Merge branch 'master' into order-relativedatetime

src/pretix/control/forms/event.py

@@ -80,7 +80,7 @@ from pretix.control.forms.widgets import Select2
 from pretix.helpers.countries import CachedCountries
 from pretix.multidomain.models import AlternativeDomainAssignment, KnownDomain
 from pretix.multidomain.urlreverse import (
-    build_absolute_uri, get_organizer_domain,
+    eventreverse_absolute, get_organizer_domain,
 )
 from pretix.plugins.banktransfer.payment import BankTransfer
 from pretix.presale.style import get_fonts
@@ -197,10 +197,10 @@ class EventWizardBasicsForm(I18nModelForm):
             'presale_end': SplitDateTimeField,
         }
         widgets = {
-            'date_from': SplitDateTimePickerWidget(),
-            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_basics-date_from_0'}),
-            'presale_start': SplitDateTimePickerWidget(),
-            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_basics-presale_start_0'}),
+            'date_from': SplitDateTimePickerWidget(without_seconds=True),
+            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_basics-date_from_0'}, without_seconds=True),
+            'presale_start': SplitDateTimePickerWidget(without_seconds=True),
+            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_basics-presale_start_0'}, without_seconds=True),
             'slug': SlugWidget,
         }
 
@@ -219,7 +219,7 @@ class EventWizardBasicsForm(I18nModelForm):
         self.fields['location'].widget.attrs['placeholder'] = _(
             'Sample Conference Center\nHeidelberg, Germany'
         )
-        self.fields['slug'].widget.prefix = build_absolute_uri(self.organizer, 'presale:organizer.index')
+        self.fields['slug'].widget.prefix = eventreverse_absolute(self.organizer, 'presale:organizer.index')
         self.fields['tax_rate']._required = True  # Do not render as optional because it is conditionally required
         if self.has_subevents:
             del self.fields['presale_start']
@@ -521,11 +521,11 @@ class EventUpdateForm(I18nModelForm):
             'limit_sales_channels': SafeModelMultipleChoiceField,
         }
         widgets = {
-            'date_from': SplitDateTimePickerWidget(),
-            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}),
-            'date_admission': SplitDateTimePickerWidget(attrs={'data-date-default': '#id_date_from_0'}),
-            'presale_start': SplitDateTimePickerWidget(),
-            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_presale_start_0'}),
+            'date_from': SplitDateTimePickerWidget(without_seconds=True),
+            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}, without_seconds=True),
+            'date_admission': SplitDateTimePickerWidget(attrs={'data-date-default': '#id_date_from_0'}, without_seconds=True),
+            'presale_start': SplitDateTimePickerWidget(without_seconds=True),
+            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_presale_start_0'}, without_seconds=True),
         }
 
 
@@ -625,6 +625,7 @@ class EventSettingsForm(EventSettingsValidationMixin, FormPlaceholderMixin, Sett
         'max_items_per_order',
         'reservation_time',
         'contact_mail',
+        'contact_url',
         'show_variations_expanded',
         'hide_sold_out',
         'meta_noindex',
@@ -671,6 +672,11 @@ class EventSettingsForm(EventSettingsValidationMixin, FormPlaceholderMixin, Sett
 
     base_context = {
         'frontpage_text': ['event'],
+        'presale_has_ended_text': ['event'],
+        'voucher_explanation_text': ['event'],
+        'banner_text': ['event'],
+        'banner_text_bottom': ['event'],
+        'event_info_text': ['event'],
     }
 
     def _resolve_virtual_keys_input(self, data, prefix=''):
@@ -1673,7 +1679,7 @@ class CountriesAndEUAndStates(CountriesAndEU):
 
 class TaxRuleLineForm(I18nForm):
     country = LazyTypedChoiceField(
-        choices=CountriesAndEUAndStates(),
+        choices=lazy(lambda: CountriesAndEUAndStates(), CountriesAndEUAndStates),
         required=False
     )
     address_type = forms.ChoiceField(

src/pretix/control/forms/filter.py

@@ -770,7 +770,7 @@ class EventOrderExpertFilterForm(EventOrderFilterForm):
                 )
             elif q.type == Question.TYPE_TIME:
                 self.fields[fname] = forms.TimeField(
-                    widget=TimePickerWidget(time_format=get_format_without_seconds('TIME_INPUT_FORMATS')),
+                    widget=TimePickerWidget(without_seconds=True),
                     help_text=_('Exact matches only'),
                     **kwargs,
                 )

src/pretix/control/forms/item.py

@@ -246,8 +246,8 @@ class QuestionForm(I18nModelForm):
             'valid_string_length_max',
         ]
         widgets = {
-            'valid_datetime_min': SplitDateTimePickerWidget(),
-            'valid_datetime_max': SplitDateTimePickerWidget(),
+            'valid_datetime_min': SplitDateTimePickerWidget(without_seconds=True),
+            'valid_datetime_max': SplitDateTimePickerWidget(without_seconds=True),
             'valid_date_min': DatePickerWidget(),
             'valid_date_max': DatePickerWidget(),
             'items': forms.CheckboxSelectMultiple(
@@ -1427,6 +1427,6 @@ class ItemProgramTimeForm(I18nModelForm):
             'end': forms.SplitDateTimeField,
         }
         widgets = {
-            'start': SplitDateTimePickerWidget(),
-            'end': SplitDateTimePickerWidget(),
+            'start': SplitDateTimePickerWidget(without_seconds=True),
+            'end': SplitDateTimePickerWidget(without_seconds=True),
         }

src/pretix/control/forms/organizer.py

@@ -88,7 +88,7 @@ from pretix.control.forms.event import (
 )
 from pretix.control.forms.widgets import Select2, Select2Multiple
 from pretix.multidomain.models import KnownDomain
-from pretix.multidomain.urlreverse import build_absolute_uri
+from pretix.multidomain.urlreverse import eventreverse_absolute
 
 
 class OrganizerForm(I18nModelForm):
@@ -604,6 +604,7 @@ class OrganizerSettingsForm(SettingsForm):
         'customer_accounts_require_login_for_order_access',
         'invoice_regenerate_allowed',
         'contact_mail',
+        'contact_url',
         'imprint_url',
         'organizer_info_text',
         'event_list_type',
@@ -791,7 +792,7 @@ class MailSettingsForm(SettingsForm):
         }
 
         if 'url' in base_parameters:
-            placeholders['url'] = build_absolute_uri(
+            placeholders['url'] = eventreverse_absolute(
                 self.organizer,
                 'presale:organizer.customer.activate'
             ) + '?token=' + get_random_string(30)

src/pretix/control/forms/subevents.py

@@ -39,6 +39,7 @@ from pretix.base.reldate import RelativeDateTimeField, RelativeDateWrapper
 from pretix.base.templatetags.money import money_filter
 from pretix.control.forms import SplitDateTimeField, SplitDateTimePickerWidget
 from pretix.control.forms.rrule import RRuleForm
+from pretix.helpers.i18n import get_javascript_format_without_seconds
 from pretix.helpers.money import change_decimal_field
 
 
@@ -80,11 +81,11 @@ class SubEventForm(I18nModelForm):
             'presale_end': SplitDateTimeField,
         }
         widgets = {
-            'date_from': SplitDateTimePickerWidget(),
-            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}),
-            'date_admission': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}),
-            'presale_start': SplitDateTimePickerWidget(),
-            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_presale_start_0'}),
+            'date_from': SplitDateTimePickerWidget(without_seconds=True),
+            'date_to': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}, without_seconds=True),
+            'date_admission': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_date_from_0'}, without_seconds=True),
+            'presale_start': SplitDateTimePickerWidget(without_seconds=True),
+            'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_presale_start_0'}, without_seconds=True),
         }
 
 
@@ -162,7 +163,7 @@ class SubEventBulkEditForm(I18nModelForm):
             self.fields[k + '_time'] = forms.TimeField(
                 label=self._meta.model._meta.get_field(k).verbose_name,
                 help_text=self._meta.model._meta.get_field(k).help_text,
-                widget=TimePickerWidget(),
+                widget=TimePickerWidget(without_seconds=True),
                 required=False,
             )
 
@@ -506,6 +507,12 @@ class TimeForm(forms.Form):
         required=False
     )
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['time_from'].widget.attrs['data-format'] = get_javascript_format_without_seconds("TIME_INPUT_FORMATS")
+        self.fields['time_to'].widget.attrs['data-format'] = get_javascript_format_without_seconds("TIME_INPUT_FORMATS")
+        self.fields['time_admission'].widget.attrs['data-format'] = get_javascript_format_without_seconds("TIME_INPUT_FORMATS")
+
 
 TimeFormSet = formset_factory(
     TimeForm,

src/pretix/control/forms/vouchers.py

@@ -32,16 +32,20 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
 
+import copy
 import csv
-from collections import namedtuple
+from collections import Counter, namedtuple
 from io import StringIO
 
 from django import forms
 from django.core.exceptions import ObjectDoesNotExist, ValidationError
 from django.core.validators import EmailValidator
+from django.db.models import Count, F, Max
 from django.db.models.functions import Upper
+from django.forms.utils import ErrorDict
 from django.urls import reverse
-from django.utils.translation import gettext_lazy as _
+from django.utils.timezone import now
+from django.utils.translation import gettext_lazy as _, pgettext_lazy
 from django_scopes.forms import SafeModelChoiceField
 
 from pretix.base.email import get_available_placeholders
@@ -50,7 +54,10 @@ from pretix.base.forms import (
 )
 from pretix.base.forms.widgets import format_placeholders_help_text
 from pretix.base.i18n import language
-from pretix.base.models import Item, Voucher
+from pretix.base.models import Item, ItemVariation, Quota, SubEvent, Voucher
+from pretix.base.models.vouchers import VoucherBulkData
+from pretix.base.services.locking import lock_objects
+from pretix.base.services.quotas import QuotaAvailability
 from pretix.control.forms import SplitDateTimeField, SplitDateTimePickerWidget
 from pretix.control.forms.widgets import Select2, Select2ItemVarQuota
 from pretix.control.signals import voucher_form_validation
@@ -105,15 +112,22 @@ class VoucherForm(I18nModelForm):
             except Item.DoesNotExist:
                 pass
         super().__init__(*args, **kwargs)
+        if not self.event and self.instance:
+            self.event = self.instance.event
 
-        if instance.event.has_subevents:
-            self.fields['subevent'].queryset = instance.event.subevents.all()
+        self.fields['tag'].widget.attrs['data-typeahead-url'] = reverse('control:event.vouchers.tags.typeahead', kwargs={
+            'event': self.event.slug,
+            'organizer': self.event.organizer.slug,
+        })
+
+        if self.event.has_subevents:
+            self.fields['subevent'].queryset = self.event.subevents.all()
             self.fields['subevent'].widget = Select2(
                 attrs={
                     'data-model-select2': 'event',
                     'data-select2-url': reverse('control:event.subevents.select2', kwargs={
-                        'event': instance.event.slug,
-                        'organizer': instance.event.organizer.slug,
+                        'event': self.event.slug,
+                        'organizer': self.event.organizer.slug,
                     }),
                 }
             )
@@ -123,18 +137,19 @@ class VoucherForm(I18nModelForm):
             del self.fields['subevent']
 
