Order import: Do not allow importing variation for wrong item (Z#23211320) (#5553)

* Order import: Do not allow importing variation for wrong item (Z#23211320)

* Fix test

src/pretix/base/modelimport_orders.py

@@ -175,7 +175,7 @@ class Variation(ImportColumn):
         if value:
             matches = [
                 p for p in self.items
-                if str(p.pk) == value or any((v and v == value) for v in i18n_flat(p.value)) and p.item_id == previous_values['item'].pk
+                if (str(p.pk) == value or any((v and v == value) for v in i18n_flat(p.value))) and p.item_id == previous_values['item'].pk
             ]
             if len(matches) == 0:
                 raise ValidationError(_("No matching variation was found."))

src/tests/base/test_modelimport_orders.py

@@ -443,6 +443,37 @@ def test_variation_invalid(user, event, item):
     assert 'Error while importing value "Foo" for column "Product variation" in line "1": No matching variation was found.' in str(excinfo.value)
 
 
+@pytest.mark.django_db
+@scopes_disabled()
+def test_variation_wrong_item(user, event, item):
+    settings = dict(DEFAULT_SETTINGS)
+    settings['item'] = 'static:{}'.format(item.pk)
+    settings['variation'] = 'csv:E'
+    item2 = Item.objects.create(event=event, name="Ticket", default_price=23)
+    v1 = item2.variations.create(value='Foo')
+    data = [{
+        'A': 'Dieter',
+        'B': 'Schneider',
+        'C': 'schneider@example.org',
+        'D': 'Test',
+        'E': str(v1.pk),
+        'F': '0.00',
+        'G': 'US',
+        'H': 'Texas',
+        'I': 'Foo',
+        'J': '2021-06-28 11:00:00',
+        'K': '06221/32177-50',
+        'L': 'True',
+        'M': 'baz',
+        'N': 'Seat-1',
+    }]
+    with pytest.raises(DataImportError) as excinfo:
+        import_orders.apply(
+            args=(event.pk, inputfile_factory(data).id, settings, 'en', user.pk)
+        ).get()
+    assert f'Error while importing value "{str(v1.pk)}" for column "Product variation" in line "1": No matching variation was found.' in str(excinfo.value)
+
+
 @pytest.mark.django_db
 @scopes_disabled()
 def test_variation_dynamic(user, event, item):