From 49c4cc639fdc337e68218d2ad00be9f134d1e662 Mon Sep 17 00:00:00 2001 From: Mira Date: Wed, 22 May 2024 13:13:50 +0200 Subject: [PATCH] Fix time machine permission via pretix_event_access sessions for staff users (#4160) --- src/pretix/base/timemachine.py | 3 ++- src/pretix/presale/utils.py | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/pretix/base/timemachine.py b/src/pretix/base/timemachine.py index e8848c8372..df07721446 100644 --- a/src/pretix/base/timemachine.py +++ b/src/pretix/base/timemachine.py @@ -81,5 +81,6 @@ def has_time_machine_permission(request, event): ) or ( getattr(request, 'event_access_user', None) and request.event_access_user.is_authenticated and - request.event_access_user.has_event_permission(request.organizer, request.event, permission, request=request) + request.event_access_user.has_event_permission(request.organizer, request.event, permission, + session_key=request.event_access_parent_session_key) ) diff --git a/src/pretix/presale/utils.py b/src/pretix/presale/utils.py index dcf92f5ead..297d8cb55c 100644 --- a/src/pretix/presale/utils.py +++ b/src/pretix/presale/utils.py @@ -339,6 +339,7 @@ def _detect_event(request, require_live=True, require_plugin=None): request.organizer, request.event, session_key=parent_session_key): can_access = True request.event_access_user = user + request.event_access_parent_session_key = parent_session_key if not can_access and not request.event.live: # Directly construct view instead of just calling `raise` since this case is so common that we