         choices = []
-        if 'itemvar' in initial or (self.data and 'itemvar' in self.data):
-            iv = self.data.get('itemvar') or initial.get('itemvar', '')
+        prefix = (self.prefix + '-') if self.prefix else ''
+        if 'itemvar' in initial or (self.data and prefix + 'itemvar' in self.data):
+            iv = self.data.get(prefix + 'itemvar', '') or initial.get('itemvar', '') or ''
             if iv.startswith('q-'):
-                q = self.instance.event.quotas.get(pk=iv[2:])
+                q = self.event.quotas.get(pk=iv[2:])
                 choices.append(('q-%d' % q.pk, _('Any product in quota "{quota}"').format(quota=q)))
             elif '-' in iv:
                 itemid, varid = iv.split('-')
-                i = self.instance.event.items.get(pk=itemid)
+                i = self.event.items.get(pk=itemid)
                 v = i.variations.get(pk=varid)
                 choices.append(('%d-%d' % (i.pk, v.pk), '%s – %s' % (str(i), v.value)))
             elif iv:
-                i = self.instance.event.items.get(pk=iv)
+                i = self.event.items.get(pk=iv)
                 if i.variations.exists():
                     choices.append((str(i.pk), _('{product} – Any variation').format(product=i)))
                 else:
@@ -145,8 +160,8 @@ class VoucherForm(I18nModelForm):
             attrs={
                 'data-model-select2': 'generic',
                 'data-select2-url': reverse('control:event.vouchers.itemselect2', kwargs={
-                    'event': instance.event.slug,
-                    'organizer': instance.event.organizer.slug,
+                    'event': self.event.slug,
+                    'organizer': self.event.organizer.slug,
                 }),
                 'data-placeholder': _('All products')
             }
@@ -154,7 +169,7 @@ class VoucherForm(I18nModelForm):
         self.fields['itemvar'].required = False
         self.fields['itemvar'].widget.choices = self.fields['itemvar'].choices
 
-        if self.instance.event.seating_plan or self.instance.event.subevents.filter(seating_plan__isnull=False).exists():
+        if self.event.seating_plan or self.event.subevents.filter(seating_plan__isnull=False).exists():
             self.fields['seat'] = forms.CharField(
                 label=_("Specific seat ID"),
                 max_length=255,
@@ -164,40 +179,45 @@ class VoucherForm(I18nModelForm):
                 help_text=str(self.instance.seat) if self.instance.seat else '',
             )
 
+    def parse_itemvar(self, data):
+        try:
+            itemid = quotaid = None
+            iv = data.get('itemvar', '')
+            if iv.startswith('q-'):
+                quotaid = iv[2:]
+            elif '-' in iv:
+                itemid, varid = iv.split('-')
+            elif iv:
+                itemid, varid = iv, None
+            else:
+                itemid, varid = None, None
+
+            if itemid:
+                item = self.event.items.get(pk=itemid)
+                if varid:
+                    variation = item.variations.get(pk=varid)
+                else:
+                    variation = None
+                quota = None
+            elif quotaid:
+                quota = self.event.quotas.get(pk=quotaid)
+                item = None
+                variation = None
+            else:
+                quota = None
+                item = None
+                variation = None
+
+            return (item, variation, quota)
+
+        except ObjectDoesNotExist:
+            raise ValidationError(_("Invalid product selected."))
+
     def clean(self):
         data = super().clean()
 
         if not self._errors:
-            try:
-                itemid = quotaid = None
-                iv = self.data.get('itemvar', '')
-                if iv.startswith('q-'):
-                    quotaid = iv[2:]
-                elif '-' in iv:
-                    itemid, varid = iv.split('-')
-                elif iv:
-                    itemid, varid = iv, None
-                else:
-                    itemid, varid = None, None
-
-                if itemid:
-                    self.instance.item = self.instance.event.items.get(pk=itemid)
-                    if varid:
-                        self.instance.variation = self.instance.item.variations.get(pk=varid)
-                    else:
-                        self.instance.variation = None
-                    self.instance.quota = None
-                elif quotaid:
-                    self.instance.quota = self.instance.event.quotas.get(pk=quotaid)
-                    self.instance.item = None
-                    self.instance.variation = None
-                else:
-                    self.instance.quota = None
-                    self.instance.item = None
-                    self.instance.variation = None
-
-            except ObjectDoesNotExist:
-                raise ValidationError(_("Invalid product selected."))
+            self.instance.item, self.instance.variation, self.instance.quota = self.parse_itemvar(self.data)
 
         if 'codes' in data:
             data['codes'] = [a.strip() for a in data.get('codes', '').strip().split("\n") if a]
@@ -209,7 +229,7 @@ class VoucherForm(I18nModelForm):
 
         try:
             Voucher.clean_item_properties(
-                data, self.instance.event,
+                data, self.event,
                 self.instance.quota, self.instance.item, self.instance.variation,
                 seats_given=data.get('seat') or data.get('seats'),
                 block_quota=data.get('block_quota')
@@ -229,7 +249,7 @@ class VoucherForm(I18nModelForm):
 
         try:
             Voucher.clean_subevent(
-                data, self.instance.event
+                data, self.event
             )
         except ValidationError as e:
             raise ValidationError({"subevent": e.message})
@@ -245,19 +265,19 @@ class VoucherForm(I18nModelForm):
         if check_quota:
             Voucher.clean_quota_check(
                 data, cnt, self.initial_instance_data,
-                self.instance.event, self.instance.quota, self.instance.item, self.instance.variation
+                self.event, self.instance.quota, self.instance.item, self.instance.variation
             )
-        Voucher.clean_voucher_code(data, self.instance.event, self.instance.pk)
+        Voucher.clean_voucher_code(data, self.event, self.instance.pk)
         if 'seat' in self.fields:
             if data.get('seat'):
                 self.instance.seat = Voucher.clean_seat_id(
-                    data, self.instance.item, self.instance.quota, self.instance.event, self.instance.pk
+                    data, self.instance.item, self.instance.quota, self.event, self.instance.pk
                 )
                 self.instance.item = self.instance.seat.product
             else:
                 self.instance.seat = None
 
-        voucher_form_validation.send(sender=self.instance.event, form=self, data=data)
+        voucher_form_validation.send(sender=self.event, form=self, data=data)
 
         return data
 
@@ -265,6 +285,215 @@ class VoucherForm(I18nModelForm):
         return super().save(commit)
 
