From 9c59206949398634a989d23e7d0719c60eed6b40 Mon Sep 17 00:00:00 2001
From: Raphael Michel <michel@rami.io>
Date: Thu, 11 Sep 2025 19:19:12 +0200
Subject: [PATCH] Review notes

---
 src/pretix/presale/views/organizer.py |  4 ++--
 src/pretix/presale/views/widget.py    | 11 ++++++++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/pretix/presale/views/organizer.py b/src/pretix/presale/views/organizer.py
index 2d9d8704c3..519708c8b7 100644
--- a/src/pretix/presale/views/organizer.py
+++ b/src/pretix/presale/views/organizer.py
@@ -564,6 +564,8 @@ def add_events_for_days(request, baseqs, before, after, ebd, timezones):
 
 
 def filter_subevents_with_plugins(subevents, sales_channel=None):
+    # Special-case of GlobalSignal.send_chained() that only sends subevents that have the plugin enabled
+    # and then mixes the results back together.
     from pretix.base.signals import (
         _populate_app_cache, app_cache, get_defining_app, is_app_active,
     )
@@ -574,8 +576,6 @@ def filter_subevents_with_plugins(subevents, sales_channel=None):
     if not app_cache:
         _populate_app_cache()
 
-    # Special-case of GlobalSignal.send_chained() that only sends subevents that have the plugin enabled
-    # and then mixes the results back together.
     for receiver in filter_subevents._live_receivers(None):
         app = get_defining_app(receiver)
         event_state = {}
diff --git a/src/pretix/presale/views/widget.py b/src/pretix/presale/views/widget.py
index 448fe4f1ea..c612accf9e 100644
--- a/src/pretix/presale/views/widget.py
+++ b/src/pretix/presale/views/widget.py
@@ -73,7 +73,8 @@ from pretix.presale.views.event import (
 )
 from pretix.presale.views.organizer import (
     EventListMixin, add_events_for_days, add_subevents_for_days,
-    days_for_template, filter_qs_by_attr, weeks_for_template,
+    days_for_template, filter_qs_by_attr, filter_subevents_with_plugins,
+    weeks_for_template,
 )
 
 logger = logging.getLogger(__name__)
@@ -403,6 +404,14 @@ class WidgetAPIProductList(EventListMixin, View):
                     return self.response({
                         'error': gettext('The selected date does not exist in this event series.')
                     })
+
+                # Prevent direct access to subevents that are hidden by a plugin
+                subevents = filter_subevents_with_plugins([self.subevent], request.sales_channel)
+                if self.subevent not in subevents:
+                    return self.response({
+                        'error': gettext('The selected date is not available.')
+                    })
+
             else:
                 return self._get_event_list(request, **kwargs)
         else: