From 539f4db37a5438cb6deae166e1dac354eadd445c Mon Sep 17 00:00:00 2001
From: Raphael Michel <michel@pretix.eu>
Date: Tue, 4 Aug 2026 09:31:20 +0200
Subject: [PATCH] CachedFileField: Bind file access to session (Z#23242301)

---
 src/pretix/control/forms/__init__.py | 13 ++++++++++++-
 src/pretix/plugins/sendmail/forms.py | 19 +++++++++++--------
 src/pretix/plugins/sendmail/views.py |  1 +
 3 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/src/pretix/control/forms/__init__.py b/src/pretix/control/forms/__init__.py
index a4adbe3d91..c87979cb75 100644
--- a/src/pretix/control/forms/__init__.py
+++ b/src/pretix/control/forms/__init__.py
@@ -172,7 +172,9 @@ class CachedFileInput(forms.ClearableFileInput):
         from ...base.models import CachedFile
         v = super().value_from_datadict(data, files, name)
         if v is None and data.get(name + '-cachedfile'):  # An explicit "[x] clear" would be False, not None
-            return CachedFile.objects.filter(id=data[name + '-cachedfile']).first()
+            v = CachedFile.objects.filter(id=data[name + '-cachedfile']).first()
+            if self.request and not v.allowed_for_session(self.request):
+                v = None
         return v
 
     def get_context(self, name, value, attrs):
@@ -244,6 +246,11 @@ class ExtFileField(ExtValidationMixin, SizeFileField):
 class CachedFileField(ExtFileField):
     widget = CachedFileInput
 
+    def __init__(self, *args, **kwargs):
+        self.request = kwargs.pop("request", None)
+        super().__init__(*args, **kwargs)
+        self.widget.request = self.request
+
     def to_python(self, data):
         from ...base.models import CachedFile
 
@@ -271,6 +278,8 @@ class CachedFileField(ExtFileField):
                 filename=data.name,
                 type=data.content_type,
             )
+            if self.request:
+                cf.bind_to_session(self.request)  # no salt because we want direct web access
             cf.file.save(data.name, data.file)
             cf.save()
             data._uploaded_to = cf
@@ -294,6 +303,8 @@ class CachedFileField(ExtFileField):
                 filename=data.name,
                 type=data.content_type,
             )
+            if self.request:
+                cf.bind_to_session(self.request)  # no salt because we want direct web access
             cf.file.save(data.name, data.file)
             cf.save()
             data._uploaded_to = cf
diff --git a/src/pretix/plugins/sendmail/forms.py b/src/pretix/plugins/sendmail/forms.py
index 1dc858024c..16aaa0e97a 100644
--- a/src/pretix/plugins/sendmail/forms.py
+++ b/src/pretix/plugins/sendmail/forms.py
@@ -56,18 +56,11 @@ from pretix.base.services.placeholders import FormPlaceholderMixin  # noqa
 class BaseMailForm(FormPlaceholderMixin, forms.Form):
     subject = forms.CharField(label=_("Subject"))
     message = forms.CharField(label=_("Message"))
-    attachment = CachedFileField(
-        label=_("Attachment"),
-        required=False,
-        ext_whitelist=settings.FILE_UPLOAD_EXTENSIONS_EMAIL_ATTACHMENT,
-        help_text=_('Sending an attachment increases the chance of your email not arriving or being sorted into spam folders. We recommend only using PDFs '
-                    'of no more than 2 MB in size.'),
-        max_size=settings.FILE_UPLOAD_MAX_SIZE_EMAIL_ATTACHMENT
-    )
 
     def __init__(self, *args, **kwargs):
         event = self.event = kwargs.pop('event')
         context_parameters = kwargs.pop('context_parameters')
+        request = kwargs.pop('request')
         super().__init__(*args, **kwargs)
         self.fields['subject'] = I18nFormField(
             label=_('Subject'),
@@ -79,6 +72,16 @@ class BaseMailForm(FormPlaceholderMixin, forms.Form):
             widget=I18nMarkdownTextarea, required=True,
             locales=event.settings.get('locales'),
         )
+        self.fields['attachment'] = CachedFileField(
+            label=_("Attachment"),
+            required=False,
+            ext_whitelist=settings.FILE_UPLOAD_EXTENSIONS_EMAIL_ATTACHMENT,
+            help_text=_(
+                'Sending an attachment increases the chance of your email not arriving or being sorted into spam folders. We recommend only using PDFs '
+                'of no more than 2 MB in size.'),
+            max_size=settings.FILE_UPLOAD_MAX_SIZE_EMAIL_ATTACHMENT,
+            request=request,
+        )
         self._set_field_placeholders('subject', context_parameters, rich=False)
         self._set_field_placeholders('message', context_parameters, rich=True)
 
diff --git a/src/pretix/plugins/sendmail/views.py b/src/pretix/plugins/sendmail/views.py
index a78edbb9c4..c4745d9769 100644
--- a/src/pretix/plugins/sendmail/views.py
+++ b/src/pretix/plugins/sendmail/views.py
@@ -157,6 +157,7 @@ class BaseSenderView(EventPermissionRequiredMixin, FormView):
         kwargs = super().get_form_kwargs()
         kwargs['event'] = self.request.event
         kwargs['context_parameters'] = self.context_parameters
+        kwargs['request'] = self.request
         if 'from_log' in self.request.GET:
             try:
                 from_log_id = self.request.GET.get('from_log')