 
+class VoucherBulkEditForm(VoucherForm):
+    def __init__(self, *args, **kwargs):
+        self.mixed_values = kwargs.pop('mixed_values')
+        self.queryset = kwargs.pop('queryset')
+        super().__init__(**kwargs)
+        del self.fields["code"]
+        self.fields.pop("seat", None)
+
+    def is_bulk_checked(self, fieldname):
+        return self.prefix + fieldname in self.data.getlist('_bulk')
+
+    def clean(self):
+        # We skip the parent class because it's not suited for bulk editing and implement custom validation here.
+        # This does not validate *everything* we validate in VoucherForm. For example, we skip validation that one does
+        # not create a voucher for an add-on product or that the seat matches the product to save on complexity.
+        # This is a UX validation only anyway, since one could first create the voucher and then make the product an
+        # add-on product. However, we need to validate everything that we don't want violated in the database.
+        data = super(VoucherForm, self).clean()
+
+        if self.is_bulk_checked("itemvar"):
+            data["item"], data["variation"], data["quota"] = self.parse_itemvar(data)
+
+        if self.is_bulk_checked("max_usages") and "max_usages" in data:
+            max_redeemed = self.queryset.aggregate(m=Max("redeemed"))["m"]
+            if data["max_usages"] < max_redeemed:
+                raise ValidationError(_(
+                    "You cannot reduce the maximum number of redemptions to %(max_usages)s, because at least one "
+                    "of the selected vouchers has already been redeemed %(max_redeemed)s times."
+                ) % {"max_usages": data["max_usages"], "max_redeemed": max_redeemed})
+
+        # Check diff on product and quota usage based on old groups of vouchers
+        if any(self.is_bulk_checked(k) for k in ("max_usages", "itemvar", "block_quota", "valid_until", "subevent")):
+            quota_diff = Counter()
+
+            current_vouchers = self.queryset.order_by().values(
+                "item", "variation", "quota", "block_quota", "valid_until", "subevent", "redeemed", "max_usages",
+                "allow_ignore_quota",
+            ).annotate(c=Count("*"))
+            item_cache = {i.pk: i for i in Item.objects.filter(pk__in=[c["item"] for c in current_vouchers])}
+            var_cache = {v.pk: v for v in ItemVariation.objects.filter(pk__in=[c["variation"] for c in current_vouchers])}
+            quota_cache = {q.pk: q for q in Quota.objects.filter(pk__in=[c["quota"] for c in current_vouchers])}
+            subevent_cache = {s.pk: s for s in SubEvent.objects.filter(pk__in=[c["subevent"] for c in current_vouchers])}
+
+            for current in current_vouchers:
+                bulk_count = current.pop('c')
+                current = VoucherBulkData(**current)
+                # Get quotas that are currently used
+                if current.item:
+                    current.item = item_cache[current.item]
+                if current.variation:
+                    current.variation = var_cache[current.variation]
+                if current.quota:
+                    current.quota = quota_cache[current.quota]
+                if current.subevent:
+                    current.subevent = subevent_cache[current.subevent]
+
+                old_quotas = Voucher.clean_quota_get_ignored(current)
+                old_amount = max(current.max_usages - current.redeemed, 0) * bulk_count
+
+                # Predict state after change
+                after_change = copy.copy(current)
+                if self.is_bulk_checked("itemvar") and "itemvar" in data:
+                    after_change.item = data["item"]
+                    after_change.variation = data["variation"]
+                    after_change.quota = data["quota"]
+                if self.is_bulk_checked("subevent") and "subevent" in data:
+                    after_change.subevent = data["subevent"]
+                if self.is_bulk_checked("max_usages") and "max_usages" in data:
+                    after_change.max_usages = data["max_usages"]
+                if self.is_bulk_checked("block_quota") and "block_quota" in data:
+                    after_change.block_quota = data["block_quota"]
+                if self.is_bulk_checked("valid_until") and "valid_until" in data:
+                    after_change.valid_until = data["valid_until"]
+                if self.is_bulk_checked("allow_ignore_quota") and "allow_ignore_quota" in data:
+                    after_change.allow_ignore_quota = data["allow_ignore_quota"]
+
+                if after_change.quota and self.event.has_subevents and not after_change.subevent:
+                    raise ValidationError(_("You cannot create a voucher that allows selection of a quota but has no date selected."))
+
+                if after_change.quota and after_change.subevent and after_change.quota.subevent_id != after_change.subevent.pk:
+                    raise ValidationError(_("The selected quota does not match the selected subevent."))
+
+                if after_change.block_quota and self.event.has_subevents and not after_change.subevent:
+                    raise ValidationError(
+                        _('If you want this voucher to block quota, you need to select a specific date.'))
+
+                if after_change.block_quota and not after_change.item and not after_change.quota:
+                    raise ValidationError(
+                        _('You need to select a specific product or quota if this voucher should reserve '
+                          'tickets.')
+                    )
+
+                if after_change.allow_ignore_quota:
+                    # todo: is this the most useful way to do this?
+                    continue
+
+                new_quotas = Voucher.clean_quota_get_ignored(after_change)
+                new_amount = max(after_change.max_usages - after_change.redeemed, 0) * bulk_count
+
+                if new_quotas != old_quotas or new_amount != old_amount:
+                    for q in old_quotas:
+                        quota_diff[q] -= old_amount
+                    for q in new_quotas:
+                        quota_diff[q] += new_amount
+
+            if any(v > 0 for q, v in quota_diff.items()):
+                lock_objects([q for q, v in quota_diff.items() if q.size is not None and v > 0], shared_lock_objects=[self.event])
+                qa = QuotaAvailability(count_waitinglist=False)
+                qa.queue(*(q for q, v in quota_diff.items() if v > 0))
+                qa.compute()
+
+                if any(qa.results[q][0] != Quota.AVAILABILITY_OK or (qa.results[q][1] is not None and qa.results[q][1] < required)
+                       for q, required in quota_diff.items() if required > 0):
+                    raise ValidationError(_(
+                        'There is no sufficient quota available to perform this change.'
+                    ))
+
+        has_seat = self.queryset.filter(seat__isnull=False).exists()
+        if has_seat:
+            if self.is_bulk_checked("max_usages"):
+                raise ValidationError(_(
+                    'Changing the maximum number of usages in bulk is not supported if any of the selected vouchers '
+                    'is assigned a seat.'
+                ))
+            if self.is_bulk_checked("subevent"):
+                raise ValidationError(pgettext_lazy(
+                    'subevent',
+                    'Changing the date in bulk is not supported if any of the selected vouchers '
+                    'is assigned a seat.'
+                ))
+            if self.is_bulk_checked("itemvar") and data["quota"]:
+                raise ValidationError(_(
+                    'Changing the product to a quota is not supported if any of the selected vouchers '
+                    'is assigned a seat.'
+                ))
+
+            if self.is_bulk_checked("valid_until"):
+                if data["valid_until"] is None or data["valid_until"] >= now():
+                    currently_not_blocked_seats = self.queryset.filter(
+                        seat__isnull=False,
+                        max_usages__gt=F("redeemed"),
+                        valid_until__lt=now(),
+                    )
+                    if self.event.has_subevents:
+                        subevents = self.event.subevents.filter(pk__in=currently_not_blocked_seats.values_list("subevent"))
+                        for se in subevents:
+                            conflicts = currently_not_blocked_seats.filter(
+                                subevent=se
+                            ).exclude(
+                                seat_id__in=se.free_seats().values("pk")
+                            )
+                            if conflicts:
+                                raise ValidationError(_(
+                                    'This change cannot be completed because not all assigned seats of the vouchers are '
+                                    'still available'
+                                ))
+                    else:
+                        conflicts = currently_not_blocked_seats.exclude(
+                            seat_id__in=self.event.free_seats().values("pk")
+                        )
+                        if conflicts:
+                            raise ValidationError(_(
+                                'This change cannot be completed because not all assigned seats of the vouchers are '
+                                'still available'
+                            ))
+
+        return data
+
+    def save(self, commit=True):
+        objs = list(self.queryset)
+        fields = set()
+
+        check_map = {
+            'price_mode': '__price',
+            'value': '__price',
+        }
+        for k in self.fields:
+            if not self.is_bulk_checked(check_map.get(k, k)):
+                continue
+
+            if k == 'itemvar':
+                fields.add("item")
+                fields.add("variation")
+                fields.add("quota")
+            else:
+                fields.add(k)
+            for obj in objs:
+                if k == 'itemvar':
+                    obj.item = self.cleaned_data["item"]
+                    obj.variation = self.cleaned_data["variation"]
+                    obj.quota = self.cleaned_data["quota"]
+                else:
+                    setattr(obj, k, self.cleaned_data[k])
+
+        fields = [f for f in fields if f != 'itemvars']
+        if fields:
+            Voucher.objects.bulk_update(objs, fields, 200)
+
+    def full_clean(self):
+        if len(self.data) == 0:
+            # form wasn't submitted
+            self._errors = ErrorDict()
+            return
+        super().full_clean()
+
+    def _post_clean(self):
+        pass  # skip model-level clean
+
+
 class VoucherBulkForm(VoucherForm):
     codes = forms.CharField(
         widget=forms.Textarea,

