From 1be702a59eca81c278d39702476607c059f33cf0 Mon Sep 17 00:00:00 2001 From: Mira Weller Date: Fri, 26 Jul 2024 19:09:22 +0200 Subject: [PATCH] require can_view_orders permission for retrieving seats --- src/pretix/api/views/event.py | 1 + src/tests/api/test_permissions.py | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/pretix/api/views/event.py b/src/pretix/api/views/event.py index cce3ecd21f..86f1d3c2c5 100644 --- a/src/pretix/api/views/event.py +++ b/src/pretix/api/views/event.py @@ -672,6 +672,7 @@ class EventSettingsView(views.APIView): class SeatViewSet(ConditionalListView, viewsets.ModelViewSet): serializer_class = SeatSerializer queryset = Seat.objects.none() + permission = 'can_view_orders' write_permission = 'can_change_event_settings' filter_backends = (DjangoFilterBackend,) filterset_fields = ('zone_name', 'row_name', 'row_label', 'seat_number', 'seat_label', 'seat_guid', 'blocked',) diff --git a/src/tests/api/test_permissions.py b/src/tests/api/test_permissions.py index d85e0c99f0..85a24e1a1d 100644 --- a/src/tests/api/test_permissions.py +++ b/src/tests/api/test_permissions.py @@ -54,7 +54,7 @@ event_urls = [ (None, 'taxrules/'), ('can_view_orders', 'waitinglistentries/'), ('can_view_orders', 'checkinlists/'), - (None, 'seats/'), + ('can_view_orders', 'seats/'), ] event_permission_sub_urls = [ @@ -192,7 +192,7 @@ event_permission_sub_urls = [ ('post', 'can_change_event_settings', 'item_meta_properties/', 400), ('patch', 'can_change_event_settings', 'item_meta_properties/0/', 404), ('delete', 'can_change_event_settings', 'item_meta_properties/0/', 404), - ('get', None, 'seats/1/', 404), + ('get', 'can_view_orders', 'seats/1/', 404), ('patch', 'can_change_event_settings', 'seats/1/', 404), ]