From acad153ea223d94281c08df4f859ee3352979b96 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Tue, 4 Aug 2026 09:12:05 +0200 Subject: [PATCH] PDF editor: Harden cached file access for background (Z#23242291) --- src/pretix/control/views/pdf.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/pretix/control/views/pdf.py b/src/pretix/control/views/pdf.py index fc935df80e..318e7b0c01 100644 --- a/src/pretix/control/views/pdf.py +++ b/src/pretix/control/views/pdf.py @@ -27,6 +27,7 @@ from decimal import Decimal from io import BytesIO from django.conf import settings +from django.core.exceptions import PermissionDenied from django.core.files import File from django.core.files.base import ContentFile from django.core.files.storage import default_storage @@ -193,6 +194,7 @@ class BaseEditorView(EventPermissionRequiredMixin, TemplateView): c.expires = now() + timedelta(days=7) c.date = now() c.filename = 'background_preview.pdf' + c.bind_to_session(request, "ticketoutput-pdf-background") c.type = 'application/pdf' c.save() c.file.save('empty.pdf', ContentFile(buffer.read())) @@ -218,6 +220,7 @@ class BaseEditorView(EventPermissionRequiredMixin, TemplateView): c.expires = now() + timedelta(days=7) c.date = now() c.filename = 'background_preview.pdf' + c.bind_to_session(request, "ticketoutput-pdf-background") c.type = 'application/pdf' c.file = fileobj c.save() @@ -303,5 +306,7 @@ class FontsCSSView(TemplateView): class PdfView(TemplateView): def get(self, request, *args, **kwargs): cf = get_object_or_404(CachedFile, id=kwargs.get("filename"), filename="background_preview.pdf") + if not cf.allowed_for_session(request, "ticketoutput-pdf-background"): + raise PermissionDenied() resp = FileResponse(cf.file, filename=cf.filename, content_type='application/pdf') return resp