Event metadata: Fix server-side validation of write protection

src/pretix/control/forms/event.py

@@ -400,10 +400,10 @@ class EventMetaValueForm(forms.ModelForm):
         if self.disabled:
             self.fields['value'].widget.attrs['readonly'] = 'readonly'
 
-    def clean_slug(self):
+    def clean_value(self):
         if self.disabled:
             return self.instance.value if self.instance else None
-        return self.cleaned_data['slug']
+        return self.cleaned_data['value']
 
     class Meta:
         model = EventMetaValue

src/pretix/control/forms/subevents.py

@@ -435,10 +435,10 @@ class SubEventMetaValueForm(forms.ModelForm):
         if self.disabled:
             self.fields['value'].widget.attrs['readonly'] = 'readonly'
 
-    def clean_slug(self):
+    def clean_value(self):
         if self.disabled:
             return self.instance.value if self.instance else None
-        return self.cleaned_data['slug']
+        return self.cleaned_data['value']
 
     class Meta:
         model = SubEventMetaValue

src/pretix/control/views/subevents.py

@@ -1276,6 +1276,11 @@ class SubEventBulkEdit(SubEventQueryMixin, EventPermissionRequiredMixin, FormVie
             self._default_meta = self.request.event.meta_data
 
         for p in self.request.organizer.meta_properties.all():
+            if p.protected and not self.request.user.has_organizer_permission(
+                    self.request.organizer, 'organizer.settings.general:write', request=self.request
+            ):
+                continue
+
             inst = SubEventMetaValue(property=p)
             if len(matches[p.id]) == 1 and matches[p.id][0]['c'] == total:
                 inst.value = matches[p.id][0]['value']