CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

API: Fix order and invoice viewset with staff permissions

Browse Source
This commit is contained in:
Raphael Michel
2023-09-06 09:38:31 +02:00
parent 447370d7b3
commit b43523ea65
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/pretix/api/views/order.py
View File

@@ -298,12 +298,12 @@ class OrganizerOrderViewSet(OrderViewSetMixin, viewsets.ReadOnlyModelViewSet):
if isinstance(self.request.auth, (TeamAPIToken, Device)): if isinstance(self.request.auth, (TeamAPIToken, Device)):
return Order.objects.filter( return Order.objects.filter(
event__organizer=self.request.organizer, event__organizer=self.request.organizer,
event__in=self.request.auth.get_events_with_permission(perm) event__in=self.request.auth.get_events_with_permission(perm, request=self.request)
) )
elif self.request.user.is_authenticated: elif self.request.user.is_authenticated:
return Order.objects.filter( return Order.objects.filter(
event__organizer=self.request.organizer, event__organizer=self.request.organizer,
event__in=self.request.user.get_events_with_permission(perm) event__in=self.request.user.get_events_with_permission(perm, request=self.request)
) )
else: else:
raise PermissionDenied() raise PermissionDenied()
@@ -1829,12 +1829,12 @@ class InvoiceViewSet(viewsets.ReadOnlyModelViewSet):
elif isinstance(self.request.auth, (TeamAPIToken, Device)): elif isinstance(self.request.auth, (TeamAPIToken, Device)):
qs = Invoice.objects.filter( qs = Invoice.objects.filter(
event__organizer=self.request.organizer, event__organizer=self.request.organizer,
event__in=self.request.auth.get_events_with_permission(perm) event__in=self.request.auth.get_events_with_permission(perm, request=self.request)
) )
elif self.request.user.is_authenticated: elif self.request.user.is_authenticated:
qs = Invoice.objects.filter( qs = Invoice.objects.filter(
event__organizer=self.request.organizer, event__organizer=self.request.organizer,
event__in=self.request.user.get_events_with_permission(perm) event__in=self.request.user.get_events_with_permission(perm, request=self.request)
) )
return qs.prefetch_related('lines').select_related('order', 'refers').annotate( return qs.prefetch_related('lines').select_related('order', 'refers').annotate(
nr=Concat('prefix', 'invoice_no') nr=Concat('prefix', 'invoice_no')