Fix logic flaw in cart position deletion

src/pretix/api/views/event.py

@@ -13,7 +13,7 @@ from pretix.api.serializers.event import (
 )
 from pretix.api.views import ConditionalListView
 from pretix.base.models import (
-    Device, Event, ItemCategory, TaxRule, TeamAPIToken,
+    CartPosition, Device, Event, ItemCategory, TaxRule, TeamAPIToken,
 )
 from pretix.base.models.event import SubEvent
 from pretix.helpers.dicts import merge_dicts
@@ -272,7 +272,7 @@ class SubEventViewSet(ConditionalListView, viewsets.ModelViewSet):
                     auth=self.request.auth,
                     data=self.request.data
                 )
-                instance.cartposition_set.filter(addon_to__isnull=False).delete()
+                CartPosition.objects.filter(addon_to__subevent=instance).delete()
                 instance.cartposition_set.all().delete()
                 super().perform_destroy(instance)
         except ProtectedError:

src/pretix/api/views/item.py

@@ -16,8 +16,8 @@ from pretix.api.serializers.item import (
 )
 from pretix.api.views import ConditionalListView
 from pretix.base.models import (
-    Item, ItemAddOn, ItemBundle, ItemCategory, ItemVariation, Question,
+    CartPosition, Item, ItemAddOn, ItemBundle, ItemCategory, ItemVariation,
-    QuestionOption, Quota,
+    Question, QuestionOption, Quota,
 )
 from pretix.helpers.dicts import merge_dicts
 
@@ -84,8 +84,8 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
             user=self.request.user,
             auth=self.request.auth,
         )
-        self.get_object().cartposition_set.filter(addon_to__isnull=False).delete()
+        CartPosition.objects.filter(addon_to__item=instance).delete()
-        self.get_object().cartposition_set.all().delete()
+        instance.cartposition_set.all().delete()
         super().perform_destroy(instance)
 
 

src/pretix/control/views/item.py

@@ -18,8 +18,8 @@ from django.views.generic.edit import DeleteView
 
 from pretix.base.forms import I18nFormSet
 from pretix.base.models import (
-    CachedTicket, Item, ItemCategory, ItemVariation, Order, Question,
+    CachedTicket, CartPosition, Item, ItemCategory, ItemVariation, Order,
-    QuestionAnswer, QuestionOption, Quota, Voucher,
+    Question, QuestionAnswer, QuestionOption, Quota, Voucher,
 )
 from pretix.base.models.event import SubEvent
 from pretix.base.models.items import ItemAddOn, ItemBundle
@@ -1158,7 +1158,7 @@ class ItemDelete(EventPermissionRequiredMixin, DeleteView):
         success_url = self.get_success_url()
         o = self.get_object()
         if o.allow_delete():
-            self.get_object().cartposition_set.filter(addon_to__isnull=False).delete()
+            CartPosition.objects.filter(addon_to__item=self.get_object()).delete()
             self.get_object().cartposition_set.all().delete()
             self.get_object().log_action('pretix.event.item.deleted', user=self.request.user)
             self.get_object().delete()

src/pretix/control/views/subevents.py

@@ -16,6 +16,7 @@ from django.utils.translation import pgettext_lazy, ugettext_lazy as _
 from django.views import View
 from django.views.generic import CreateView, DeleteView, ListView, UpdateView
 
+from pretix.base.models import CartPosition
 from pretix.base.models.checkin import CheckinList
 from pretix.base.models.event import SubEvent, SubEventMetaValue
 from pretix.base.models.items import (
@@ -117,7 +118,7 @@ class SubEventDelete(EventPermissionRequiredMixin, DeleteView):
             return HttpResponseRedirect(self.get_success_url())
         else:
             self.object.log_action('pretix.subevent.deleted', user=self.request.user)
-            self.object.cartposition_set.filter(addon_to__isnull=False).delete()
+            CartPosition.objects.filter(addon_to__subevent=self.object).delete()
             self.object.cartposition_set.all().delete()
             self.object.delete()
             messages.success(request, pgettext_lazy('subevent', 'The selected date has been deleted.'))
@@ -513,7 +514,7 @@ class SubEventBulkAction(EventPermissionRequiredMixin, View):
         elif request.POST.get('action') == 'delete_confirm':
             for obj in self.objects:
                 if obj.allow_delete():
-                    obj.cartposition_set.filter(addon_to__isnull=False).delete()
+                    CartPosition.objects.filter(addon_to__subevent=obj).delete()
                     obj.cartposition_set.all().delete()
                     obj.log_action('pretix.subevent.deleted', user=self.request.user)
                     obj.delete()

src/pretix/control/views/vouchers.py

@@ -17,7 +17,7 @@ from django.views.generic import (
     CreateView, DeleteView, ListView, TemplateView, UpdateView, View,
 )
 
-from pretix.base.models import LogEntry, Voucher
+from pretix.base.models import CartPosition, LogEntry, OrderPosition, Voucher
 from pretix.base.models.vouchers import _generate_random_code
 from pretix.control.forms.filter import VoucherFilterForm
 from pretix.control.forms.vouchers import VoucherBulkForm, VoucherForm
@@ -143,7 +143,7 @@ class VoucherDelete(EventPermissionRequiredMixin, DeleteView):
             messages.error(request, _('A voucher can not be deleted if it already has been redeemed.'))
         else:
             self.object.log_action('pretix.voucher.deleted', user=self.request.user)
-            self.object.cartposition_set.filter(addon_to__isnull=False).delete()
+            CartPosition.objects.filter(addon_to__voucher=False).delete()
             self.object.cartposition_set.all().delete()
             self.object.delete()
             messages.success(request, _('The selected voucher has been deleted.'))
@@ -349,7 +349,7 @@ class VoucherBulkAction(EventPermissionRequiredMixin, View):
             for obj in self.objects:
                 if obj.allow_delete():
                     obj.log_action('pretix.voucher.deleted', user=self.request.user)
-                    obj.cartposition_set.filter(addon_to__isnull=False).delete()
+                    OrderPosition.objects.filter(addon_to__voucher=obj).delete()
                     obj.cartposition_set.all().delete()
                     obj.delete()
                 else: