Big string replace

2026-05-06 15:24:02 +00:00 · 2025-12-17 17:09:06 +01:00
parent 318f1db5a0
commit a2a4c8a955
73 changed files with 852 additions and 848 deletions
--- a/src/pretix/control/context.py
+++ b/src/pretix/control/context.py
@@ -102,7 +102,7 @@ def _default_context(request):
                    complain_testmode_orders = request.event.orders.filter(testmode=True).exists()
                    request.event.cache.set('complain_testmode_orders', complain_testmode_orders, 30)
            ctx['complain_testmode_orders'] = complain_testmode_orders and request.user.has_event_permission(
-                request.organizer, request.event, 'can_view_orders', request=request
+                request.organizer, request.event, 'event.orders:read', request=request
            )
        else:
            ctx['complain_testmode_orders'] = False
--- a/src/pretix/control/forms/filter.py
+++ b/src/pretix/control/forms/filter.py
@@ -1111,7 +1111,7 @@ class OrderPaymentSearchFilterForm(forms.Form):
            self.fields['organizer'].queryset = Organizer.objects.filter(
                pk__in=self.request.user.teams.values_list('organizer', flat=True)
            )
-            self.fields['event'].queryset = self.request.user.get_events_with_permission('can_view_orders')
+            self.fields['event'].queryset = self.request.user.get_events_with_permission('event.orders:read')

        self.fields['provider'].choices += get_all_payment_providers()

--- a/src/pretix/control/navigation.py
+++ b/src/pretix/control/navigation.py
@@ -43,7 +43,7 @@ def get_event_navigation(request: HttpRequest):
            'icon': 'dashboard',
        }
    ]
-    if 'can_change_event_settings' in request.eventpermset:
+    if 'event.settings.general:write' in request.eventpermset:
        event_settings = [
            {
                'label': _('General'),
@@ -133,7 +133,7 @@ def get_event_navigation(request: HttpRequest):
            'children': event_settings
        })

-    if 'can_change_items' in request.eventpermset:
+    if 'event.items:write' in request.eventpermset:
        nav.append({
            'label': _('Products'),
            'url': reverse('control:event.items', kwargs={
@@ -187,7 +187,7 @@ def get_event_navigation(request: HttpRequest):
            ]
        })

-    if 'can_change_event_settings' in request.eventpermset:
+    if 'event.settings.general:write' in request.eventpermset:
        if request.event.has_subevents:
            nav.append({
                'label': pgettext_lazy('subevent', 'Dates'),
@@ -199,7 +199,7 @@ def get_event_navigation(request: HttpRequest):
                'icon': 'calendar',
            })

-    if 'can_view_orders' in request.eventpermset:
+    if 'event.orders:read' in request.eventpermset:
        children = [
            {
                'label': _('All orders'),
@@ -242,7 +242,7 @@ def get_event_navigation(request: HttpRequest):
                'active': 'event.orders.waitinglist' in url.url_name,
            },
        ]
-        if 'can_change_orders' in request.eventpermset:
+        if 'event.orders:write' in request.eventpermset:
            children.append({
                'label': _('Import'),
                'url': reverse('control:event.orders.import', kwargs={
@@ -262,7 +262,7 @@ def get_event_navigation(request: HttpRequest):
            'children': children
        })

-    if 'can_view_vouchers' in request.eventpermset:
+    if 'event.vouchers:read' in request.eventpermset:
        nav.append({
            'label': _('Vouchers'),
            'url': reverse('control:event.vouchers', kwargs={
@@ -291,7 +291,7 @@ def get_event_navigation(request: HttpRequest):
            ]
        })

-    if 'can_view_orders' in request.eventpermset:
+    if 'event.orders:read' in request.eventpermset:
        nav.append({
            'label': pgettext_lazy('navigation', 'Check-in'),
            'url': reverse('control:event.orders.checkinlists', kwargs={
@@ -480,7 +480,7 @@ def get_organizer_navigation(request):
            'icon': 'calendar',
        },
    ]
-    if 'can_change_organizer_settings' in request.orgapermset:
+    if 'organizer.settings.general:write' in request.orgapermset:
        nav.append({
            'label': _('Settings'),
            'url': reverse('control:organizer.edit', kwargs={
@@ -534,7 +534,7 @@ def get_organizer_navigation(request):
            ]
        })

-    if 'can_change_teams' in request.orgapermset:
+    if 'organizer.teams:write' in request.orgapermset:
        nav.append({
            'label': _('Teams'),
            'url': reverse('control:organizer.teams', kwargs={
@@ -544,7 +544,7 @@ def get_organizer_navigation(request):
            'icon': 'group',
        })

-    if 'can_manage_gift_cards' in request.orgapermset:
+    if 'organizer.giftcards:write' in request.orgapermset:
        children = []
        children.append({
            'label': _('Gift cards'),
@@ -554,7 +554,7 @@ def get_organizer_navigation(request):
            'active': 'organizer.giftcard' in url.url_name and 'acceptance' not in url.url_name,
            'children': children,
        })
-        if 'can_change_organizer_settings' in request.orgapermset:
+        if 'organizer.settings.general:write' in request.orgapermset:
            children.append(
                {
                    'label': _('Acceptance'),
@@ -575,7 +575,7 @@ def get_organizer_navigation(request):

    if request.organizer.settings.customer_accounts:
        children = []
-        if 'can_manage_customers' in request.orgapermset:
+        if 'organizer.customers:write' in request.orgapermset:
            children.append(
                {
                    'label': _('Customers'),
@@ -585,7 +585,7 @@ def get_organizer_navigation(request):
                    'active': 'organizer.customer' in url.url_name,
                }
            )
-        if 'can_change_organizer_settings' in request.orgapermset:
+        if 'organizer.settings.general:write' in request.orgapermset:
            children.append(
                {
                    'label': _('Membership types'),
@@ -633,7 +633,7 @@ def get_organizer_navigation(request):
            'active': 'organizer.reusable_medi' in url.url_name,
        })

-    if 'can_change_organizer_settings' in request.orgapermset:
+    if 'organizer.settings.general:write' in request.orgapermset:
        nav.append({
            'label': _('Devices'),
            'url': reverse('control:organizer.devices', kwargs={
@@ -667,7 +667,7 @@ def get_organizer_navigation(request):
        'icon': 'download',
    })

-    if 'can_change_organizer_settings' in request.orgapermset:
+    if 'organizer.settings.general:write' in request.orgapermset:
        merge_in(nav, [{
            'parent': reverse('control:organizer.export', kwargs={
                'organizer': request.organizer.slug,
--- a/src/pretix/control/permissions.py
+++ b/src/pretix/control/permissions.py
@@ -53,9 +53,9 @@ def event_permission_required(permission):
    This view decorator rejects all requests with a 403 response which are not from
    users having the given permission for the event the request is associated with.
    """
-    if permission == 'can_change_settings':
+    if permission == 'event.settings.general:write':
        # Legacy support
-        permission = 'can_change_event_settings'
+        permission = 'event.settings.general:write'

    def decorator(function):
        def wrapper(request, *args, **kw):
@@ -92,9 +92,9 @@ def organizer_permission_required(permission):
    This view decorator rejects all requests with a 403 response which are not from
    users having the given permission for the event the request is associated with.
    """
-    if permission == 'can_change_settings':
+    if permission == 'event.settings.general:write':
        # Legacy support
-        permission = 'can_change_organizer_settings'
+        permission = 'organizer.settings.general:write'

    def decorator(function):
        def wrapper(request, *args, **kw):
--- a/src/pretix/control/views/checkin.py
+++ b/src/pretix/control/views/checkin.py
@@ -150,7 +150,7 @@ class CheckInListShow(EventPermissionRequiredMixin, PaginationMixin, CheckInList
    model = Checkin
    context_object_name = 'entries'
    template_name = 'pretixcontrol/checkin/index.html'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    def dispatch(self, request, *args, **kwargs):
        self.list = get_object_or_404(self.request.event.checkin_lists.all(), pk=kwargs.get("list"))
@@ -211,7 +211,7 @@ class CheckInListBulkRevertConfirmView(CheckInListQueryMixin, EventPermissionReq


 class CheckInListBulkActionView(CheckInListQueryMixin, EventPermissionRequiredMixin, AsyncPostView):
-    permission = ('can_change_orders', 'can_checkin_orders')
+    permission = ('event.orders:write', 'event.orders:checkin')

    def dispatch(self, request, *args, **kwargs):
        self.list = get_object_or_404(self.request.event.checkin_lists.all(), pk=kwargs.get("list"))
@@ -228,7 +228,7 @@ class CheckInListBulkActionView(CheckInListQueryMixin, EventPermissionRequiredMi
        self.list = get_object_or_404(request.event.checkin_lists.all(), pk=kwargs.get("list"))
        positions = self.get_queryset()
        if request.POST.get('revert') == 'true':
-            if not request.user.has_event_permission(request.organizer, request.event, 'can_change_orders', request=request):
+            if not request.user.has_event_permission(request.organizer, request.event, 'event.orders:write', request=request):
                raise PermissionDenied()
            for op in positions:
                if op.order.status == Order.STATUS_PAID or (
@@ -295,7 +295,7 @@ class CheckInListBulkActionView(CheckInListQueryMixin, EventPermissionRequiredMi
 class CheckinListList(EventPermissionRequiredMixin, PaginationMixin, ListView):
    model = CheckinList
    context_object_name = 'checkinlists'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'
    template_name = 'pretixcontrol/checkin/lists.html'
    ordering = ('subevent__date_from', 'name', 'pk')

@@ -317,9 +317,9 @@ class CheckinListList(EventPermissionRequiredMixin, PaginationMixin, ListView):
                cl.subevent.event = self.request.event  # re-use same event object to make sure settings are cached
        ctx['checkinlists'] = clists

-        ctx['can_change_organizer_settings'] = self.request.user.has_organizer_permission(
+        ctx['organizer.settings.general:write'] = self.request.user.has_organizer_permission(
            self.request.organizer,
-            'can_change_organizer_settings',
+            'organizer.settings.general:write',
            self.request
        )
        ctx['filter_form'] = self.filter_form
@@ -335,7 +335,7 @@ class CheckinListCreate(EventPermissionRequiredMixin, CreateView):
    model = CheckinList
    form_class = CheckinListForm
    template_name = 'pretixcontrol/checkin/list_edit.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    context_object_name = 'checkinlist'

    def dispatch(self, request, *args, **kwargs):
@@ -386,7 +386,7 @@ class CheckinListUpdate(EventPermissionRequiredMixin, UpdateView):
    model = CheckinList
    form_class = CheckinListForm
    template_name = 'pretixcontrol/checkin/list_edit.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    context_object_name = 'checkinlist'

    def dispatch(self, request, *args, **kwargs):
@@ -445,7 +445,7 @@ class CheckinListUpdate(EventPermissionRequiredMixin, UpdateView):
 class CheckinListDelete(EventPermissionRequiredMixin, CompatDeleteView):
    model = CheckinList
    template_name = 'pretixcontrol/checkin/list_delete.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    context_object_name = 'checkinlist'

    def get_object(self, queryset=None) -> CheckinList:
@@ -476,7 +476,7 @@ class CheckinListDelete(EventPermissionRequiredMixin, CompatDeleteView):
 class CheckinListView(EventPermissionRequiredMixin, PaginationMixin, ListView):
    model = Checkin
    context_object_name = 'checkins'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'
    template_name = 'pretixcontrol/checkin/checkins.html'
    ordering = ('-datetime', '-pk')

