Fix: prevent unauthorized manual check-ins in dashboard #1239
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Reviewer's GuideAdds strict authorization checks to the manual check-in and revert workflows by introducing a position validation helper that enforces event and product constraints, and bolsters test coverage to ensure unauthorized positions are correctly ignored. File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- Ensure that the manual check-in endpoint in production code actually calls
_validate_position_for_checkin_list(the PR currently only defines and uses it in tests). - Rather than silently skipping unauthorized positions, consider returning a clear error or logging the attempt so clients know when invalid IDs were provided.
- Optimize the product check by using a queryset filter/exists instead of loading
limit_products.all()into memory for membership testing.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Ensure that the manual check-in endpoint in production code actually calls `_validate_position_for_checkin_list` (the PR currently only defines and uses it in tests).
- Rather than silently skipping unauthorized positions, consider returning a clear error or logging the attempt so clients know when invalid IDs were provided.
- Optimize the product check by using a queryset filter/exists instead of loading `limit_products.all()` into memory for membership testing.
## Individual Comments
### Comment 1
<location> `src/tests/control/test_checkins.py:384-387` </location>
<code_context>
@pytest.mark.django_db
def test_manual_checkins_unauthorized_position(client, checkin_list_env):
client.login(email='dummy@dummy.dummy', password='dummy')
# Create a position from a different event that shouldn't be checkable
other_orga = Organizer.objects.create(name='Other', slug='other')
other_event = Event.objects.create(
organizer=other_orga,
name='Other Event',
slug='other',
date_from=now(),
)
other_item = Item.objects.create(event=other_event, name='Other Ticket', default_price=23, admission=True)
other_order = Order.objects.create(
code='OTHER',
event=other_event,
email='other@dummy.test',
status=Order.STATUS_PAID,
datetime=now(),
expires=now() + timedelta(days=10),
total=23,
locale='en',
)
other_position = OrderPosition.objects.create(
order=other_order,
item=other_item,
variation=None,
price=Decimal('23'),
attendee_name_parts={'full_name': 'Other'},
)
# Try to check in the unauthorized position
with scopes_disabled():
assert not _validate_position_for_checkin_list(other_position, checkin_list_env[6])
initial_checkin_count = Checkin.objects.count()
initial_log_count = LogEntry.objects.count()
client.post(
'/control/event/dummy/dummy/checkinlists/{}/'.format(checkin_list_env[6].pk),
{'checkin': [other_position.pk]},
)
# Verify the unauthorized position was not checked in
with scopes_disabled():
assert Checkin.objects.count() == initial_checkin_count
assert not other_position.checkins.exists()
# Verify no log entries were created for the unauthorized operation
assert LogEntry.objects.count() == initial_log_count
assert not LogEntry.objects.filter(
action_type='pretix.event.checkin',
object_id=other_position.order.pk
).exists()
</code_context>
<issue_to_address>
**issue (code-quality):** Replace call to format with f-string ([`use-fstring-for-formatting`](https://docs.sourcery.ai/Reference/Default-Rules/refactorings/use-fstring-for-formatting/))
</issue_to_address>
### Comment 2
<location> `src/tests/control/test_checkins.py:463-466` </location>
<code_context>
@pytest.mark.django_db
def test_manual_checkins_revert_unauthorized_position(client, checkin_list_env):
client.login(email='dummy@dummy.dummy', password='dummy')
# Create a position from a different event
other_orga = Organizer.objects.create(name='Other', slug='other')
other_event = Event.objects.create(
organizer=other_orga,
name='Other Event',
slug='other',
date_from=now(),
)
other_item = Item.objects.create(event=other_event, name='Other Ticket', default_price=23, admission=True)
other_order = Order.objects.create(
code='OTHER',
event=other_event,
email='other@dummy.test',
status=Order.STATUS_PAID,
datetime=now(),
expires=now() + timedelta(days=10),
total=23,
locale='en',
)
other_position = OrderPosition.objects.create(
order=other_order,
item=other_item,
variation=None,
price=Decimal('23'),
attendee_name_parts={'full_name': 'Other'},
)
# Create a checkin for the unauthorized position (simulating it was somehow created)
with scopes_disabled():
Checkin.objects.create(position=other_position, list=checkin_list_env[6])
initial_checkin_count = Checkin.objects.count()
initial_log_count = LogEntry.objects.count()
# Try to revert the unauthorized position
client.post(
'/control/event/dummy/dummy/checkinlists/{}/'.format(checkin_list_env[6].pk),
{'checkin': [other_position.pk], 'revert': 'true'},
)
# Verify the unauthorized position checkin was not reverted
with scopes_disabled():
assert Checkin.objects.count() == initial_checkin_count
assert other_position.checkins.exists()
# Verify no log entries were created for the unauthorized operation
assert LogEntry.objects.count() == initial_log_count
assert not LogEntry.objects.filter(
action_type='pretix.event.checkin.reverted',
object_id=other_position.order.pk
).exists()
</code_context>
<issue_to_address>
**issue (code-quality):** Replace call to format with f-string ([`use-fstring-for-formatting`](https://docs.sourcery.ai/Reference/Default-Rules/refactorings/use-fstring-for-formatting/))
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
g-k-s-03
force-pushed
the
fix/checkin-validation
branch
from
33fb0ac to
81aac77
Compare
Copilot finished reviewing on behalf of
mariobehling
November 12, 2025 21:21
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR addresses a security vulnerability that allows users to check in OrderPositions for events they shouldn't have access to by adding validation to the manual check-in endpoint. The changes add comprehensive test coverage for the new authorization validation logic.
