From e6f09c6df1ac5dbee14d2519b3261cd9b7fe4fe8 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Mon, 21 Sep 2026 13:41:36 +0200 Subject: [PATCH] Event metadata: Fix server-side validation of write protection --- src/pretix/control/forms/event.py | 4 ++-- src/pretix/control/forms/subevents.py | 4 ++-- src/pretix/control/views/subevents.py | 5 +++++ 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/src/pretix/control/forms/event.py b/src/pretix/control/forms/event.py index 068d306d42..c59359010a 100644 --- a/src/pretix/control/forms/event.py +++ b/src/pretix/control/forms/event.py @@ -400,10 +400,10 @@ class EventMetaValueForm(forms.ModelForm): if self.disabled: self.fields['value'].widget.attrs['readonly'] = 'readonly' - def clean_slug(self): + def clean_value(self): if self.disabled: return self.instance.value if self.instance else None - return self.cleaned_data['slug'] + return self.cleaned_data['value'] class Meta: model = EventMetaValue diff --git a/src/pretix/control/forms/subevents.py b/src/pretix/control/forms/subevents.py index 21e2320636..4b3dac134b 100644 --- a/src/pretix/control/forms/subevents.py +++ b/src/pretix/control/forms/subevents.py @@ -435,10 +435,10 @@ class SubEventMetaValueForm(forms.ModelForm): if self.disabled: self.fields['value'].widget.attrs['readonly'] = 'readonly' - def clean_slug(self): + def clean_value(self): if self.disabled: return self.instance.value if self.instance else None - return self.cleaned_data['slug'] + return self.cleaned_data['value'] class Meta: model = SubEventMetaValue diff --git a/src/pretix/control/views/subevents.py b/src/pretix/control/views/subevents.py index 5cbf7fd310..a6ae084be5 100644 --- a/src/pretix/control/views/subevents.py +++ b/src/pretix/control/views/subevents.py @@ -1276,6 +1276,11 @@ class SubEventBulkEdit(SubEventQueryMixin, EventPermissionRequiredMixin, FormVie self._default_meta = self.request.event.meta_data for p in self.request.organizer.meta_properties.all(): + if p.protected and not self.request.user.has_organizer_permission( + self.request.organizer, 'organizer.settings.general:write', request=self.request + ): + continue + inst = SubEventMetaValue(property=p) if len(matches[p.id]) == 1 and matches[p.id][0]['c'] == total: inst.value = matches[p.id][0]['value']