@@ -505,7 +505,7 @@ class CheckinListView(EventPermissionRequiredMixin, PaginationMixin, ListView):

 class CheckInListSimulator(EventPermissionRequiredMixin, FormView):
    template_name = 'pretixcontrol/checkin/simulator.html'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'
    form_class = CheckinListSimulatorForm

    def dispatch(self, request, *args, **kwargs):
@@ -575,7 +575,7 @@ class CheckInListSimulator(EventPermissionRequiredMixin, FormView):

 class CheckInResetView(CheckInListQueryMixin, EventPermissionRequiredMixin, AsyncFormView):
    form_class = CheckinResetForm
-    permission = "can_change_orders"
+    permission = "event.orders:write"
    template_name = "pretixcontrol/checkin/reset.html"

    def get_error_url(self, *args):
--- a/src/pretix/control/views/dashboards.py
+++ b/src/pretix/control/views/dashboards.py
@@ -351,10 +351,10 @@ def event_index(request, organizer, event):
        except SubEvent.DoesNotExist:
            pass

-    can_view_orders = request.user.has_event_permission(request.organizer, request.event, 'can_view_orders',
+    can_view_orders = request.user.has_event_permission(request.organizer, request.event, 'event.orders:read',
                                                        request=request)
    can_change_event_settings = request.user.has_event_permission(request.organizer, request.event,
-                                                                  'can_change_event_settings', request=request)
+                                                                  'event.settings.general:write', request=request)

    widgets = []
    if can_view_orders:
@@ -426,11 +426,11 @@ def event_index_log_lazy(request, organizer, event):
                                                         'device').order_by('-datetime')
    qs = qs.exclude(action_type__in=OVERVIEW_BANLIST)

-    can_view_orders = request.user.has_event_permission(request.organizer, request.event, 'can_view_orders',
+    can_view_orders = request.user.has_event_permission(request.organizer, request.event, 'event.orders:read',
                                                        request=request)
    can_change_event_settings = request.user.has_event_permission(request.organizer, request.event,
-                                                                  'can_change_event_settings', request=request)
-    can_view_vouchers = request.user.has_event_permission(request.organizer, request.event, 'can_view_vouchers',
+                                                                  'event.settings.general:write', request=request)
+    can_view_vouchers = request.user.has_event_permission(request.organizer, request.event, 'event.vouchers:read',
                                                          request=request)

    if not can_view_orders:
@@ -442,7 +442,7 @@ def event_index_log_lazy(request, organizer, event):
            ContentType.objects.get_for_model(Voucher),
            ContentType.objects.get_for_model(Order)
        ]
-        if request.user.has_event_permission(request.organizer, request.event, 'can_change_items', request=request):
+        if request.user.has_event_permission(request.organizer, request.event, 'event.items:write', request=request):
            allowed_types += [
                ContentType.objects.get_for_model(Item),
                ContentType.objects.get_for_model(ItemCategory),
--- a/src/pretix/control/views/datasync.py
+++ b/src/pretix/control/views/datasync.py
@@ -72,7 +72,7 @@ def on_control_order_info(sender: Event, request, order: Order, **kwargs):


 class ControlSyncJob(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, request, provider, *args, **kwargs):
        prov, meta = datasync_providers.get(active_in=self.request.event, identifier=provider)
@@ -154,7 +154,7 @@ class GlobalFailedSyncJobsView(AdministratorPermissionRequiredMixin, FailedSyncJ


 class OrganizerFailedSyncJobsView(OrganizerPermissionRequiredMixin, FailedSyncJobsView):
-    permission = "can_change_organizer_settings"
+    permission = "organizer.settings.general:write"

    def get_queryset(self):
        return super().get_queryset().filter(
@@ -163,7 +163,7 @@ class OrganizerFailedSyncJobsView(OrganizerPermissionRequiredMixin, FailedSyncJo


 class EventFailedSyncJobsView(EventPermissionRequiredMixin, FailedSyncJobsView):
-    permission = "can_change_event_settings"
+    permission = "event.settings.general:write"

    def get_queryset(self):
        return super().get_queryset().filter(
--- a/src/pretix/control/views/discounts.py
+++ b/src/pretix/control/views/discounts.py
@@ -50,7 +50,7 @@ from . import CreateView, PaginationMixin, UpdateView
 class DiscountDelete(EventPermissionRequiredMixin, CompatDeleteView):
    model = Discount
    template_name = 'pretixcontrol/items/discount_delete.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'discount'

    def get_context_data(self, *args, **kwargs) -> dict:
@@ -96,7 +96,7 @@ class DiscountUpdate(EventPermissionRequiredMixin, UpdateView):
    model = Discount
    form_class = DiscountForm
    template_name = 'pretixcontrol/items/discount.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'discount'

    def get_object(self, queryset=None) -> Discount:
@@ -139,7 +139,7 @@ class DiscountCreate(EventPermissionRequiredMixin, CreateView):
    model = Discount
    form_class = DiscountForm
    template_name = 'pretixcontrol/items/discount.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'discount'

    def get_success_url(self) -> str:
@@ -227,7 +227,7 @@ def discount_move(request, discount, up=True):
    messages.success(request, _('The order of discounts has been updated.'))


-@event_permission_required("can_change_items")
+@event_permission_required("event.items:write")
@require_http_methods(["POST"])
 def discount_move_up(request, organizer, event, discount):
    discount_move(request, discount, up=True)
@@ -236,7 +236,7 @@ def discount_move_up(request, organizer, event, discount):
                    event=request.event.slug)


-@event_permission_required("can_change_items")
+@event_permission_required("event.items:write")
@require_http_methods(["POST"])
 def discount_move_down(request, organizer, event, discount):
    discount_move(request, discount, up=False)
@@ -246,7 +246,7 @@ def discount_move_down(request, organizer, event, discount):


@transaction.atomic
-@event_permission_required("can_change_items")
+@event_permission_required("event.items:write")
@require_http_methods(["POST"])
 def reorder_discounts(request, organizer, event):
    try:
--- a/src/pretix/control/views/event.py
+++ b/src/pretix/control/views/event.py
@@ -155,7 +155,7 @@ class MetaDataEditorMixin:
            property=p,
            disabled=(
                p.protected and
-                not self.request.user.has_organizer_permission(self.request.organizer, 'can_change_organizer_settings', request=self.request)
+                not self.request.user.has_organizer_permission(self.request.organizer, 'organizer.settings.general:write', request=self.request)
            ),
            instance=val_instances.get(p.pk, self.meta_model(property=p, event=self.object)),
            data=(self.request.POST if self.request.method == "POST" else None)
@@ -187,7 +187,7 @@ class EventUpdate(DecoupleMixin, EventSettingsViewMixin, EventPermissionRequired
    model = Event
    form_class = EventUpdateForm
    template_name = 'pretixcontrol/event/settings.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    @cached_property
    def object(self) -> Event:
@@ -346,7 +346,7 @@ class EventUpdate(DecoupleMixin, EventSettingsViewMixin, EventPermissionRequired
 class EventPlugins(EventSettingsViewMixin, EventPermissionRequiredMixin, TemplateView, SingleObjectMixin):
    model = Event
    context_object_name = 'event'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    template_name = 'pretixcontrol/event/plugins.html'

    def get_object(self, queryset=None) -> Event:
@@ -447,7 +447,7 @@ class EventPlugins(EventSettingsViewMixin, EventPermissionRequiredMixin, Templat
                            continue

                        if getattr(pluginmeta, 'level', PLUGIN_LEVEL_EVENT) == PLUGIN_LEVEL_EVENT_ORGANIZER_HYBRID:
-                            if not request.user.has_organizer_permission(request.organizer, "can_change_organizer_settings", request):
+                            if not request.user.has_organizer_permission(request.organizer, "organizer.settings.general:write", request):
                                messages.error(
                                    request,
                                    _("You do not have sufficient permission to enable plugins that need to be enabled "
@@ -502,7 +502,7 @@ class EventPlugins(EventSettingsViewMixin, EventPermissionRequiredMixin, Templat
 class PaymentProviderSettings(EventSettingsViewMixin, EventPermissionRequiredMixin, TemplateView, SingleObjectMixin):
    model = Event
    context_object_name = 'event'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    template_name = 'pretixcontrol/event/payment_provider.html'

    def get_success_url(self) -> str:
@@ -581,7 +581,7 @@ class PaymentProviderSettings(EventSettingsViewMixin, EventPermissionRequiredMix

 class EventSettingsFormView(EventPermissionRequiredMixin, DecoupleMixin, FormView):
    model = Event
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    def get_context_data(self, *args, **kwargs) -> dict:
        context = super().get_context_data(*args, **kwargs)
@@ -621,7 +621,7 @@ class EventSettingsFormView(EventPermissionRequiredMixin, DecoupleMixin, FormVie
 class PaymentSettings(EventSettingsViewMixin, EventSettingsFormView):
    template_name = 'pretixcontrol/event/payment.html'
    form_class = PaymentSettingsForm
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    def get_success_url(self) -> str:
        return reverse('control:event.settings.payment', kwargs={
@@ -650,7 +650,7 @@ class PaymentSettings(EventSettingsViewMixin, EventSettingsFormView):
 class TaxSettings(EventSettingsViewMixin, EventSettingsFormView):
    template_name = 'pretixcontrol/event/tax.html'
    form_class = TaxSettingsForm
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    def get_success_url(self) -> str:
        return reverse('control:event.settings.tax', kwargs={
@@ -670,7 +670,7 @@ class InvoiceSettings(EventSettingsViewMixin, EventSettingsFormView):
    model = Event
    form_class = InvoiceSettingsForm
    template_name = 'pretixcontrol/event/invoicing.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    def get_context_data(self, **kwargs):
        types = get_transmission_types()
@@ -704,7 +704,7 @@ class CancelSettings(EventSettingsViewMixin, EventSettingsFormView):
    model = Event
    form_class = CancelSettingsForm
    template_name = 'pretixcontrol/event/cancel.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    def get_success_url(self) -> str:
        return reverse('control:event.settings.cancel', kwargs={
@@ -738,7 +738,7 @@ class CancelSettings(EventSettingsViewMixin, EventSettingsFormView):


 class InvoicePreview(EventPermissionRequiredMixin, View):
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    def get(self, request, *args, **kwargs):
        fname, ftype, fcontent = build_preview_invoice_pdf(request.event)
@@ -753,7 +753,7 @@ class InvoicePreview(EventPermissionRequiredMixin, View):


 class DangerZone(EventPermissionRequiredMixin, TemplateView):
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    template_name = 'pretixcontrol/event/dangerzone.html'


