From ad0b5776b63dc03c51c4ba01ec7762e6bfd7fc75 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Tue, 28 Jul 2026 12:24:44 +0200 Subject: [PATCH] [SECURITY] Add missing permission check for view (CVE-2026-57532) --- src/pretix/control/views/event.py | 2 +- src/tests/control/test_permissions.py | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/pretix/control/views/event.py b/src/pretix/control/views/event.py index d566050fc..ca5a158b7 100644 --- a/src/pretix/control/views/event.py +++ b/src/pretix/control/views/event.py @@ -1554,7 +1554,7 @@ class WidgetSettings(EventSettingsViewMixin, EventPermissionRequiredMixin, FormV return ctx -class QuickSetupView(FormView): +class QuickSetupView(EventPermissionRequiredMixin, FormView): template_name = 'pretixcontrol/event/quick_setup.html' permission = 'event.settings.general:write' form_class = QuickSetupForm diff --git a/src/tests/control/test_permissions.py b/src/tests/control/test_permissions.py index aaff20d9e..3748a2ecb 100644 --- a/src/tests/control/test_permissions.py +++ b/src/tests/control/test_permissions.py @@ -90,6 +90,7 @@ event_urls = [ "delete/", "dangerzone/", "cancel/", + "quickstart/", "settings/", "settings/plugins", "settings/payment", @@ -310,6 +311,7 @@ event_permission_urls = [ ("event.settings.general:write", "live/", 200, HTTP_GET), ("event.settings.general:write", "delete/", 200, HTTP_GET), ("event.settings.general:write", "dangerzone/", 200, HTTP_GET), + ("event.settings.general:write", "quickstart/", 200, HTTP_GET), ("event.settings.general:write", "settings/", 200, HTTP_GET), # ("event.settings.payment:write", "settings/payment", 200, HTTP_GET), GET allowed also with other permissions ("event.settings.payment:write", "settings/payment", 200, HTTP_POST),