src/pretix/control/middleware.py

@@ -36,7 +36,8 @@ from urllib.parse import quote, urljoin, urlparse
 
 from django.conf import settings
 from django.contrib.auth import REDIRECT_FIELD_NAME, logout
-from django.http import Http404
+from django.contrib.auth.views import redirect_to_login
+from django.http import Http404, HttpResponse
 from django.shortcuts import get_object_or_404, resolve_url
 from django.template.response import TemplateResponse
 from django.urls import get_script_prefix, resolve, reverse
@@ -97,6 +98,8 @@ class PermissionMiddleware:
         super().__init__()
 
     def _login_redirect(self, request):
+        from django.contrib.auth.views import redirect_to_login
+
         # Taken from django/contrib/auth/decorators.py
         path = request.build_absolute_uri()
         # urlparse chokes on lazy objects in Python 3, force to str
@@ -109,10 +112,21 @@ class PermissionMiddleware:
         if ((not login_scheme or login_scheme == current_scheme) and
                 (not login_netloc or login_netloc == current_netloc)):
             path = request.get_full_path()
-        from django.contrib.auth.views import redirect_to_login
 
-        return redirect_to_login(
-            path, resolved_login_url, REDIRECT_FIELD_NAME)
+        if request.headers.get("X-Requested-With") == "XMLHttpRequest":
+            # It's not useful to return a 302 redirect on a XMLHttpRequest request,  because
+            # the XMLHttpRequest is unable to detect redirects.
+            return HttpResponse(
+                "Authentication required",
+                status=401,
+                headers={
+                    # Appending ?next= is handled by client, because it should be the top-level context url,
+                    # not the URL called in the background
+                    "X-Login-Url": resolved_login_url,
+                }
+            )
+
+        return redirect_to_login(path, resolved_login_url, REDIRECT_FIELD_NAME)
 
     def __call__(self, request):
         url = resolve(request.path_info)
@@ -212,14 +226,17 @@ class AuditLogMiddleware:
         if request.path.startswith(get_script_prefix() + 'control') and request.user.is_authenticated:
             if getattr(request.user, "is_hijacked", False):
                 hijack_history = request.session.get('hijack_history', False)
-                hijacker = get_object_or_404(User, pk=hijack_history[0])
+                hijacker = get_object_or_404(User, pk=hijack_history[0]["user"])
                 ss = hijacker.get_active_staff_session(request.session.get('hijacker_session'))
-                if ss:
-                    ss.logs.create(
-                        url=request.path,
-                        method=request.method,
-                        impersonating=request.user
-                    )
+                if not ss:
+                    # Staff session expired or not found
+                    logout(request)
+                    return redirect_to_login(request.get_full_path())
+                ss.logs.create(
+                    url=request.path,
+                    method=request.method,
+                    impersonating=request.user
+                )
             else:
                 ss = request.user.get_active_staff_session(request.session.session_key)
                 if ss:

src/pretix/control/signals.py

@@ -39,7 +39,8 @@ from pretix.base.signals import (
 html_page_start = GlobalSignal()
 """
 This signal allows you to put code in the beginning of the main page for every
-page in the backend. You are expected to return HTML.
+page in the backend. You are expected to return a SafeString containing HTML, or
+a string that will be HTML-escaped.
 