@@ -769,7 +769,7 @@ class MailSettings(EventSettingsViewMixin, EventSettingsFormView):
    model = Event
    form_class = MailSettingsForm
    template_name = 'pretixcontrol/event/mail.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    def get_success_url(self) -> str:
        return reverse('control:event.settings.mail', kwargs={
@@ -801,7 +801,7 @@ class MailSettings(EventSettingsViewMixin, EventSettingsFormView):


 class MailSettingsSetup(EventPermissionRequiredMixin, MailSettingsSetupView):
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    basetpl = 'pretixcontrol/event/base.html'

    def get_success_url(self) -> str:
@@ -817,7 +817,7 @@ class MailSettingsSetup(EventPermissionRequiredMixin, MailSettingsSetupView):


 class MailSettingsPreview(EventPermissionRequiredMixin, View):
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    # create index-language mapping
    @cached_property
@@ -887,7 +887,7 @@ class MailSettingsPreview(EventPermissionRequiredMixin, View):


 class MailSettingsRendererPreview(MailSettingsPreview):
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    def post(self, request, *args, **kwargs):
        return HttpResponse(status=405)
@@ -935,7 +935,7 @@ class MailSettingsRendererPreview(MailSettingsPreview):


 class TicketSettingsPreview(EventPermissionRequiredMixin, View):
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    @cached_property
    def output(self):
@@ -967,7 +967,7 @@ class TicketSettings(EventSettingsViewMixin, EventPermissionRequiredMixin, FormV
    model = Event
    form_class = TicketSettingsForm
    template_name = 'pretixcontrol/event/tickets.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    def get_context_data(self, *args, **kwargs) -> dict:
        context = super().get_context_data(*args, **kwargs)
@@ -1078,7 +1078,7 @@ class EventPermissions(EventSettingsViewMixin, EventPermissionRequiredMixin, Tem


 class EventLive(EventPermissionRequiredMixin, TemplateView):
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    template_name = 'pretixcontrol/event/live.html'

    def get_context_data(self, **kwargs):
@@ -1145,12 +1145,12 @@ class EventLive(EventPermissionRequiredMixin, TemplateView):


 class EventTransferSession(EventPermissionRequiredMixin, TemplateView):
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    template_name = 'pretixcontrol/event/transfer_session.html'


 class EventDelete(RecentAuthenticationRequiredMixin, EventPermissionRequiredMixin, FormView):
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    template_name = 'pretixcontrol/event/delete.html'
    form_class = EventDeleteForm

@@ -1218,20 +1218,20 @@ class EventLog(EventPermissionRequiredMixin, PaginationMixin, ListView):
            'user', 'content_type', 'api_token', 'oauth_application', 'device'
        ).order_by('-datetime', '-pk')
        qs = qs.exclude(action_type__in=OVERVIEW_BANLIST)
-        if not self.request.user.has_event_permission(self.request.organizer, self.request.event, 'can_view_orders',
+        if not self.request.user.has_event_permission(self.request.organizer, self.request.event, 'event.orders:read',
                                                      request=self.request):
            qs = qs.exclude(content_type=ContentType.objects.get_for_model(Order))
-        if not self.request.user.has_event_permission(self.request.organizer, self.request.event, 'can_view_vouchers',
+        if not self.request.user.has_event_permission(self.request.organizer, self.request.event, 'event.vouchers:read',
                                                      request=self.request):
            qs = qs.exclude(content_type=ContentType.objects.get_for_model(Voucher))
        if not self.request.user.has_event_permission(self.request.organizer, self.request.event,
-                                                      'can_change_event_settings', request=self.request):
+                                                      'event.settings.general:write', request=self.request):
            allowed_types = [
                ContentType.objects.get_for_model(Voucher),
                ContentType.objects.get_for_model(Order)
            ]
            if self.request.user.has_event_permission(self.request.organizer, self.request.event,
-                                                      'can_change_items', request=self.request):
+                                                      'event.items:write', request=self.request):
                allowed_types += [
                    ContentType.objects.get_for_model(Item),
                    ContentType.objects.get_for_model(ItemCategory),
@@ -1268,7 +1268,7 @@ class EventLog(EventPermissionRequiredMixin, PaginationMixin, ListView):


 class EventComment(EventPermissionRequiredMixin, View):
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    def post(self, *args, **kwargs):
        form = CommentForm(self.request.POST)
@@ -1297,7 +1297,7 @@ class TaxCreate(EventSettingsViewMixin, EventPermissionRequiredMixin, CreateView
    model = TaxRule
    form_class = TaxRuleForm
    template_name = 'pretixcontrol/event/tax_edit.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    context_object_name = 'taxrule'

    def get_success_url(self) -> str:
@@ -1358,7 +1358,7 @@ class TaxUpdate(EventSettingsViewMixin, EventPermissionRequiredMixin, UpdateView
    model = TaxRule
    form_class = TaxRuleForm
    template_name = 'pretixcontrol/event/tax_edit.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    context_object_name = 'rule'

    def get_object(self, queryset=None) -> TaxRule:
@@ -1422,7 +1422,7 @@ class TaxUpdate(EventSettingsViewMixin, EventPermissionRequiredMixin, UpdateView

 class TaxDefault(EventSettingsViewMixin, EventPermissionRequiredMixin, DetailView):
    model = TaxRule
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'

    def get_object(self, queryset=None) -> TaxRule:
        try:
@@ -1467,7 +1467,7 @@ class TaxDefault(EventSettingsViewMixin, EventPermissionRequiredMixin, DetailVie
 class TaxDelete(EventSettingsViewMixin, EventPermissionRequiredMixin, CompatDeleteView):
    model = TaxRule
    template_name = 'pretixcontrol/event/tax_delete.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    context_object_name = 'taxrule'

    def get_object(self, queryset=None) -> TaxRule:
@@ -1504,7 +1504,7 @@ class TaxDelete(EventSettingsViewMixin, EventPermissionRequiredMixin, CompatDele

 class WidgetSettings(EventSettingsViewMixin, EventPermissionRequiredMixin, FormView):
    template_name = 'pretixcontrol/event/widget.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    form_class = WidgetCodeForm

    def get_form_kwargs(self):
@@ -1533,7 +1533,7 @@ class WidgetSettings(EventSettingsViewMixin, EventPermissionRequiredMixin, FormV

 class QuickSetupView(FormView):
    template_name = 'pretixcontrol/event/quick_setup.html'
-    permission = 'can_change_event_settings'
+    permission = 'event.settings.general:write'
    form_class = QuickSetupForm

    def dispatch(self, request, *args, **kwargs):
--- a/src/pretix/control/views/item.py
+++ b/src/pretix/control/views/item.py
@@ -159,7 +159,7 @@ def item_move(request, item, up=True):
    messages.success(request, _('The order of items has been updated.'))


-@event_permission_required("can_change_items")
+@event_permission_required("event.items:write")
@require_http_methods(["POST"])
 def item_move_up(request, organizer, event, item):
    item_move(request, item, up=True)
@@ -168,7 +168,7 @@ def item_move_up(request, organizer, event, item):
                    event=request.event.slug)


-@event_permission_required("can_change_items")
+@event_permission_required("event.items:write")
@require_http_methods(["POST"])
 def item_move_down(request, organizer, event, item):
    item_move(request, item, up=False)
@@ -178,7 +178,7 @@ def item_move_down(request, organizer, event, item):


@transaction.atomic
-@event_permission_required("can_change_items")
+@event_permission_required("event.items:write")
@require_http_methods(["POST"])
 def reorder_items(request, organizer, event, category):
    try:
@@ -215,7 +215,7 @@ def reorder_items(request, organizer, event, category):
 class CategoryDelete(EventPermissionRequiredMixin, CompatDeleteView):
    model = ItemCategory
    template_name = 'pretixcontrol/items/category_delete.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'category'

    def get_object(self, queryset=None) -> ItemCategory:
@@ -249,7 +249,7 @@ class CategoryUpdate(EventPermissionRequiredMixin, UpdateView):
    model = ItemCategory
    form_class = CategoryForm
    template_name = 'pretixcontrol/items/category.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'category'

    def get_object(self, queryset=None) -> ItemCategory:
@@ -287,7 +287,7 @@ class CategoryCreate(EventPermissionRequiredMixin, CreateView):
    model = ItemCategory
    form_class = CategoryForm
    template_name = 'pretixcontrol/items/category.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'category'

    def get_success_url(self) -> str:
@@ -371,7 +371,7 @@ def category_move(request, category, up=True):
    messages.success(request, _('The order of categories has been updated.'))


-@event_permission_required("can_change_items")
+@event_permission_required("event.items:write")
@require_http_methods(["POST"])
 def category_move_up(request, organizer, event, category):
    category_move(request, category, up=True)
@@ -380,7 +380,7 @@ def category_move_up(request, organizer, event, category):
                    event=request.event.slug)


-@event_permission_required("can_change_items")
+@event_permission_required("event.items:write")
@require_http_methods(["POST"])
 def category_move_down(request, organizer, event, category):
    category_move(request, category, up=False)
@@ -390,7 +390,7 @@ def category_move_down(request, organizer, event, category):


@transaction.atomic
-@event_permission_required("can_change_items")
+@event_permission_required("event.items:write")
@require_http_methods(["POST"])
 def reorder_categories(request, organizer, event):
    try:
@@ -522,7 +522,7 @@ class QuestionList(ListView):


@transaction.atomic
-@event_permission_required("can_change_items")
+@event_permission_required("event.items:write")
@require_http_methods(["POST"])
 def reorder_questions(request, organizer, event):
    try:
@@ -570,7 +570,7 @@ def reorder_questions(request, organizer, event):
 class QuestionDelete(EventPermissionRequiredMixin, CompatDeleteView):
    model = Question
    template_name = 'pretixcontrol/items/question_delete.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'question'

    def get_object(self, queryset=None) -> Question:
@@ -664,7 +664,7 @@ class QuestionMixin:
 class QuestionView(EventPermissionRequiredMixin, ChartContainingView, DetailView):
    model = Question
    template_name = 'pretixcontrol/items/question.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    template_name_field = 'question'

    @cached_property
@@ -753,7 +753,7 @@ class QuestionUpdate(EventPermissionRequiredMixin, QuestionMixin, UpdateView):
    model = Question
    form_class = QuestionForm
    template_name = 'pretixcontrol/items/question_edit.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'question'

    def get_object(self, queryset=None) -> Question:
@@ -794,7 +794,7 @@ class QuestionCreate(EventPermissionRequiredMixin, QuestionMixin, CreateView):
    model = Question
    form_class = QuestionForm
    template_name = 'pretixcontrol/items/question_edit.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'question'

    def get_form_kwargs(self):
@@ -888,7 +888,7 @@ class QuotaCreate(EventPermissionRequiredMixin, CreateView):
    model = Quota
    form_class = QuotaForm
    template_name = 'pretixcontrol/items/quota_edit.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'quota'

    def get_success_url(self) -> str:
@@ -1055,7 +1055,7 @@ class QuotaView(ChartContainingView, DetailView):
            raise Http404(_("The requested quota does not exist."))

    def post(self, request, *args, **kwargs):
-        if not request.user.has_event_permission(request.organizer, request.event, 'can_change_items', request):
+        if not request.user.has_event_permission(request.organizer, request.event, 'event.items:write', request):
            raise PermissionDenied()
        quota = self.get_object()
        if 'reopen' in request.POST:
@@ -1085,7 +1085,7 @@ class QuotaUpdate(EventPermissionRequiredMixin, UpdateView):
    model = Quota
    form_class = QuotaForm
    template_name = 'pretixcontrol/items/quota_edit.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'quota'

    def get_context_data(self, *args, **kwargs):
@@ -1143,7 +1143,7 @@ class QuotaUpdate(EventPermissionRequiredMixin, UpdateView):
 class QuotaDelete(EventPermissionRequiredMixin, CompatDeleteView):
    model = Quota
    template_name = 'pretixcontrol/items/quota_delete.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'quota'

    def get_object(self, queryset=None) -> Quota:
@@ -1246,7 +1246,7 @@ class MetaDataEditorMixin:
 class ItemCreate(EventPermissionRequiredMixin, MetaDataEditorMixin, CreateView):
    form_class = ItemCreateForm
    template_name = 'pretixcontrol/item/create.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'

    def get_success_url(self) -> str:
        return reverse('control:event.item', kwargs={
@@ -1322,7 +1322,7 @@ class ItemCreate(EventPermissionRequiredMixin, MetaDataEditorMixin, CreateView):
 class ItemUpdateGeneral(ItemDetailMixin, EventPermissionRequiredMixin, MetaDataEditorMixin, UpdateView):
    form_class = ItemUpdateForm
    template_name = 'pretixcontrol/item/index.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'

    @cached_property
    def plugin_forms(self):
@@ -1584,7 +1584,7 @@ class ItemUpdateGeneral(ItemDetailMixin, EventPermissionRequiredMixin, MetaDataE
 class ItemDelete(EventPermissionRequiredMixin, CompatDeleteView):
    model = Item
    template_name = 'pretixcontrol/item/delete.html'
-    permission = 'can_change_items'
+    permission = 'event.items:write'
    context_object_name = 'item'

    def get_context_data(self, *args, **kwargs) -> dict:
--- a/src/pretix/control/views/main.py
+++ b/src/pretix/control/views/main.py
@@ -213,9 +213,9 @@ class EventWizard(SafeSessionWizardView):
            else:
                allow = (
                    request.user.has_event_permission(clone_from.organizer, clone_from,
-                                                      'can_change_event_settings', request)
+                                                      'event.settings.general:write', request)
                    and request.user.has_event_permission(clone_from.organizer, clone_from,
-                                                          'can_change_items', request)
+                                                          'event.items:write', request)
                )
            if not allow:
                messages.error(self.request, _('You do not have permission to clone this event.'))
--- a/src/pretix/control/views/modelimport.py
+++ b/src/pretix/control/views/modelimport.py
@@ -214,7 +214,7 @@ class BaseProcessView(AsyncAction, FormView):

 class OrderImportView(EventPermissionRequiredMixin, BaseImportView):
    template_name = 'pretixcontrol/orders/import_start.html'
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def get_process_url(self, request, cf, charset):
        return reverse('control:event.orders.import.process', kwargs={
@@ -225,7 +225,7 @@ class OrderImportView(EventPermissionRequiredMixin, BaseImportView):


 class OrderProcessView(EventPermissionRequiredMixin, BaseProcessView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    template_name = 'pretixcontrol/orders/import_process.html'
    form_class = OrdersProcessForm
    task = import_orders
@@ -257,7 +257,7 @@ class OrderProcessView(EventPermissionRequiredMixin, BaseProcessView):

 class VoucherImportView(EventPermissionRequiredMixin, BaseImportView):
    template_name = 'pretixcontrol/vouchers/import_start.html'
-    permission = 'can_change_vouchers'
+    permission = 'event.vouchers:write'

    def get_process_url(self, request, cf, charset):
        return reverse('control:event.vouchers.import.process', kwargs={
@@ -268,7 +268,7 @@ class VoucherImportView(EventPermissionRequiredMixin, BaseImportView):


 class VoucherProcessView(EventPermissionRequiredMixin, BaseProcessView):
-    permission = 'can_change_vouchers'
+    permission = 'event.vouchers:write'
    template_name = 'pretixcontrol/vouchers/import_process.html'
    form_class = VouchersProcessForm
    task = import_vouchers
--- a/src/pretix/control/views/orders.py
+++ b/src/pretix/control/views/orders.py
@@ -169,7 +169,7 @@ class OrderSearchMixin:

 class OrderSearch(OrderSearchMixin, EventPermissionRequiredMixin, TemplateView):
    template_name = 'pretixcontrol/orders/search.html'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    def get_context_data(self, **kwargs):
        ctx = super().get_context_data(**kwargs)
@@ -199,7 +199,7 @@ class OrderSearch(OrderSearchMixin, EventPermissionRequiredMixin, TemplateView):

 class BaseOrderBulkActionView(OrderSearchMixin, EventPermissionRequiredMixin, AsyncFormView):
    template_name = 'pretixcontrol/orders/bulk_action.html'
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    form_class = forms.Form

    def get_queryset(self):
@@ -402,7 +402,7 @@ class OrderList(OrderSearchMixin, EventPermissionRequiredMixin, PaginationMixin,
    model = Order
    context_object_name = 'orders'
    template_name = 'pretixcontrol/orders/index.html'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    def get_queryset(self):
        qs = Order.objects.filter(
@@ -526,7 +526,7 @@ class OrderView(EventPermissionRequiredMixin, DetailView):

 class OrderDetail(OrderView):
    template_name = 'pretixcontrol/order/index.html'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    def get_context_data(self, **kwargs):
        ctx = super().get_context_data(**kwargs)
@@ -626,7 +626,7 @@ class OrderDetail(OrderView):

 class OrderTransactions(OrderView):
    template_name = 'pretixcontrol/order/transactions.html'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    def get_context_data(self, **kwargs):
        ctx = super().get_context_data(**kwargs)
@@ -645,7 +645,7 @@ class OrderTransactions(OrderView):

 class OrderDownload(AsyncAction, OrderView):
    task = generate
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    def get_success_url(self, value):
        return self.get_self_url()
@@ -744,7 +744,7 @@ class OrderDownload(AsyncAction, OrderView):


 class OrderComment(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, *args, **kwargs):
        form = CommentForm(self.request.POST)
@@ -784,7 +784,7 @@ class OrderComment(OrderView):


 class OrderApprove(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, *args, **kwargs):
        if self.order.require_approval:
@@ -803,7 +803,7 @@ class OrderApprove(OrderView):


 class OrderDelete(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, *args, **kwargs):
        if self.order.testmode:
@@ -833,7 +833,7 @@ class OrderDelete(OrderView):


 class OrderDeny(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, request, *args, **kwargs):
        if self.order.require_approval:
@@ -859,7 +859,7 @@ class OrderDeny(OrderView):


 class OrderPaymentCancel(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    @cached_property
    def payment(self):
@@ -898,7 +898,7 @@ class OrderPaymentCancel(OrderView):


 class OrderRefundCancel(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    @cached_property
    def refund(self):
@@ -928,7 +928,7 @@ class OrderRefundCancel(OrderView):


 class OrderRefundProcess(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    @cached_property
    def refund(self):
@@ -967,7 +967,7 @@ class OrderRefundProcess(OrderView):


 class OrderRefundDone(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    @cached_property
    def refund(self):
@@ -990,7 +990,7 @@ class OrderRefundDone(OrderView):


 class OrderCancellationRequestDelete(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    @cached_property
    def req(self):
@@ -1024,7 +1024,7 @@ class OrderCancellationRequestDelete(OrderView):


 class OrderPaymentConfirm(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    @cached_property
    def payment(self):
@@ -1078,7 +1078,7 @@ class OrderPaymentConfirm(OrderView):


 class OrderRefundView(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    @cached_property
    def start_form(self):
@@ -1427,7 +1427,7 @@ class OrderRefundView(OrderView):


 class OrderTransition(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    @cached_property
    def req(self):
@@ -1592,7 +1592,7 @@ class OrderTransition(OrderView):


 class OrderInvoiceCreate(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, *args, **kwargs):
        with transaction.atomic():
@@ -1618,7 +1618,7 @@ class OrderInvoiceCreate(OrderView):


 class OrderCheckVATID(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, *args, **kwargs):
        try:
@@ -1666,7 +1666,7 @@ class OrderCheckVATID(OrderView):


 class OrderInvoiceRegenerate(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, *args, **kwargs):
        try:
@@ -1699,7 +1699,7 @@ class OrderInvoiceRegenerate(OrderView):


 class OrderInvoiceRetransmit(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, *args, **kwargs):
        with transaction.atomic(durable=True):
@@ -1730,7 +1730,7 @@ class OrderInvoiceRetransmit(OrderView):


 class OrderInvoiceReissue(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, *args, **kwargs):
        with transaction.atomic():
@@ -1781,7 +1781,7 @@ class OrderInvoiceInspect(AdministratorPermissionRequiredMixin, OrderView):


 class OrderResendLink(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, *args, **kwargs):
        if 'position' in kwargs:
@@ -1798,7 +1798,7 @@ class OrderResendLink(OrderView):


 class InvoiceDownload(EventPermissionRequiredMixin, View):
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    def get_order_url(self):
        return reverse('control:event.order', kwargs={
@@ -1842,7 +1842,7 @@ class InvoiceDownload(EventPermissionRequiredMixin, View):


 class OrderExtend(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def post(self, *args, **kwargs):
        if self.form.is_valid():
@@ -1890,7 +1890,7 @@ class OrderExtend(OrderView):


 class OrderReactivate(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    @cached_property
    def reactivate_form(self):
@@ -1940,7 +1940,7 @@ class OrderReactivate(OrderView):


 class OrderChange(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    template_name = 'pretixcontrol/order/change.html'

