From ce4fd2a958d79d185eb079783084ad53de9d3796 Mon Sep 17 00:00:00 2001 From: Mira Weller Date: Tue, 23 Jun 2026 14:20:44 +0200 Subject: [PATCH] Fix URL matching in EventQRCode (Z#23237781) --- src/pretix/control/views/event.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/pretix/control/views/event.py b/src/pretix/control/views/event.py index 322c0761c..455ce9bf1 100644 --- a/src/pretix/control/views/event.py +++ b/src/pretix/control/views/event.py @@ -64,7 +64,6 @@ from django.shortcuts import get_object_or_404, redirect from django.urls import NoReverseMatch, reverse from django.utils.functional import cached_property from django.utils.html import conditional_escape, format_html -from django.utils.http import url_has_allowed_host_and_scheme from django.utils.safestring import mark_safe from django.utils.timezone import now from django.utils.translation import gettext, gettext_lazy as _, gettext_noop @@ -1742,7 +1741,7 @@ class EventQRCode(EventPermissionRequiredMixin, View): url = eventreverse_absolute(request.event, 'presale:event.index') if "url" in request.GET: - if url_has_allowed_host_and_scheme(request.GET["url"], allowed_hosts=[urlparse(url).netloc]): + if request.GET["url"].startswith(url): url = request.GET["url"] else: raise PermissionDenied("Untrusted URL")