 The ``sender`` keyword argument will contain the request.
 """
@@ -129,7 +130,7 @@ event_dashboard_top = EventPluginSignal()
 Arguments: 'request'
 
 This signal is sent out to include custom HTML in the top part of the the event dashboard.
-Receivers should return HTML.
+Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 An additional keyword argument ``subevent`` *can* contain a sub-event.
@@ -140,7 +141,7 @@ event_dashboard_widgets = EventPluginSignal()
 This signal is sent out to include widgets in the event dashboard. Receivers
 should return a list of dictionaries, where each dictionary can have the keys:
 
-* content (str, containing HTML)
+* content (SafeString, containing HTML)
 * display_size (str, one of "full" (whole row), "big" (half a row) or "small"
   (quarter of a row). May be ignored on small displays, default is "small")
 * priority (int, used for ordering, higher comes first, default is 1)
@@ -157,7 +158,7 @@ Arguments: 'user'
 This signal is sent out to include widgets in the personal user dashboard. Receivers
 should return a list of dictionaries, where each dictionary can have the keys:
 
-* content (str, containing HTML)
+* content (SafeString, containing HTML)
 * display_size (str, one of "full" (whole row), "big" (half a row) or "small"
   (quarter of a row). May be ignored on small displays, default is "small")
 * priority (int, used for ordering, higher comes first, default is 1)
@@ -172,6 +173,7 @@ Arguments: 'form'
 
 This signal allows you to add additional HTML to the form that is used for modifying vouchers.
 You receive the form object in the ``form`` keyword argument.
+Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -209,6 +211,7 @@ Arguments: 'quota'
 
 This signal allows you to append HTML to a Quota's detail view. You receive the
 quota as argument in the ``quota`` keyword argument.
+Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -219,6 +222,7 @@ Arguments: 'subevent'
 
 This signal allows you to append HTML to a SubEvent's detail view. You receive the
 subevent as argument in the ``subevent`` keyword argument.
+Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 """
@@ -265,7 +269,8 @@ order_info = EventPluginSignal()
 """
 Arguments: ``order``, ``request``
 
-This signal is sent out to display additional information on the order detail page
+This signal is sent out to display additional information on the order detail page.
+Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 Additionally, the argument ``order`` and ``request`` are available.
@@ -275,7 +280,8 @@ order_approve_info = EventPluginSignal()
 """
 Arguments: ``order``, ``request``
 
-This signal is sent out to display additional information on the order approve page
+This signal is sent out to display additional information on the order approve page.
+Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 Additionally, the argument ``order`` and ``request`` are available.
@@ -286,6 +292,7 @@ order_position_buttons = EventPluginSignal()
 Arguments: ``order``, ``position``, ``request``
 
 This signal is sent out to display additional buttons for a single position of an order.
+Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 Additionally, the argument ``order`` and ``request`` are available.
@@ -315,6 +322,7 @@ Arguments: 'request'
 
 This signal is sent out to include template snippets on the settings page of an event
 that allows generating a pretix Widget code.
+Receivers should return a SafeString containing HTML, or a string that will be HTML-escaped.
 
 As with all event plugin signals, the ``sender`` keyword argument will contain the event.
 A second keyword argument ``request`` will contain the request object.

src/pretix/control/sysreport.py

@@ -38,6 +38,7 @@ from pretix import __version__
 from pretix.base.models import Order, OrderPayment, Transaction
 from pretix.base.plugins import get_all_plugins
 from pretix.base.templatetags.money import money_filter
+from pretix.helpers.reportlab import PlainTextParagraph
 from pretix.plugins.reports.exporters import ReportlabExportMixin
 from pretix.settings import DATA_DIR
 
@@ -79,23 +80,23 @@ class SysReport(ReportlabExportMixin):
         style_small.fontSize = 6
 
         story = [
-            Paragraph("System report", headlinestyle),
+            PlainTextParagraph("System report", headlinestyle),
             Spacer(1, 5 * mm),
-            Paragraph("Usage", subheadlinestyle),
+            PlainTextParagraph("Usage", subheadlinestyle),
             Spacer(1, 5 * mm),
             self._usage_table(),
             Spacer(1, 5 * mm),
-            Paragraph("Installed versions", subheadlinestyle),
+            PlainTextParagraph("Installed versions", subheadlinestyle),
             Spacer(1, 5 * mm),
             self._tech_table(),
             Spacer(1, 5 * mm),
-            Paragraph("Plugins", subheadlinestyle),
+            PlainTextParagraph("Plugins", subheadlinestyle),
             Spacer(1, 5 * mm),
-            Paragraph(self._get_plugin_versions(), style_small),
+            PlainTextParagraph(self._get_plugin_versions(), style_small),
             Spacer(1, 5 * mm),
-            Paragraph("Custom templates", subheadlinestyle),
+            PlainTextParagraph("Custom templates", subheadlinestyle),
             Spacer(1, 5 * mm),
-            Paragraph(self._get_custom_templates(), style_small),
+            PlainTextParagraph(self._get_custom_templates(), style_small),
             Spacer(1, 5 * mm),
         ]
 
