require can_view_orders permission for retrieving seats

src/pretix/api/views/event.py

@@ -672,6 +672,7 @@ class EventSettingsView(views.APIView):
 class SeatViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = SeatSerializer
     queryset = Seat.objects.none()
+    permission = 'can_view_orders'
     write_permission = 'can_change_event_settings'
     filter_backends = (DjangoFilterBackend,)
     filterset_fields = ('zone_name', 'row_name', 'row_label', 'seat_number', 'seat_label', 'seat_guid', 'blocked',)

src/tests/api/test_permissions.py

@@ -54,7 +54,7 @@ event_urls = [
     (None, 'taxrules/'),
     ('can_view_orders', 'waitinglistentries/'),
     ('can_view_orders', 'checkinlists/'),
-    (None, 'seats/'),
+    ('can_view_orders', 'seats/'),
 ]
 
 event_permission_sub_urls = [
@@ -192,7 +192,7 @@ event_permission_sub_urls = [
     ('post', 'can_change_event_settings', 'item_meta_properties/', 400),
     ('patch', 'can_change_event_settings', 'item_meta_properties/0/', 404),
     ('delete', 'can_change_event_settings', 'item_meta_properties/0/', 404),
-    ('get', None, 'seats/1/', 404),
+    ('get', 'can_view_orders', 'seats/1/', 404),
     ('patch', 'can_change_event_settings', 'seats/1/', 404),
 ]