Bump to 2026.6.1

[SECURITY] Add missing permission check for view (CVE-2026-57532)
2026-08-01 09:25:09 +00:00 · 2026-07-28 12:25:38 +02:00 · 2026-07-28 12:25:31 +02:00
3 changed files with 4 additions and 2 deletions
@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.6.0"
+__version__ = "2026.6.1"
@@ -1558,7 +1558,7 @@ class WidgetSettings(EventSettingsViewMixin, EventPermissionRequiredMixin, FormV
        return ctx


-class QuickSetupView(FormView):
+class QuickSetupView(EventPermissionRequiredMixin, FormView):
    template_name = 'pretixcontrol/event/quick_setup.html'
    permission = 'event.settings.general:write'
    form_class = QuickSetupForm
@@ -90,6 +90,7 @@ event_urls = [
    "delete/",
    "dangerzone/",
    "cancel/",
+    "quickstart/",
    "settings/",
    "settings/plugins",
    "settings/payment",
@@ -311,6 +312,7 @@ event_permission_urls = [
    ("event.settings.general:write", "live/", 200, HTTP_GET),
    ("event.settings.general:write", "delete/", 200, HTTP_GET),
    ("event.settings.general:write", "dangerzone/", 200, HTTP_GET),
+    ("event.settings.general:write", "quickstart/", 200, HTTP_GET),
    ("event.settings.general:write", "settings/", 200, HTTP_GET),
    # ("event.settings.payment:write", "settings/payment", 200, HTTP_GET),  GET allowed also with other permissions
    ("event.settings.payment:write", "settings/payment", 200, HTTP_POST),
Author	SHA1	Message	Date
Raphael Michel	2bd0a341d6	Bump to 2026.6.1	2026-07-28 12:25:38 +02:00
Raphael Michel	6bec15d12a	[SECURITY] Add missing permission check for view (CVE-2026-57532)	2026-07-28 12:25:31 +02:00