@@ -121,13 +122,13 @@ class SysReport(ReportlabExportMixin):
             ("RIGHTPADDING", (-1, 0), (-1, -1), 0),
         ]
         tdata = [
-            [Paragraph("Site URL:", style), Paragraph(settings.SITE_URL, style)],
-            [Paragraph("pretix version:", style), Paragraph(__version__, style)],
-            [Paragraph("Python version:", style), Paragraph(sys.version, style)],
-            [Paragraph("Platform:", style), Paragraph(platform.platform(), style)],
+            [PlainTextParagraph("Site URL:", style), Paragraph(settings.SITE_URL, style)],
+            [PlainTextParagraph("pretix version:", style), Paragraph(__version__, style)],
+            [PlainTextParagraph("Python version:", style), Paragraph(sys.version, style)],
+            [PlainTextParagraph("Platform:", style), Paragraph(platform.platform(), style)],
             [
-                Paragraph("Database engine:", style),
-                Paragraph(settings.DATABASES["default"]["ENGINE"], style),
+                PlainTextParagraph("Database engine:", style),
+                PlainTextParagraph(settings.DATABASES["default"]["ENGINE"], style),
             ],
         ]
         table = Table(tdata, colWidths=colwidths, repeatRows=0)
@@ -206,7 +207,7 @@ class SysReport(ReportlabExportMixin):
         year_last = now().year
         tdata = [
             [
-                Paragraph(l, style_small_head)
+                PlainTextParagraph(l, style_small_head)
                 for l in (
                     "Time frame",
                     "Currency",
@@ -257,19 +258,19 @@ class SysReport(ReportlabExportMixin):
 
                 tdata.append(
                     (
-                        Paragraph(
+                        PlainTextParagraph(
                             date_format(first_day, "M Y")
                             + " – "
                             + date_format(after_day - timedelta(days=1), "M Y"),
                             style_small,
                         ),
-                        Paragraph(c, style_small),
-                        Paragraph(str(orders_count), style_small) if i == 0 else "",
-                        Paragraph(money_filter(revenue_data.get("s_net") or 0, c), style_small),
-                        Paragraph(str(testmode_count), style_small) if i == 0 else "",
-                        Paragraph(str(unconfirmed_count), style_small) if i == 0 else "",
-                        Paragraph(str(revenue_data.get("c") or 0), style_small),
-                        Paragraph(money_filter(revenue_data.get("s_gross") or 0, c), style_small),
+                        PlainTextParagraph(c, style_small),
+                        PlainTextParagraph(str(orders_count), style_small) if i == 0 else "",
+                        PlainTextParagraph(money_filter(revenue_data.get("s_net") or 0, c), style_small),
+                        PlainTextParagraph(str(testmode_count), style_small) if i == 0 else "",
+                        PlainTextParagraph(str(unconfirmed_count), style_small) if i == 0 else "",
+                        PlainTextParagraph(str(revenue_data.get("c") or 0), style_small),
+                        PlainTextParagraph(money_filter(revenue_data.get("s_gross") or 0, c), style_small),
                     )
                 )
 

src/pretix/control/templates/pretixcontrol/auth/login.html

@@ -56,5 +56,4 @@
     </form>
     <script type="text/plain" id="good_origin">{{ good_origin }}</script>
     <script type="text/plain" id="bad_origin_report_url">{{ bad_origin_report_url }}</script>
-    <!-- pretix-login-marker -->{# marker required for ajax calls to detect that user session is over #}
 {% endblock %}

src/pretix/control/templates/pretixcontrol/auth/login_2fa.html

@@ -3,6 +3,7 @@
 {% load i18n %}
 {% load static %}
 {% load compress %}
+{% load escapejson %}
 {% block content %}
     <form class="form-signin" action="" method="post" id="webauthn-form">
         {% csrf_token %}
@@ -30,8 +31,7 @@
     </form>
     {% if jsondata %}
         <script type="text/json" id="webauthn-login">
-            {{ jsondata|safe }}
-
+            {{ jsondata|escapejson }}
         </script>
     {% endif %}
     {% compress js %}

src/pretix/control/templates/pretixcontrol/dashboard.html

@@ -28,7 +28,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </div>
                 </div>
@@ -51,7 +51,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </div>
                 </div>
@@ -72,7 +72,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </div>
                 </div>
@@ -94,7 +94,7 @@
                             {% if w.lazy %}
                                 <span class="fa fa-cog fa-4x"></span>
                             {% else %}
-                                {{ w.content|safe }}
+                                {{ w.content }}
                             {% endif %}
                         </a>
                     {% else %}
@@ -102,7 +102,7 @@
                             {% if w.lazy %}
                                 <span class="fa fa-cog fa-4x"></span>
                             {% else %}
-                                {{ w.content|safe }}
+                                {{ w.content }}
                             {% endif %}
                         </div>
                     {% endif %}

src/pretix/control/templates/pretixcontrol/email/confirmation_code.txt

@@ -1,13 +1,13 @@
-{% load i18n %}{% blocktrans with url=url|safe messages=messages|safe %}Hello,
+{% load i18n %}{% blocktrans with code=code reason=reason instance=instance %}Hello,
 
 {{ reason }}
 
     {{ code }}
 
-Please do never give this code to another person. Our support team will never ask for this code.
+Don't share this code with anyone. The {{ instance }} team will never ask you for it.
 
-If this code was not requested by you, please contact us immediately.
+If you didn't request this code, please contact us immediately.
 
-Best regards,
-Your {{ instance }} team
+Thanks,  
+The {{ instance }} Team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/email_setup.txt

@@ -1,14 +1,15 @@
-{% load i18n %}{% blocktrans with code=code instance=instance %}Hello,
+{% load i18n %}{% blocktrans with code=code address=address instance=instance %}Hello,
 
-someone requested to use {{ address }} as a sender address on {{ instance }}.
-This will allow them to send emails that are shown to originate from this email address.
-If that was you, please enter the following confirmation code:
+Someone requested to use {{ address }} as a sender address on {{ instance }}. Once verified, emails sent from {{ instance }} can show this address as the sender.
 
-{{ code }}
+If this was you, enter the following code in the setup form:
 
-If this was not requested by you, you can safely ignore this email.
+    {{ code }}
 
-Best regards,  
+Don't share this code with anyone unless you want to authorize them to use this address for this purpose. The {{ instance }} team will never ask you for it.
 