    @cached_property
@@ -2197,7 +2197,7 @@ class OrderChange(OrderView):


 class OrderModifyInformation(OrderQuestionsViewMixin, OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    template_name = 'pretixcontrol/order/change_questions.html'
    only_user_visible = False
    all_optional = True
@@ -2250,7 +2250,7 @@ class OrderModifyInformation(OrderQuestionsViewMixin, OrderView):


 class OrderContactChange(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    template_name = 'pretixcontrol/order/change_contact.html'

    def get_context_data(self, **kwargs):
@@ -2265,7 +2265,7 @@ class OrderContactChange(OrderView):
            data=self.request.POST if self.request.method == "POST" else None,
            customers=self.request.organizer.settings.customer_accounts and (
                self.request.user.has_organizer_permission(
-                    self.request.organizer, 'can_manage_customers', request=self.request
+                    self.request.organizer, 'organizer.customers:write', request=self.request
                )
            )
        )
@@ -2334,7 +2334,7 @@ class OrderContactChange(OrderView):


 class OrderLocaleChange(OrderView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    template_name = 'pretixcontrol/order/change_locale.html'

    def get_context_data(self, **kwargs):
@@ -2390,7 +2390,7 @@ class OrderViewMixin:

 class OrderSendMail(EventPermissionRequiredMixin, OrderViewMixin, FormView):
    template_name = 'pretixcontrol/order/sendmail.html'
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    form_class = OrderMailForm

    def get_form_kwargs(self):
@@ -2514,7 +2514,7 @@ class OrderPositionSendMail(OrderSendMail):

 class OrderEmailHistory(EventPermissionRequiredMixin, OrderViewMixin, ListView):
    template_name = 'pretixcontrol/order/mail_history.html'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'
    model = LogEntry
    context_object_name = 'logs'
    paginate_by = 10
@@ -2551,7 +2551,7 @@ class OrderEmailHistory(EventPermissionRequiredMixin, OrderViewMixin, ListView):


 class AnswerDownload(EventPermissionRequiredMixin, OrderViewMixin, ListView):
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    def get(self, request, *args, **kwargs):
        answid = kwargs.get('answer')
@@ -2575,7 +2575,7 @@ class AnswerDownload(EventPermissionRequiredMixin, OrderViewMixin, ListView):

 class OverView(EventPermissionRequiredMixin, TemplateView):
    template_name = 'pretixcontrol/orders/overview.html'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    @cached_property
    def filter_form(self):
@@ -2614,7 +2614,7 @@ class OverView(EventPermissionRequiredMixin, TemplateView):


 class OrderGo(EventPermissionRequiredMixin, View):
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    def get_order(self, code):
        try:
@@ -2699,7 +2699,7 @@ class ExportMixin:
            return ex

    def get_scheduled_queryset(self):
-        if not self.request.user.has_event_permission(self.request.organizer, self.request.event, 'can_change_event_settings',
+        if not self.request.user.has_event_permission(self.request.organizer, self.request.event, 'event.settings.general:write',
                                                      request=self.request):
            qs = self.request.event.scheduled_exports.filter(owner=self.request.user)
        else:
@@ -2726,7 +2726,7 @@ class ExportMixin:


 class ExportDoView(EventPermissionRequiredMixin, ExportMixin, AsyncAction, TemplateView):
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'
    known_errortypes = ['ExportError', 'ExportEmptyError']
    task = export
    template_name = 'pretixcontrol/orders/export_form.html'
@@ -2775,7 +2775,7 @@ class ExportDoView(EventPermissionRequiredMixin, ExportMixin, AsyncAction, Templ


 class ExportView(EventPermissionRequiredMixin, ExportMixin, ListView):
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'
    paginate_by = 25
    context_object_name = 'scheduled'

@@ -2876,7 +2876,7 @@ class ExportView(EventPermissionRequiredMixin, ExportMixin, ListView):
        return self.get_scheduled_queryset()

    def has_permission(self):
-        return self.request.user.has_event_permission(self.request.organizer, self.request.event, "can_view_orders")
+        return self.request.user.has_event_permission(self.request.organizer, self.request.event, "event.orders:read")

    def get_context_data(self, **kwargs):
        ctx = super().get_context_data(**kwargs)
@@ -2895,7 +2895,7 @@ class ExportView(EventPermissionRequiredMixin, ExportMixin, ListView):


 class DeleteScheduledExportView(EventPermissionRequiredMixin, ExportMixin, CompatDeleteView):
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'
    template_name = 'pretixcontrol/orders/export_delete.html'
    context_object_name = 'export'

@@ -2944,7 +2944,7 @@ class RefundList(EventPermissionRequiredMixin, PaginationMixin, ListView):
    model = OrderRefund
    context_object_name = 'refunds'
    template_name = 'pretixcontrol/orders/refunds.html'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    def get_queryset(self):
        qs = OrderRefund.objects.filter(
@@ -2969,7 +2969,7 @@ class RefundList(EventPermissionRequiredMixin, PaginationMixin, ListView):

 class EventCancel(EventPermissionRequiredMixin, AsyncAction, FormView):
    template_name = 'pretixcontrol/orders/cancel.html'
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    form_class = EventCancelForm
    task = cancel_event
    known_errortypes = ['OrderError']
@@ -3054,7 +3054,7 @@ class EventCancel(EventPermissionRequiredMixin, AsyncAction, FormView):

 class EventCancelConfirm(EventPermissionRequiredMixin, AsyncAction, FormView):
    template_name = 'pretixcontrol/orders/cancel_confirm.html'
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    form_class = EventCancelConfirmForm
    task = cancel_event
    known_errortypes = ['OrderError']
--- a/src/pretix/control/views/organizer.py
+++ b/src/pretix/control/views/organizer.py
@@ -245,13 +245,13 @@ class OrganizerDetail(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin
 class OrganizerTeamView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, DetailView):
    model = Organizer
    template_name = 'pretixcontrol/organizers/teams.html'
-    permission = 'can_change_permissions'
+    permission = 'organizer.teams:read'
    context_object_name = 'organizer'


 class OrganizerSettingsFormView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, FormView):
    model = Organizer
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'

    def get_form_kwargs(self):
        kwargs = super().get_form_kwargs()
@@ -282,7 +282,7 @@ class OrganizerSettingsFormView(OrganizerDetailViewMixin, OrganizerPermissionReq
 class OrganizerMailSettings(OrganizerSettingsFormView):
    form_class = MailSettingsForm
    template_name = 'pretixcontrol/organizers/mail.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'

    def get_success_url(self):
        return reverse('control:organizer.settings.mail', kwargs={
@@ -308,7 +308,7 @@ class OrganizerMailSettings(OrganizerSettingsFormView):


 class MailSettingsSetup(OrganizerPermissionRequiredMixin, MailSettingsSetupView):
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    basetpl = 'pretixcontrol/base.html'

    def get_success_url(self):
@@ -323,7 +323,7 @@ class MailSettingsSetup(OrganizerPermissionRequiredMixin, MailSettingsSetupView)


 class MailSettingsPreview(OrganizerPermissionRequiredMixin, View):
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'

    # return the origin text if key is missing in dict
    class SafeDict(dict):
@@ -455,7 +455,7 @@ class OrganizerUpdate(OrganizerPermissionRequiredMixin, UpdateView):
    model = Organizer
    form_class = OrganizerUpdateForm
    template_name = 'pretixcontrol/organizers/edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'organizer'

    @cached_property
@@ -597,7 +597,7 @@ class OrganizerCreate(CreateView):
 class OrganizerPlugins(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, TemplateView, SingleObjectMixin):
    model = Organizer
    context_object_name = 'organizer'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    template_name = 'pretixcontrol/organizers/plugins.html'

    def get_object(self, queryset=None) -> Organizer:
@@ -769,14 +769,14 @@ class OrganizerPlugins(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixi
 class OrganizerPluginEvents(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, FormView):
    model = Organizer
    context_object_name = 'organizer'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    template_name = 'pretixcontrol/organizers/plugin_events.html'
    form_class = OrganizerPluginEventsForm

    def get_form_kwargs(self):
        kwargs = super().get_form_kwargs()
        kwargs["events"] = self.request.user.get_events_with_permission(
-            "can_change_event_settings", request=self.request
+            "event.settings.general:write", request=self.request
        ).filter(organizer=self.request.organizer)
        kwargs["initial"] = {
            "events": self.request.organizer.events.filter(plugins__regex='(^|,)' + self.plugin.module + '(,|$)')
@@ -854,7 +854,7 @@ class OrganizerPluginEvents(OrganizerDetailViewMixin, OrganizerPermissionRequire
 class TeamListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, PaginationMixin, ListView):
    model = Team
    template_name = 'pretixcontrol/organizers/teams.html'
-    permission = 'can_change_teams'
+    permission = 'organizer.teams:write'
    context_object_name = 'teams'

    def get_queryset(self):
@@ -880,7 +880,7 @@ class TeamListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, P
 class TeamCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CreateView):
    model = Team
    template_name = 'pretixcontrol/organizers/team_edit.html'
-    permission = 'can_change_teams'
+    permission = 'organizer.teams:write'
    form_class = TeamForm

    def get_form_kwargs(self):
@@ -917,7 +917,7 @@ class TeamCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin,
 class TeamUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, UpdateView):
    model = Team
    template_name = 'pretixcontrol/organizers/team_edit.html'
-    permission = 'can_change_teams'
+    permission = 'organizer.teams:write'
    context_object_name = 'team'
    form_class = TeamForm

@@ -953,7 +953,7 @@ class TeamUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin,
 class TeamDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CompatDeleteView):
    model = Team
    template_name = 'pretixcontrol/organizers/team_delete.html'
-    permission = 'can_change_teams'
+    permission = 'organizer.teams:write'
    context_object_name = 'team'

    def get_object(self, queryset=None):
@@ -1013,7 +1013,7 @@ class TeamDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin,
 class TeamMemberView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, DetailView):
    template_name = 'pretixcontrol/organizers/team_members.html'
    context_object_name = 'team'
-    permission = 'can_change_teams'
+    permission = 'organizer.teams:write'
    model = Team

    def get_object(self, queryset=None):
@@ -1232,7 +1232,7 @@ class DeviceQueryMixin:
 class DeviceListView(DeviceQueryMixin, OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    model = Device
    template_name = 'pretixcontrol/organizers/devices.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'devices'
    paginate_by = 100

@@ -1245,7 +1245,7 @@ class DeviceListView(DeviceQueryMixin, OrganizerDetailViewMixin, OrganizerPermis
 class DeviceCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CreateView):
    model = Device
    template_name = 'pretixcontrol/organizers/device_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    form_class = DeviceForm

    def get_form_kwargs(self):
@@ -1276,7 +1276,7 @@ class DeviceCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixi

 class DeviceLogView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    template_name = 'pretixcontrol/organizers/device_logs.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    model = LogEntry
    context_object_name = 'logs'
    paginate_by = 20
@@ -1304,7 +1304,7 @@ class DeviceLogView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin,
 class DeviceUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, UpdateView):
    model = Device
    template_name = 'pretixcontrol/organizers/device_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'device'
    form_class = DeviceForm

@@ -1347,7 +1347,7 @@ class DeviceUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixi

 class DeviceBulkUpdateView(DeviceQueryMixin, OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, FormView):
    template_name = 'pretixcontrol/organizers/device_bulk_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'device'
    form_class = DeviceBulkEditForm

@@ -1461,7 +1461,7 @@ class DeviceBulkUpdateView(DeviceQueryMixin, OrganizerDetailViewMixin, Organizer
 class DeviceConnectView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, DetailView):
    model = Device
    template_name = 'pretixcontrol/organizers/device_connect.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'device'

    def get_object(self, queryset=None):
@@ -1493,7 +1493,7 @@ class DeviceConnectView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMix
 class DeviceRevokeView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, DetailView):
    model = Device
    template_name = 'pretixcontrol/organizers/device_revoke.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'device'

    def get_object(self, queryset=None):
@@ -1523,7 +1523,7 @@ class DeviceRevokeView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixi
 class WebHookListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    model = WebHook
    template_name = 'pretixcontrol/organizers/webhooks.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'webhooks'

    def get_queryset(self):
@@ -1533,7 +1533,7 @@ class WebHookListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin
 class WebHookCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CreateView):
    model = WebHook
    template_name = 'pretixcontrol/organizers/webhook_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    form_class = WebHookForm

    def get_form_kwargs(self):
@@ -1567,7 +1567,7 @@ class WebHookCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMix
 class WebHookUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, UpdateView):
    model = WebHook
    template_name = 'pretixcontrol/organizers/webhook_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'webhook'
    form_class = WebHookForm

@@ -1610,7 +1610,7 @@ class WebHookUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMix
 class WebHookLogsView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    model = WebHook
    template_name = 'pretixcontrol/organizers/webhook_logs.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'calls'
    paginate_by = 50

