From 1fa84b772bf13979483d94c57745b7e8a69a1391 Mon Sep 17 00:00:00 2001
From: Mira Weller <weller@rami.io>
Date: Fri, 26 Sep 2025 19:56:50 +0200
Subject: [PATCH] Fully block password change for non-native auth backend

---
 src/pretix/control/views/user.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/pretix/control/views/user.py b/src/pretix/control/views/user.py
index 82daa5e461..df9aa1b970 100644
--- a/src/pretix/control/views/user.py
+++ b/src/pretix/control/views/user.py
@@ -829,6 +829,9 @@ class UserPasswordChangeView(FormView):
     template_name = 'pretixcontrol/user/change_password.html'
 
     def get_form_kwargs(self):
+        if self.request.user.auth_backend != 'native':
+            raise PermissionDenied
+
         return {
             **super().get_form_kwargs(),
             "user": self.request.user,
@@ -867,6 +870,9 @@ class UserEmailChangeView(RecentAuthenticationRequiredMixin, FormView):
     template_name = 'pretixcontrol/user/change_email.html'
 
     def get_form_kwargs(self):
+        if self.request.user.auth_backend != 'native':
+            raise PermissionDenied
+
         return {
             **super().get_form_kwargs(),
             "user": self.request.user,