CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-16 11:46:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SECURITY] Hardening for user impersonation feature (CVE-2026-13602)

Browse Source 
---------

Co-authored-by: Mira Weller <weller@pretix.eu>
This commit is contained in:
Raphael Michel
2026-07-01 15:15:43 +02:00
co-authored by Mira Weller
parent c9781f012b
commit 6eebaaa563
2 changed files with 30 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/control/middleware.py
+1 -1
View File
@@ -212,7 +212,7 @@ class AuditLogMiddleware:
if request.path.startswith(get_script_prefix() + 'control') and request.user.is_authenticated:
if getattr(request.user, "is_hijacked", False):
hijack_history = request.session.get('hijack_history', False)
hijacker = get_object_or_404(User, pk=hijack_history[0])
hijacker = get_object_or_404(User, pk=hijack_history[0]["user"])
ss = hijacker.get_active_staff_session(request.session.get('hijacker_session'))
if ss:
ss.logs.create(