CGM_Public/pretix_original
2
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-08 10:27:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SECURITY] Add missing permission check for view (CVE-2026-57532)

Browse Source
This commit is contained in:
Raphael Michel
2026-07-28 12:26:45 +02:00
parent 15bfa2b2ce
commit ad0b5776b6
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/control/views/event.py
+1 -1
View File
@@ -1554,7 +1554,7 @@ class WidgetSettings(EventSettingsViewMixin, EventPermissionRequiredMixin, FormV
return ctx
class QuickSetupView(FormView):
class QuickSetupView(EventPermissionRequiredMixin, FormView):
template_name = 'pretixcontrol/event/quick_setup.html'
permission = 'event.settings.general:write'
form_class = QuickSetupForm
src/tests/control/test_permissions.py
+2
View File
@@ -90,6 +90,7 @@ event_urls = [
"delete/",
"dangerzone/",
"cancel/",
"quickstart/",
"settings/",
"settings/plugins",
"settings/payment",
@@ -310,6 +311,7 @@ event_permission_urls = [
("event.settings.general:write", "live/", 200, HTTP_GET),
("event.settings.general:write", "delete/", 200, HTTP_GET),
("event.settings.general:write", "dangerzone/", 200, HTTP_GET),
("event.settings.general:write", "quickstart/", 200, HTTP_GET),
("event.settings.general:write", "settings/", 200, HTTP_GET),
# ("event.settings.payment:write", "settings/payment", 200, HTTP_GET), GET allowed also with other permissions
("event.settings.payment:write", "settings/payment", 200, HTTP_POST),