[SECURITY] Bind relevant cached file downloads to the current session

2020-12-18 19:17:23 +01:00
parent a3dd015c23
commit c60a25f2bc
11 changed files with 42 additions and 9 deletions
--- a/src/pretix/api/views/exporters.py
+++ b/src/pretix/api/views/exporters.py
@@ -81,7 +81,7 @@ class ExportersMixin:
        serializer = JobRunSerializer(exporter=instance, data=self.request.data, **self.get_serializer_kwargs())
        serializer.is_valid(raise_exception=True)

-        cf = CachedFile()
+        cf = CachedFile(web_download=False)
        cf.date = now()
        cf.expires = now() + timedelta(days=3)
        cf.save()