diff --git a/src/pretix/api/serializers/event.py b/src/pretix/api/serializers/event.py index 4fa4e99a37..d1debdeacc 100644 --- a/src/pretix/api/serializers/event.py +++ b/src/pretix/api/serializers/event.py @@ -709,7 +709,7 @@ class TaxRuleSerializer(CountryFieldMixin, I18nAwareModelSerializer): class EventSettingsSerializer(SettingsSerializer): default_write_permission = 'event.settings.general:write' default_fields = [ - # These are readable for all users with access to the events, therefore secrets made in the settings store + # These are readable for all users with access to the events, therefore secrets stored in the settings store # should not be included! 'imprint_url', 'checkout_email_helptext', diff --git a/src/pretix/api/serializers/organizer.py b/src/pretix/api/serializers/organizer.py index 93a6e69310..af6b6d9bad 100644 --- a/src/pretix/api/serializers/organizer.py +++ b/src/pretix/api/serializers/organizer.py @@ -553,7 +553,7 @@ class TeamMemberSerializer(serializers.ModelSerializer): class OrganizerSettingsSerializer(SettingsSerializer): default_write_permission = 'organizer.settings.general:write' default_fields = [ - # These are readable for all users with access to the events, therefore secrets made in the settings store + # These are readable for all users with access to the events, therefore secrets stored in the settings store # should not be included! 'customer_accounts', 'customer_accounts_native', diff --git a/src/pretix/base/signals.py b/src/pretix/base/signals.py index e91ec94185..a4e82487e2 100644 --- a/src/pretix/base/signals.py +++ b/src/pretix/base/signals.py @@ -1118,7 +1118,7 @@ api_event_settings_fields = EventPluginSignal() This signal is sent out to collect serializable settings fields for the API. You are expected to return a dictionary mapping names of attributes in the settings store to DRF serializer field instances. -These are readable for all users with access to the events, therefore secrets made in the settings store +These are readable for all users with access to the events, therefore secrets stored in the settings store should not be included! As with all event-plugin signals, the ``sender`` keyword argument will contain the event.