@@ -1652,7 +1652,7 @@ class WebHookLogsView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin
 class GiftCardAcceptanceInviteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, FormView):
    model = GiftCardAcceptance
    template_name = 'pretixcontrol/organizers/giftcard_acceptance_invite.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    form_class = GiftCardAcceptanceInviteForm

    def get_form_kwargs(self):
@@ -1685,7 +1685,7 @@ class GiftCardAcceptanceInviteView(OrganizerDetailViewMixin, OrganizerPermission
 class GiftCardAcceptanceListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    model = GiftCardAcceptance
    template_name = 'pretixcontrol/organizers/giftcard_acceptance_list.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'acceptor_acceptance'
    paginate_by = 50

@@ -1754,7 +1754,7 @@ class GiftCardAcceptanceListView(OrganizerDetailViewMixin, OrganizerPermissionRe
 class GiftCardListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    model = GiftCard
    template_name = 'pretixcontrol/organizers/giftcards.html'
-    permission = 'can_manage_gift_cards'
+    permission = 'organizer.giftcards:write'
    context_object_name = 'giftcards'
    paginate_by = 50

@@ -1777,7 +1777,7 @@ class GiftCardListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixi
        ctx = super().get_context_data(**kwargs)
        ctx['filter_form'] = self.filter_form
        ctx['other_organizers'] = self.request.user.get_organizers_with_permission(
-            'can_manage_gift_cards', self.request
+            'organizer.giftcards:write', self.request
        ).exclude(pk=self.request.organizer.pk)
        return ctx

@@ -1788,7 +1788,7 @@ class GiftCardListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixi

 class GiftCardDetailView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, DetailView):
    template_name = 'pretixcontrol/organizers/giftcard.html'
-    permission = 'can_manage_gift_cards'
+    permission = 'organizer.giftcards:write'
    context_object_name = 'card'

    def get_object(self, queryset=None) -> Organizer:
@@ -1880,7 +1880,7 @@ class GiftCardDetailView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMi

 class GiftCardCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CreateView):
    template_name = 'pretixcontrol/organizers/giftcard_create.html'
-    permission = 'can_manage_gift_cards'
+    permission = 'organizer.giftcards:write'
    form_class = GiftCardCreateForm
    success_url = 'invalid'

@@ -1931,7 +1931,7 @@ class GiftCardCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMi

 class GiftCardUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, UpdateView):
    template_name = 'pretixcontrol/organizers/giftcard_edit.html'
-    permission = 'can_manage_gift_cards'
+    permission = 'organizer.giftcards:write'
    form_class = GiftCardUpdateForm
    success_url = 'invalid'
    context_object_name = 'card'
@@ -2026,7 +2026,7 @@ class ExportMixin:

    @cached_property
    def events(self):
-        return self.request.user.get_events_with_permission('can_view_orders', request=self.request).filter(
+        return self.request.user.get_events_with_permission('event.orders:read', request=self.request).filter(
            organizer=self.request.organizer
        )

@@ -2060,7 +2060,7 @@ class ExportMixin:
        return ctx

    def get_scheduled_queryset(self):
-        if not self.request.user.has_organizer_permission(self.request.organizer, 'can_change_organizer_settings',
+        if not self.request.user.has_organizer_permission(self.request.organizer, 'organizer.settings.general:write',
                                                          request=self.request):
            qs = self.request.organizer.scheduled_exports.filter(owner=self.request.user)
        else:
@@ -2306,7 +2306,7 @@ class RunScheduledExportView(OrganizerPermissionRequiredMixin, ExportMixin, View
 class GateListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    model = Gate
    template_name = 'pretixcontrol/organizers/gates.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'gates'

    def get_queryset(self):
@@ -2316,7 +2316,7 @@ class GateListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, L
 class GateCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CreateView):
    model = Gate
    template_name = 'pretixcontrol/organizers/gate_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    form_class = GateForm

    def get_form_kwargs(self):
@@ -2350,7 +2350,7 @@ class GateCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin,
 class GateUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, UpdateView):
    model = Gate
    template_name = 'pretixcontrol/organizers/gate_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'gate'
    form_class = GateForm

@@ -2385,7 +2385,7 @@ class GateUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin,
 class GateDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CompatDeleteView):
    model = Gate
    template_name = 'pretixcontrol/organizers/gate_delete.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'gate'

    def get_object(self, queryset=None):
@@ -2409,7 +2409,7 @@ class GateDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin,
 class EventMetaPropertyListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    model = EventMetaProperty
    template_name = 'pretixcontrol/organizers/properties.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'properties'

    def get_queryset(self):
@@ -2460,7 +2460,7 @@ class EventMetaPropertyEditorMixin:

 class EventMetaPropertyCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, EventMetaPropertyEditorMixin, CreateView):
    model = EventMetaProperty
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'

    def get_object(self, queryset=None):
        return EventMetaProperty()
@@ -2490,7 +2490,7 @@ class EventMetaPropertyCreateView(OrganizerDetailViewMixin, OrganizerPermissionR

 class EventMetaPropertyUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, EventMetaPropertyEditorMixin, UpdateView):
    model = EventMetaProperty
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'property'

    def get_object(self, queryset=None):
@@ -2522,7 +2522,7 @@ class EventMetaPropertyUpdateView(OrganizerDetailViewMixin, OrganizerPermissionR
 class EventMetaPropertyDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CompatDeleteView):
    model = EventMetaProperty
    template_name = 'pretixcontrol/organizers/property_delete.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'property'

    def get_object(self, queryset=None):
@@ -2566,7 +2566,7 @@ def meta_property_move(request, property, up=True):
    messages.success(request, _('The order of properties has been updated.'))


-@organizer_permission_required("can_change_organizer_settings")
+@organizer_permission_required("organizer.settings.general:write")
@require_http_methods(["POST"])
 def meta_property_move_up(request, organizer, property):
    meta_property_move(request, property, up=True)
@@ -2574,7 +2574,7 @@ def meta_property_move_up(request, organizer, property):
                    organizer=request.organizer.slug)


-@organizer_permission_required("can_change_organizer_settings")
+@organizer_permission_required("organizer.settings.general:write")
@require_http_methods(["POST"])
 def meta_property_move_down(request, organizer, property):
    meta_property_move(request, property, up=False)
@@ -2583,7 +2583,7 @@ def meta_property_move_down(request, organizer, property):


@transaction.atomic
-@organizer_permission_required("can_change_organizer_settings")
+@organizer_permission_required("organizer.settings.general:write")
@require_http_methods(["POST"])
 def reorder_meta_properties(request, organizer):
    try:
@@ -2615,7 +2615,7 @@ def reorder_meta_properties(request, organizer):

 class LogView(OrganizerPermissionRequiredMixin, PaginationMixin, ListView):
    template_name = 'pretixcontrol/organizers/logs.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    model = LogEntry
    context_object_name = 'logs'

@@ -2640,7 +2640,7 @@ class LogView(OrganizerPermissionRequiredMixin, PaginationMixin, ListView):
 class MembershipTypeListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    model = MembershipType
    template_name = 'pretixcontrol/organizers/membershiptypes.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'types'

    def get_queryset(self):
@@ -2650,7 +2650,7 @@ class MembershipTypeListView(OrganizerDetailViewMixin, OrganizerPermissionRequir
 class MembershipTypeCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CreateView):
    model = MembershipType
    template_name = 'pretixcontrol/organizers/membershiptype_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    form_class = MembershipTypeForm

    def get_object(self, queryset=None):
@@ -2684,7 +2684,7 @@ class MembershipTypeCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequ
 class MembershipTypeUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, UpdateView):
    model = MembershipType
    template_name = 'pretixcontrol/organizers/membershiptype_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'type'
    form_class = MembershipTypeForm

@@ -2719,7 +2719,7 @@ class MembershipTypeUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequ
 class MembershipTypeDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CompatDeleteView):
    model = MembershipType
    template_name = 'pretixcontrol/organizers/membershiptype_delete.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'type'

    def get_object(self, queryset=None):
@@ -2749,7 +2749,7 @@ class MembershipTypeDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequ
 class SSOProviderListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    model = CustomerSSOProvider
    template_name = 'pretixcontrol/organizers/ssoproviders.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'providers'

    def get_queryset(self):
@@ -2759,7 +2759,7 @@ class SSOProviderListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredM
 class SSOProviderCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CreateView):
    model = CustomerSSOProvider
    template_name = 'pretixcontrol/organizers/ssoprovider_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    form_class = SSOProviderForm

    def get_object(self, queryset=None):
@@ -2793,7 +2793,7 @@ class SSOProviderCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequire
 class SSOProviderUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, UpdateView):
    model = CustomerSSOProvider
    template_name = 'pretixcontrol/organizers/ssoprovider_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'provider'
    form_class = SSOProviderForm

@@ -2835,7 +2835,7 @@ class SSOProviderUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequire
 class SSOProviderDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CompatDeleteView):
    model = CustomerSSOProvider
    template_name = 'pretixcontrol/organizers/ssoprovider_delete.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'provider'

    def get_object(self, queryset=None):
@@ -2865,7 +2865,7 @@ class SSOProviderDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequire
 class SSOClientListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    model = CustomerSSOClient
    template_name = 'pretixcontrol/organizers/ssoclients.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'clients'

    def get_queryset(self):
@@ -2875,7 +2875,7 @@ class SSOClientListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMix
 class SSOClientCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CreateView):
    model = CustomerSSOClient
    template_name = 'pretixcontrol/organizers/ssoclient_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    form_class = SSOClientForm

    def get_object(self, queryset=None):
@@ -2915,7 +2915,7 @@ class SSOClientCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredM
 class SSOClientUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, UpdateView):
    model = CustomerSSOClient
    template_name = 'pretixcontrol/organizers/ssoclient_edit.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'client'
    form_class = SSOClientForm

@@ -2965,7 +2965,7 @@ class SSOClientUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredM
 class SSOClientDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CompatDeleteView):
    model = CustomerSSOClient
    template_name = 'pretixcontrol/organizers/ssoclient_delete.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'client'

    def get_object(self, queryset=None):
@@ -2995,7 +2995,7 @@ class SSOClientDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredM
 class CustomerListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, PaginationMixin, ListView):
    model = Customer
    template_name = 'pretixcontrol/organizers/customers.html'
-    permission = 'can_manage_customers'
+    permission = 'organizer.customers:write'
    context_object_name = 'customers'

    def get_queryset(self):
@@ -3016,7 +3016,7 @@ class CustomerListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixi

 class CustomerDetailView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, PaginationMixin, ListView):
    template_name = 'pretixcontrol/organizers/customer.html'
-    permission = 'can_manage_customers'
+    permission = 'organizer.customers:write'
    context_object_name = 'orders'

    def get_queryset(self):
@@ -3132,7 +3132,7 @@ class CustomerDetailView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMi

 class CustomerCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CreateView):
    template_name = 'pretixcontrol/organizers/customer_edit.html'
-    permission = 'can_manage_customers'
+    permission = 'organizer.customers:write'
    context_object_name = 'customer'
    form_class = CustomerCreateForm

