pretix/base/templates/403.html
index edadd07a9..85a7e5de0 100644
--- a/src/pretix/base/templates/403.html
+++ b/src/pretix/base/templates/403.html
@@ -13,7 +13,7 @@
             &middot; <a id='reload' href='#'>{% trans "Try again" %}</a>
         </p>
         {% if request.user.is_staff and not staff_session %}
-            <form action="{% url 'control:user.sudo' %}?next={{ request.path|urlencode }}" method="post">
+            <form action="{% url 'control:user.sudo' %}?next={{ request.path|add:"?"|add:request.GET.urlencode|urlencode }}" method="post">
                 <p>
                     {% csrf_token %}
                     <button type="submit" class="btn btn-default" id="button-sudo">
diff --git a/src/pretix/base/templates/404.html b/src/pretix/base/templates/404.html
index 762b9b447..6fa272a0b 100644
--- a/src/pretix/base/templates/404.html
+++ b/src/pretix/base/templates/404.html
@@ -12,7 +12,7 @@
             <a id='goback' href='#'>{% trans "Take a step back" %}</a>
         </p>
         {% if request.user.is_staff and not staff_session %}
-            <form action="{% url 'control:user.sudo' %}?next={{ request.path|urlencode }}" method="post">
+            <form action="{% url 'control:user.sudo' %}?next={{ request.path|add:"?"|add:request.GET.urlencode|urlencode }}" method="post">
                 <p>
                     {% csrf_token %}
                     <button type="submit" class="btn btn-default" id="button-sudo">
diff --git a/src/pretix/control/permissions.py b/src/pretix/control/permissions.py
index 378b25698..3d2863b4e 100644
--- a/src/pretix/control/permissions.py
+++ b/src/pretix/control/permissions.py
@@ -6,6 +6,13 @@ from django.urls import reverse
 from django.utils.translation import gettext as _
 
 
+def current_url(request):
+    if len(request.GET):
+        return request.path + '?' + request.GET.urlencode()
+    else:
+        return request.path
+
+
 def event_permission_required(permission):
     """
     This view decorator rejects all requests with a 403 response which are not from
@@ -94,7 +101,7 @@ def administrator_permission_required():
                 raise PermissionDenied()
             if not request.user.has_active_staff_session(request.session.session_key):
                 if request.user.is_staff:
-                    return redirect(reverse('control:user.sudo') + '?next=' + quote(request.path))
+                    return redirect(reverse('control:user.sudo') + '?next=' + quote(current_url(request)))
                 raise PermissionDenied(_('You do not have permission to view this content.'))
             return function(request, *args, **kw)
         return wrapper
diff --git a/src/pretix/control/templates/pretixcontrol/base.html b/src/pretix/control/templates/pretixcontrol/base.html
index 335a3caec..6ad510dee 100644
--- a/src/pretix/control/templates/pretixcontrol/base.html
+++ b/src/pretix/control/templates/pretixcontrol/base.html
@@ -186,7 +186,7 @@
 
                     {% if request.user.is_staff and not staff_session %}
                         <li>
-                            <form action="{% url 'control:user.sudo' %}?next={{ request.path|urlencode }}" method="post">
+                            <form action="{% url 'control:user.sudo' %}?next={{ request.path|add:"?"|add:request.GET.urlencode|urlencode }}" method="post">
                                 {% csrf_token %}
                                 <button type="submit" class="btn btn-link" id="button-sudo">
                                     <i class="fa fa-id-card"></i> {% trans "Admin mode" %}