Fix bulk edit of revoked devices (Z#23187227)

src/pretix/control/views/organizer.py

@@ -944,13 +944,16 @@ class DeviceQueryMixin:
         qs = self.request.organizer.devices.prefetch_related(
             'limit_events', 'gate',
         ).order_by('revoked', '-device_id')
-        if self.filter_form.is_valid():
-            qs = self.filter_form.filter_qs(qs)
 
         if 'device' in self.request_data and '__ALL' not in self.request_data:
             qs = qs.filter(
                 id__in=self.request_data.getlist('device')
             )
+        elif self.request.method == 'GET' or '__ALL' in self.request_data:
+            if self.filter_form.is_valid():
+                qs = self.filter_form.filter_qs(qs)
+        else:
+            raise PermissionDenied()
 
         return qs