@@ -3162,7 +3162,7 @@ class CustomerCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMi

 class CustomerUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, UpdateView):
    template_name = 'pretixcontrol/organizers/customer_edit.html'
-    permission = 'can_manage_customers'
+    permission = 'organizer.customers:write'
    context_object_name = 'customer'
    form_class = CustomerUpdateForm

@@ -3191,7 +3191,7 @@ class CustomerUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMi

 class MembershipUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, UpdateView):
    template_name = 'pretixcontrol/organizers/customer_membership.html'
-    permission = 'can_manage_customers'
+    permission = 'organizer.customers:write'
    context_object_name = 'membership'
    form_class = MembershipUpdateForm

@@ -3231,7 +3231,7 @@ class MembershipUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequired

 class MembershipDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CompatDeleteView):
    template_name = 'pretixcontrol/organizers/customer_membership_delete.html'
-    permission = 'can_manage_customers'
+    permission = 'organizer.customers:write'
    context_object_name = 'membership'

    def get_object(self, queryset=None):
@@ -3269,7 +3269,7 @@ class MembershipDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequired

 class MembershipCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CreateView):
    template_name = 'pretixcontrol/organizers/customer_membership.html'
-    permission = 'can_manage_customers'
+    permission = 'organizer.customers:write'
    context_object_name = 'membership'
    form_class = MembershipUpdateForm

@@ -3308,7 +3308,7 @@ class MembershipCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequired

 class CustomerAnonymizeView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, DetailView):
    template_name = 'pretixcontrol/organizers/customer_anonymize.html'
-    permission = 'can_manage_customers'
+    permission = 'organizer.customers:write'
    context_object_name = 'customer'

    def get_object(self, queryset=None):
@@ -3335,7 +3335,7 @@ class CustomerAnonymizeView(OrganizerDetailViewMixin, OrganizerPermissionRequire
 class ReusableMediaListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, PaginationMixin, ListView):
    model = ReusableMedium
    template_name = 'pretixcontrol/organizers/reusable_media.html'
-    permission = 'can_manage_reusable_media'
+    permission = 'organizer.reusablemedia:read'
    context_object_name = 'media'

    def get_queryset(self):
@@ -3359,7 +3359,7 @@ class ReusableMediaListView(OrganizerDetailViewMixin, OrganizerPermissionRequire

 class ReusableMediumDetailView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, TemplateView):
    template_name = 'pretixcontrol/organizers/reusable_medium.html'
-    permission = 'can_manage_reusable_media'
+    permission = 'organizer.reusablemedia:read'

    @cached_property
    def medium(self):
@@ -3376,7 +3376,7 @@ class ReusableMediumDetailView(OrganizerDetailViewMixin, OrganizerPermissionRequ

 class ReusableMediumCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CreateView):
    template_name = 'pretixcontrol/organizers/reusable_medium_edit.html'
-    permission = 'can_manage_reusable_media'
+    permission = 'organizer.reusablemedia:write'
    context_object_name = 'medium'
    form_class = ReusableMediumCreateForm

@@ -3405,7 +3405,7 @@ class ReusableMediumCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequ

 class ReusableMediumUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, UpdateView):
    template_name = 'pretixcontrol/organizers/reusable_medium_edit.html'
-    permission = 'can_manage_reusable_media'
+    permission = 'organizer.reusablemedia:write'
    context_object_name = 'medium'
    form_class = ReusableMediumUpdateForm

@@ -3435,7 +3435,7 @@ class ReusableMediumUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequ
 class ChannelListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ListView):
    model = SalesChannel
    template_name = 'pretixcontrol/organizers/channels.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'channels'

    def get_queryset(self):
@@ -3454,7 +3454,7 @@ class ChannelEditorMixin:

 class ChannelCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ChannelEditorMixin, CreateView):
    model = SalesChannel
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    template_name = 'pretixcontrol/organizers/channel_add.html'

    def get_object(self, queryset=None):
@@ -3526,7 +3526,7 @@ class ChannelCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMix

 class ChannelUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, ChannelEditorMixin, UpdateView):
    model = SalesChannel
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'channel'
    template_name = 'pretixcontrol/organizers/channel_edit.html'

@@ -3571,7 +3571,7 @@ class ChannelUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMix
 class ChannelDeleteView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, CompatDeleteView):
    model = SalesChannel
    template_name = 'pretixcontrol/organizers/channel_delete.html'
-    permission = 'can_change_organizer_settings'
+    permission = 'organizer.settings.general:write'
    context_object_name = 'channel'

    def get_object(self, queryset=None):
@@ -3627,7 +3627,7 @@ def channel_move(request, channel, up=True):
    messages.success(request, _('The order of sales channels has been updated.'))


-@organizer_permission_required("can_change_organizer_settings")
+@organizer_permission_required("organizer.settings.general:write")
@require_http_methods(["POST"])
 def channel_move_up(request, organizer, channel):
    channel_move(request, channel, up=True)
@@ -3635,7 +3635,7 @@ def channel_move_up(request, organizer, channel):
                    organizer=request.organizer.slug)


-@organizer_permission_required("can_change_organizer_settings")
+@organizer_permission_required("organizer.settings.general:write")
@require_http_methods(["POST"])
 def channel_move_down(request, organizer, channel):
    channel_move(request, channel, up=False)
@@ -3644,7 +3644,7 @@ def channel_move_down(request, organizer, channel):


@transaction.atomic
-@organizer_permission_required("can_change_organizer_settings")
+@organizer_permission_required("organizer.settings.general:write")
@require_http_methods(["POST"])
 def reorder_channels(request, organizer):
    try:
--- a/src/pretix/control/views/pdf.py
+++ b/src/pretix/control/views/pdf.py
@@ -58,7 +58,7 @@ logger = logging.getLogger(__name__)

 class BaseEditorView(EventPermissionRequiredMixin, TemplateView):
    template_name = 'pretixcontrol/pdf/index.html'
-    permission = 'can_change_settings'
+    permission = 'event.settings.general:write'
    accepted_formats = (
        'application/pdf',
    )
--- a/src/pretix/control/views/search.py
+++ b/src/pretix/control/views/search.py
@@ -85,7 +85,7 @@ class OrderSearch(PaginationMixin, ListView):

        if not self.request.user.has_active_staff_session(self.request.session.session_key):
            qs = qs.filter(
-                Q(event_id__in=self.request.user.get_events_with_permission('can_view_orders').values_list('id', flat=True))
+                Q(event_id__in=self.request.user.get_events_with_permission('event.orders:read').values_list('id', flat=True))
            )

        if self.filter_form.is_valid():
@@ -159,7 +159,7 @@ class PaymentSearch(PaginationMixin, ListView):

        if not self.request.user.has_active_staff_session(self.request.session.session_key):
            qs = qs.filter(
-                Q(order__event_id__in=self.request.user.get_events_with_permission('can_view_orders').values_list('id', flat=True))
+                Q(order__event_id__in=self.request.user.get_events_with_permission('event.orders:read').values_list('id', flat=True))
            )

        if self.filter_form.is_valid():
--- a/src/pretix/control/views/shredder.py
+++ b/src/pretix/control/views/shredder.py
@@ -76,7 +76,7 @@ class ShredderMixin:


 class StartShredView(RecentAuthenticationRequiredMixin, EventPermissionRequiredMixin, ShredderMixin, TemplateView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    template_name = 'pretixcontrol/shredder/index.html'

    def get_context_data(self, **kwargs):
@@ -87,7 +87,7 @@ class StartShredView(RecentAuthenticationRequiredMixin, EventPermissionRequiredM


 class ShredDownloadView(RecentAuthenticationRequiredMixin, EventPermissionRequiredMixin, ShredderMixin, TemplateView):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    template_name = 'pretixcontrol/shredder/download.html'

    def get_context_data(self, **kwargs):
@@ -119,7 +119,7 @@ class ShredDownloadView(RecentAuthenticationRequiredMixin, EventPermissionRequir


 class ShredExportView(RecentAuthenticationRequiredMixin, EventPermissionRequiredMixin, ShredderMixin, AsyncAction, View):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    task = export
    known_errortypes = ['ShredError']

@@ -148,7 +148,7 @@ class ShredExportView(RecentAuthenticationRequiredMixin, EventPermissionRequired


 class ShredDoView(RecentAuthenticationRequiredMixin, EventPermissionRequiredMixin, ShredderMixin, AsyncAction, View):
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    task = shred
    known_errortypes = ['ShredError']

--- a/src/pretix/control/views/subevents.py
+++ b/src/pretix/control/views/subevents.py
@@ -117,7 +117,7 @@ class SubEventList(EventPermissionRequiredMixin, PaginationMixin, SubEventQueryM
    model = SubEvent
    context_object_name = 'subevents'
    template_name = 'pretixcontrol/subevents/index.html'
-    permission = 'can_change_settings'
+    permission = 'event.settings.general:write'

    def get_queryset(self):
        return super().get_queryset(True).prefetch_related(
@@ -156,7 +156,7 @@ class SubEventList(EventPermissionRequiredMixin, PaginationMixin, SubEventQueryM
 class SubEventDelete(EventPermissionRequiredMixin, CompatDeleteView):
    model = SubEvent
    template_name = 'pretixcontrol/subevents/delete.html'
-    permission = 'can_change_settings'
+    permission = 'event.settings.general:write'
    context_object_name = 'subevents'

    def get_object(self, queryset=None) -> SubEvent:
@@ -241,7 +241,7 @@ class SubEventEditorMixin(MetaDataEditorMixin):
            property=p,
            disabled=(
                p.protected and
-                not self.request.user.has_organizer_permission(self.request.organizer, 'can_change_organizer_settings', request=self.request)
+                not self.request.user.has_organizer_permission(self.request.organizer, 'organizer.settings.general:write', request=self.request)
            ),
            default=self._default_meta.get(p.name, ''),
            instance=val_instances.get(p.pk, self.meta_model(property=p, subevent=self.object)),
@@ -508,7 +508,7 @@ class SubEventEditorMixin(MetaDataEditorMixin):
 class SubEventUpdate(EventPermissionRequiredMixin, SubEventEditorMixin, UpdateView):
    model = SubEvent
    template_name = 'pretixcontrol/subevents/detail.html'
-    permission = 'can_change_settings'
+    permission = 'event.settings.general:write'
    context_object_name = 'subevent'
    form_class = SubEventForm

@@ -575,7 +575,7 @@ class SubEventUpdate(EventPermissionRequiredMixin, SubEventEditorMixin, UpdateVi
 class SubEventCreate(SubEventEditorMixin, EventPermissionRequiredMixin, CreateView):
    model = SubEvent
    template_name = 'pretixcontrol/subevents/detail.html'
-    permission = 'can_change_settings'
+    permission = 'event.settings.general:write'
    context_object_name = 'subevent'
    form_class = SubEventForm

@@ -669,7 +669,7 @@ class SubEventCreate(SubEventEditorMixin, EventPermissionRequiredMixin, CreateVi


 class SubEventBulkAction(SubEventQueryMixin, EventPermissionRequiredMixin, View):
-    permission = 'can_change_settings'
+    permission = 'event.settings.general:write'