Key Changes:
- Added two new test cases to verify unauthorized check-ins are properly rejected (
test_manual_checkins_unauthorized_positionandtest_manual_checkins_revert_unauthorized_position) - Imported
validate_position_for_checkin_listfunction for testing authorization logic - Enhanced existing tests with docstrings and improved code style (f-strings, better comments)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Member
mariobehling
left a comment
mariobehling
left a comment
There was a problem hiding this comment.
Please check AI comments in regards to pretix.base.services.checkin.
Contributor
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 7 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Author
|
validate_position_for_checkin_list is not present in the current codebase. This will cause CI failure. Either add the function or import _validate_position_for_checkin_list instead. |
Contributor
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+385
to
+386
| is_valid, error_msg = validate_position_for_checkin_list(other_position, checkin_list_env[6]) | ||
| assert not is_valid |
There was a problem hiding this comment.
The test calls validate_position_for_checkin_list() but this function is not included in the PR. Without the actual implementation of this validation function, these tests will fail with an import error. The implementation needs to be added to the PR.
Comment on lines
+448
to
+473
| # Create a position from a different event | ||
| other_orga = Organizer.objects.create(name='Other', slug='other') | ||
| other_event = Event.objects.create( | ||
| organizer=other_orga, | ||
| name='Other Event', | ||
| slug='other', | ||
| date_from=now(), | ||
| ) | ||
| other_item = Item.objects.create(event=other_event, name='Other Ticket', default_price=23, admission=True) | ||
| other_order = Order.objects.create( | ||
| code='OTHER', | ||
| event=other_event, | ||
| email='other@dummy.test', | ||
| status=Order.STATUS_PAID, | ||
| datetime=now(), | ||
| expires=now() + timedelta(days=10), | ||
| total=23, | ||
| locale='en', | ||
| ) | ||
| other_position = OrderPosition.objects.create( | ||
| order=other_order, | ||
| item=other_item, | ||
| variation=None, | ||
| price=Decimal('23'), | ||
| attendee_name_parts={'full_name': 'Other'}, | ||
| ) |
There was a problem hiding this comment.
[nitpick] There is significant code duplication between this test and test_manual_checkins_unauthorized_position (lines 357-381). The setup of the "other" event, organizer, item, order, and position is identical. Consider extracting this setup into a pytest fixture to improve maintainability and reduce duplication.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
closes #1232
Description
This patch adds validation for the manual check-in endpoint to ensure that only authorized OrderPositions can be checked in.
Currently, users can POST arbitrary OrderPosition IDs, which allows checking in attendees for events they shouldn't have access to. This introduces a security risk.
Changes
_validate_position_for_checkin_listto verify:checkin_list.all_products=False, the item must be incheckin_list.limit_products.Impact
Related Tests
test_manual_checkinstest_manual_checkins_unauthorized_positiontest_manual_checkins_reverttest_manual_checkins_revert_unauthorized_positionSummary by Sourcery
Enforce proper authorization on manual check-in and revert actions by validating positions against the check-in list’s event and product constraints, and cover these behaviors with new tests.
Bug Fixes:
Enhancements:
Tests: