Commit Graph

15 Commits

Author SHA1 Message Date
Raphael Michel
df0b580dd6 Pluggable permissions (#5728)
* Data model draft

* Refactor query and assignment usages of old permissions

* Backend UI

* API serializer

* Big string replace

* Docs, tests and fixes for teams api

* Update docs for device auth

* Eliminate old names

* Make tests pass

* Use new permissions, remove inconsistencies

* Add test for translations

* Show plugin permissions

* Add permission for seating plans

* Fix plugin activation

* Fix failing test

* Refactor to permission groups

* Update doc/api/resources/devices.rst

Co-authored-by: luelista <weller@rami.io>

* Update doc/api/resources/events.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/api/serializers/organizer.py

Co-authored-by: luelista <weller@rami.io>

* Fix typo

* Fix python version compat

* Replacement after rebase

* Add proper permission handling for exports

* Docs for exporters

* Runtime linting of permission names

* Fix typos

* Show export page even without orders permission

* More legacy compat

* Do not strongly validate before plugins are loaded

* Rebase migration

* Add permission for outgoing mails

* Review notes

* Update doc/api/resources/teams.rst

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Clean up logic around exporters

* Review and failures

* Fix migration leading to forbidden combination

* Handle permissions on event copying

* Remove print-statements

* Make test clearer

* Review feedback

* Add AnyPermissionOf

* migration safety

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-03-17 14:43:56 +01:00
Raphael Michel
aa9c478c30 [SECURITY] Prevent access to arbitrary cached files by UUID (CVE-2025-14881) 2025-12-19 12:59:21 +01:00
Raphael Michel
177a7d07fc Update license header (#5540) 2025-10-10 15:32:46 +02:00
Raphael Michel
3b64e6046c API: Add endpoints for scheduled exports (#3659)
* API: Add endpoints for scheduled exports

* ADd note to docs
2023-10-27 17:15:53 +02:00
Raphael Michel
b51ca58820 Add BaseExporter.available_for_user() 2023-06-16 17:35:36 +02:00
Raphael Michel
60cdfe4029 Allow organizer-level exports with separate permission and no event selection 2022-10-05 10:36:57 +02:00
Raphael Michel
5681ea121d API: Fix organizer exports with OAuth tokens (PRETIXEU-663) 2022-03-04 10:32:17 +01:00
Raphael Michel
6008e3d11c API: Fix organizer-level export with OAuth token (Z#2395272) 2022-03-01 16:53:48 +01:00
Raphael Michel
65fb492728 Fix crash in exporter API (PRETIXEU-650) 2022-02-23 15:03:49 +01:00
Raphael Michel
dd0a4df914 Fix error 500 on non-ASCII attachment file names 2021-11-09 11:55:03 +01:00
Raphael Michel
f367d5e675 Multi-event exports: Pass organizer, fix in staff mode 2021-07-24 16:46:37 +02:00
Raphael Michel
a93287207b pretix Community Edition moves to AGPLv3-based license (#2023) 2021-04-12 10:33:47 +02:00
Raphael Michel
1286e53b85 Reduce lifetime of export files 2020-12-22 10:48:06 +01:00
Raphael Michel
c60a25f2bc [SECURITY] Bind relevant cached file downloads to the current session 2020-12-22 10:47:47 +01:00
Raphael Michel
d08c811f3a Fix #1780 -- Trigger exports through API (#1839) 2020-11-05 18:30:12 +01:00