    @transaction.atomic
    def post(self, request, *args, **kwargs):
@@ -740,7 +740,7 @@ class SubEventBulkAction(SubEventQueryMixin, EventPermissionRequiredMixin, View)
 class SubEventBulkCreate(SubEventEditorMixin, EventPermissionRequiredMixin, AsyncFormView):
    model = SubEvent
    template_name = 'pretixcontrol/subevents/bulk.html'
-    permission = 'can_change_settings'
+    permission = 'event.settings.general:write'
    context_object_name = 'subevent'
    form_class = SubEventBulkForm
    itemformclass = BulkSubEventItemForm
@@ -1065,7 +1065,7 @@ class SubEventBulkCreate(SubEventEditorMixin, EventPermissionRequiredMixin, Asyn


 class SubEventBulkEdit(SubEventQueryMixin, EventPermissionRequiredMixin, FormView):
-    permission = 'can_change_settings'
+    permission = 'event.settings.general:write'
    form_class = SubEventBulkEditForm
    template_name = 'pretixcontrol/subevents/bulk_edit.html'
    context_object_name = 'subevent'
--- a/src/pretix/control/views/typeahead.py
+++ b/src/pretix/control/views/typeahead.py
@@ -173,7 +173,7 @@ def event_list(request):
    return JsonResponse(doc)


-@organizer_permission_required(("can_manage_gift_cards", "can_manage_reusable_media"))
+@organizer_permission_required(("organizer.giftcards:read", "organizer.reusablemedia:write"))
 def giftcard_select2(request, **kwargs):
    query = request.GET.get('query', '')
    try:
@@ -181,7 +181,7 @@ def giftcard_select2(request, **kwargs):
    except ValueError:
        page = 1

-    if request.user.has_organizer_permission(request.organizer, 'can_manage_gift_cards', request):
+    if request.user.has_organizer_permission(request.organizer, 'organizer.giftcards:write', request):
        qs = request.organizer.issued_gift_cards.filter(
            Q(secret__icontains=query)
        ).order_by('secret')
@@ -211,7 +211,7 @@ def giftcard_select2(request, **kwargs):
    return JsonResponse(doc)


-@organizer_permission_required(("can_manage_reusable_media", "can_manage_gift_cards"))
+@organizer_permission_required(("organizer.reusablemedia:write", "organizer.giftcards:write"))
 def ticket_select2(request, **kwargs):
    query = request.GET.get('query', '')
    try:
@@ -276,7 +276,7 @@ def ticket_select2(request, **kwargs):
    return JsonResponse(doc)


-@organizer_permission_required("can_manage_customers")
+@organizer_permission_required("organizer.customers:write")
 def customer_select2(request, **kwargs):
    query = request.GET.get('query', '')
    try:
@@ -1013,7 +1013,7 @@ def item_meta_values(request, organizer, event):
    })


-@organizer_permission_required(("can_view_orders", "can_change_organizer_settings"))
+@organizer_permission_required(("event.orders:read", "organizer.settings.general:write"))
 # This decorator is a bit of a hack since this is not technically an organizer permission, but it does the job here --
 # anyone who can see orders for any event can see the check-in log view where this is used as a filter
 def devices_select2(request, **kwargs):
@@ -1051,7 +1051,7 @@ def devices_select2(request, **kwargs):
    return JsonResponse(doc)


-@organizer_permission_required(("can_view_orders", "can_change_event_settings", "can_change_organizer_settings"))
+@organizer_permission_required(("event.orders:read", "event.settings.general:write", "organizer.settings.general:write"))
 # This decorator is a bit of a hack since this is not technically an organizer permission, but it does the job here --
 # anyone who can see orders for any event can see the check-in log view where this is used as a filter
 def gate_select2(request, **kwargs):
--- a/src/pretix/control/views/vouchers.py
+++ b/src/pretix/control/views/vouchers.py
@@ -83,7 +83,7 @@ class VoucherList(PaginationMixin, EventPermissionRequiredMixin, ListView):
    model = Voucher
    context_object_name = 'vouchers'
    template_name = 'pretixcontrol/vouchers/index.html'
-    permission = 'can_view_vouchers'
+    permission = 'event.vouchers:read'

    @scopes_disabled()  # we have an event check here, and we can save some performance on subqueries
    def get_queryset(self):
@@ -155,7 +155,7 @@ class VoucherList(PaginationMixin, EventPermissionRequiredMixin, ListView):

 class VoucherTags(EventPermissionRequiredMixin, TemplateView):
    template_name = 'pretixcontrol/vouchers/tags.html'
-    permission = 'can_view_vouchers'
+    permission = 'event.vouchers:read'

    def get_queryset(self):
        qs = self.request.event.vouchers.order_by('tag').filter(
@@ -196,7 +196,7 @@ class VoucherTags(EventPermissionRequiredMixin, TemplateView):
 class VoucherDeleteCarts(EventPermissionRequiredMixin, CompatDeleteView):
    model = Voucher
    template_name = 'pretixcontrol/vouchers/delete_carts.html'
-    permission = 'can_change_vouchers'
+    permission = 'event.vouchers:write'
    context_object_name = 'voucher'

    def get_object(self, queryset=None) -> Voucher:
@@ -228,7 +228,7 @@ class VoucherDeleteCarts(EventPermissionRequiredMixin, CompatDeleteView):
 class VoucherDelete(EventPermissionRequiredMixin, CompatDeleteView):
    model = Voucher
    template_name = 'pretixcontrol/vouchers/delete.html'
-    permission = 'can_change_vouchers'
+    permission = 'event.vouchers:write'
    context_object_name = 'voucher'

    def get_object(self, queryset=None) -> Voucher:
@@ -270,7 +270,7 @@ class VoucherDelete(EventPermissionRequiredMixin, CompatDeleteView):
 class VoucherUpdate(EventPermissionRequiredMixin, UpdateView):
    model = Voucher
    template_name = 'pretixcontrol/vouchers/detail.html'
-    permission = ('can_change_vouchers', 'can_view_vouchers')
+    permission = ('event.vouchers:write', 'event.vouchers:read')
    context_object_name = 'voucher'

    def form_invalid(self, form):
@@ -286,7 +286,7 @@ class VoucherUpdate(EventPermissionRequiredMixin, UpdateView):

    def get_form(self, form_class=None):
        form = super().get_form(form_class)
-        if not self.request.user.has_event_permission(self.request.organizer, self.request.event, 'can_change_vouchers',
+        if not self.request.user.has_event_permission(self.request.organizer, self.request.event, 'event.vouchers:write',
                                                      request=self.request):
            for f in form.fields.values():
                f.disabled = True
@@ -313,7 +313,7 @@ class VoucherUpdate(EventPermissionRequiredMixin, UpdateView):

    @transaction.atomic
    def post(self, request, *args, **kwargs):
-        if not request.user.has_event_permission(request.organizer, request.event, 'can_change_vouchers',
+        if not request.user.has_event_permission(request.organizer, request.event, 'event.vouchers:write',
                                                 request=request):
            raise PermissionDenied()
        return super().post(request, *args, **kwargs)
@@ -344,7 +344,7 @@ class VoucherUpdate(EventPermissionRequiredMixin, UpdateView):
 class VoucherCreate(EventPermissionRequiredMixin, CreateView):
    model = Voucher
    template_name = 'pretixcontrol/vouchers/detail.html'
-    permission = 'can_change_vouchers'
+    permission = 'event.vouchers:write'
    context_object_name = 'voucher'

    def form_invalid(self, form):
@@ -389,7 +389,7 @@ class VoucherCreate(EventPermissionRequiredMixin, CreateView):


 class VoucherGo(EventPermissionRequiredMixin, View):
-    permission = 'can_view_vouchers'
+    permission = 'event.vouchers:read'

    def get_voucher(self, code):
        return Voucher.objects.get(code__iexact=code, event=self.request.event)
@@ -408,7 +408,7 @@ class VoucherGo(EventPermissionRequiredMixin, View):
 class VoucherBulkCreate(EventPermissionRequiredMixin, AsyncFormView):
    model = Voucher
    template_name = 'pretixcontrol/vouchers/bulk.html'
-    permission = 'can_change_vouchers'
+    permission = 'event.vouchers:write'
    context_object_name = 'voucher'
    atomic_execute = True

@@ -540,7 +540,7 @@ class VoucherBulkCreate(EventPermissionRequiredMixin, AsyncFormView):


 class VoucherBulkMailPreview(EventPermissionRequiredMixin, View):
-    permission = 'can_change_vouchers'
+    permission = 'event.vouchers:write'

    # return the origin text if key is missing in dict
    class SafeDict(dict):
@@ -579,7 +579,7 @@ class VoucherBulkMailPreview(EventPermissionRequiredMixin, View):


 class VoucherRNG(EventPermissionRequiredMixin, View):
-    permission = 'can_change_vouchers'
+    permission = 'event.vouchers:write'

    def get(self, request, *args, **kwargs):
        try:
@@ -603,7 +603,7 @@ class VoucherRNG(EventPermissionRequiredMixin, View):


 class VoucherBulkAction(EventPermissionRequiredMixin, View):
-    permission = 'can_change_vouchers'
+    permission = 'event.vouchers:write'

    @cached_property
    def objects(self):
--- a/src/pretix/control/views/waitinglist.py
+++ b/src/pretix/control/views/waitinglist.py
@@ -64,7 +64,7 @@ from . import UpdateView
 class AutoAssign(EventPermissionRequiredMixin, AsyncAction, View):
    task = assign_automatically
    known_errortypes = ['WaitingListError']
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def get_success_message(self, value):
        return _('{num} vouchers have been created and sent out via email.').format(num=value)
@@ -154,7 +154,7 @@ class WaitingListQuerySetMixin:

 class WaitingListActionView(EventPermissionRequiredMixin, WaitingListQuerySetMixin, View):
    model = WaitingListEntry
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'

    def _redirect_back(self):
        if "next" in self.request.GET and url_has_allowed_host_and_scheme(self.request.GET.get("next"), allowed_hosts=None):
@@ -244,7 +244,7 @@ class WaitingListView(EventPermissionRequiredMixin, WaitingListQuerySetMixin, Pa
    model = WaitingListEntry
    context_object_name = 'entries'
    template_name = 'pretixcontrol/waitinglist/index.html'
-    permission = 'can_view_orders'
+    permission = 'event.orders:read'

    def get_context_data(self, **kwargs):
        ctx = super().get_context_data(**kwargs)
@@ -371,7 +371,7 @@ class WaitingListView(EventPermissionRequiredMixin, WaitingListQuerySetMixin, Pa
 class EntryDelete(EventPermissionRequiredMixin, CompatDeleteView):
    model = WaitingListEntry
    template_name = 'pretixcontrol/waitinglist/delete.html'
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    context_object_name = 'entry'

    def get_object(self, queryset=None) -> WaitingListEntry:
@@ -404,7 +404,7 @@ class EntryDelete(EventPermissionRequiredMixin, CompatDeleteView):
 class EntryEdit(EventPermissionRequiredMixin, UpdateView):
    model = WaitingListEntry
    template_name = 'pretixcontrol/waitinglist/edit.html'
-    permission = 'can_change_orders'
+    permission = 'event.orders:write'
    form_class = WaitingListEntryEditForm
    context_object_name = 'entry'