CGM_Public/pretix_original
2
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-05-09 15:54:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SECURITY] Do not allow to enumerate organizers

Browse Source
This commit is contained in:
Raphael Michel
2019-06-05 16:27:21 +02:00
parent b66a35df7a
commit e0c432d014
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/pretix/control/views/typeahead.py
View File

@@ -149,7 +149,12 @@ def nav_context_list(request):
] ]
if show_user and organizer: if show_user and organizer:
try:
organizer = serialize_orga(Organizer.objects.get(pk=organizer)) organizer = serialize_orga(Organizer.objects.get(pk=organizer))
except Organizer.DoesNotExist:
pass
else:
if request.user.has_organizer_permission(organizer, request):
if organizer in results: if organizer in results:
results.remove(organizer) results.remove(organizer)
results.insert(1, organizer) results.insert(1, organizer)