Bump to 2026.5.4

[SECURITY] Add missing permission check for view (CVE-2026-57532)
2026-07-30 09:05:08 +00:00 · 2026-07-28 12:27:00 +02:00 · 2026-07-28 12:26:45 +02:00
3 changed files with 4 additions and 2 deletions
@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.5.3"
+__version__ = "2026.5.4"
@@ -1554,7 +1554,7 @@ class WidgetSettings(EventSettingsViewMixin, EventPermissionRequiredMixin, FormV
        return ctx


-class QuickSetupView(FormView):
+class QuickSetupView(EventPermissionRequiredMixin, FormView):
    template_name = 'pretixcontrol/event/quick_setup.html'
    permission = 'event.settings.general:write'
    form_class = QuickSetupForm
@@ -90,6 +90,7 @@ event_urls = [
    "delete/",
    "dangerzone/",
    "cancel/",
+    "quickstart/",
    "settings/",
    "settings/plugins",
    "settings/payment",
@@ -310,6 +311,7 @@ event_permission_urls = [
    ("event.settings.general:write", "live/", 200, HTTP_GET),
    ("event.settings.general:write", "delete/", 200, HTTP_GET),
    ("event.settings.general:write", "dangerzone/", 200, HTTP_GET),
+    ("event.settings.general:write", "quickstart/", 200, HTTP_GET),
    ("event.settings.general:write", "settings/", 200, HTTP_GET),
    # ("event.settings.payment:write", "settings/payment", 200, HTTP_GET),  GET allowed also with other permissions
    ("event.settings.payment:write", "settings/payment", 200, HTTP_POST),
Author	SHA1	Message	Date
Raphael Michel	d6d400b5c4	Bump to 2026.5.4	2026-07-28 12:27:00 +02:00
Raphael Michel	ad0b5776b6	[SECURITY] Add missing permission check for view (CVE-2026-57532)	2026-07-28 12:26:45 +02:00