From 5d449ea3134b8856d28b82cf34b5cab8d3b7073b Mon Sep 17 00:00:00 2001 From: Richard Schreiber Date: Tue, 9 Jun 2026 13:20:48 +0200 Subject: [PATCH 1/2] [SECURITY] Reusable media export: Respect giftcard permissions (CVE-2026-11764) (#6261) --- src/pretix/base/exporters/reusablemedia.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/pretix/base/exporters/reusablemedia.py b/src/pretix/base/exporters/reusablemedia.py index fbc600590..e880f1716 100644 --- a/src/pretix/base/exporters/reusablemedia.py +++ b/src/pretix/base/exporters/reusablemedia.py @@ -61,18 +61,23 @@ class ReusableMediaExporter(OrganizerLevelExportMixin, ListExporter): yield headers yield self.ProgressSetTotal(total=media.count()) + can_read_giftcards = self.permission_holder.has_organizer_permission(self.organizer, 'organizer.giftcards:read') + for medium in media.iterator(chunk_size=1000): - row = [ + giftcard_secret = medium.linked_giftcard.secret if medium.linked_giftcard_id else '' + if giftcard_secret and not can_read_giftcards: + giftcard_secret = giftcard_secret[:3] + "…" + + yield [ medium.type, medium.identifier, _('Yes') if medium.active else _('No'), date_format(medium.expires, 'SHORT_DATETIME_FORMAT') if medium.expires else '', medium.customer.identifier if medium.customer_id else '', f"{medium.linked_orderposition.order.code}-{medium.linked_orderposition.positionid}" if medium.linked_orderposition_id else '', - medium.linked_giftcard.secret if medium.linked_giftcard_id else '', + giftcard_secret, medium.notes, ] - yield row def get_filename(self): return f'{self.organizer.slug}_media' -- 2.54.0 From a6c417eb2f488637e5a7a03a60de9f36b66a84d7 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Tue, 9 Jun 2026 13:22:17 +0200 Subject: [PATCH 2/2] Bump version to 2026.5.1 --- src/pretix/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pretix/__init__.py b/src/pretix/__init__.py index 8c102ccb6..7807542d8 100644 --- a/src/pretix/__init__.py +++ b/src/pretix/__init__.py @@ -19,4 +19,4 @@ # You should have received a copy of the GNU Affero General Public License along with this program. If not, see # . # -__version__ = "2026.5.0" +__version__ = "2026.5.1" -- 2.54.0