-Your {{ instance }} team
-{% endblocktrans %}
+If you didn't request this, you can safely ignore this email.
+
+Thanks,  
+The {{ instance }} Team
+{% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/forgot.txt

@@ -1,9 +1,11 @@
 {% load i18n %}{% blocktrans with url=url|safe %}Hello,
 
-you requested a new password. Please go to the following page to reset your password:
+We received a request to reset the password for your {{ instance }} account. To choose a new password, follow the link below:
 
 {{ url }}
 
-Best regards,  
-Your {{ instance }} team
+If you didn't request this, you can safely ignore this email — your password won't change.
+
+Thanks,  
+The {{ instance }} Team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/invitation.txt

@@ -1,17 +1,16 @@
 {% load i18n %}{% blocktrans with url=url|safe %}Hello,
 
-you have been invited to a team on {{ instance }}, a platform to perform event
-ticket sales.
+You've been invited to join a team on {{ instance }}, an event ticket sales platform.
 
-Organizer: {{ organizer }}
-Team: {{ team }}
+- Organizer: {{ organizer }}
+- Team: {{ team }}
+
+To accept, follow the link below:
 
-If you want to join that team, just click on the following link:
 {{ url }}
 
-If you do not want to join, you can safely ignore or delete this email.
+If you don't want to join, you can safely ignore this email.
 
-Best regards,  
-
-Your {{ instance }} team
+Thanks,  
+The {{ instance }} Team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/login_notice.txt

@@ -1,13 +1,19 @@
-{% load i18n %}{% blocktrans with url=url|safe os=source.os_type agent=source.agent_type %}Hello,
+{% load i18n %}{% blocktrans %}Hello,
 
-a login to your {{ instance }} account from an unusual or new location was detected. The login was performed using {{ agent }} on {{ os }} from {{ country }}.
+We noticed a new sign-in to your {{ instance }} account:
+{% endblocktrans %}
+- {% trans "Time" %}: {{ when }}
+- {% trans "Browser" %}: {{ agent }}
+- {% trans "Operating system" %}: {{ os }}
+{% if device %}- {% trans "Device" %}: {{ device }}
+{% endif %}{% if country %}- {% trans "Country" %}: {{ country }}
+{% endif %}
+{% blocktrans with url=url|safe %}If it was you, no action is needed.
 
-If this was you, you can safely ignore this email.
-
-If this was not you, we recommend that you change your password in your account settings:
+If you don't recognize this sign-in, please change your password immediately:
 
 {{ url }}
 
-Best regards,  
-Your {{ instance }} team
+Thanks,  
+The {{ instance }} Team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/security_notice.txt

@@ -1,16 +1,15 @@
 {% load i18n %}{% blocktrans with url=url|safe messages=messages|safe %}Hello,
 
-this is to inform you that the account information of your {{ instance }} account has been
-changed. In particular, the following changes have been performed:
+The following changes were made to your {{ instance }} account:
 
 {{ messages }}
 
-If this change was not performed by you, please contact us immediately.
+If you didn't make these changes, please contact the {{ instance }} support team immediately.
 
-You can review and change your account settings here:
+You can review your account settings here:
 
 {{ url }}
 
-Best regards,  
-Your {{ instance }} team
+Thanks,  
+The {{ instance }} Team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email_setup_simple.html

@@ -50,6 +50,46 @@
                         {% endblocktrans %}
                     </div>
                 {% endif %}
+                {% if dkim_warning %}
+                    <div class="alert alert-danger">
+                        <p>
+                            {{ dkim_warning }}
+                        </p>
+                        <p>
+                            {% trans "Your new DKIM record should be set up as a CNAME record like this:" %}
+                        </p>
+                        <pre><code>{{ dkim_hostname }}  CNAME  {{ dkim_cname }}</code></pre>
+                        <p>
+                            {% trans "Please keep in mind that updates to DNS might require multiple hours to take effect." %}
+                        </p>
+                    </div>
+                {% elif dkim_cname %}
+                    <div class="alert alert-success">
+                        {% blocktrans trimmed %}
+                            We found a DKIM record on your domain for this system. Great!
+                        {% endblocktrans %}
+                    </div>
+                {% endif %}
+                {% if dmarc_warning %}
+                    <div class="alert alert-danger">
+                        <p>
+                            {{ dmarc_warning }}
+                        </p>
+                        <p>
+                            {% trans "Your new DMARC record could look like this:" %}
+                        </p>
+                        <pre><code>_dmarc.{{ hostname }}  TXT  "v=DMARC1; p=quarantine; sp=none; adkim=r; aspf=r;"</code></pre>
+                        <p>
+                            {% trans "Please keep in mind that updates to DNS might require multiple hours to take effect." %}
+                        </p>
+                    </div>
+                {% elif dkim_cname %}
+                    <div class="alert alert-success">
+                        {% blocktrans trimmed %}
+                            We found a DMARC record on your domain for this system. Great!
+                        {% endblocktrans %}
+                    </div>
+                {% endif %}
                 {% if verification %}
                     <h3>{% trans "Verification" %}</h3>
                     <p>
@@ -70,7 +110,7 @@
             </div>
         </div>
 
-        {% if spf_warning %}
+        {% if spf_warning or dkim_warning or dmarc_warning %}
             <div class="form-group submit-group">
                 <a href="" class="btn btn-default btn-save">
                     {% trans "Cancel" %}

src/pretix/control/templates/pretixcontrol/event/index.html

@@ -106,7 +106,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </a>
                 {% elif w.link %}
@@ -114,7 +114,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x´"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </a>
                 {% else %}
@@ -122,7 +122,7 @@
                         {% if w.lazy %}
                             <span class="fa fa-cog fa-4x"></span>
                         {% else %}
-                            {{ w.content|safe }}
+                            {{ w.content }}
                         {% endif %}
                     </div>
                 {% endif %}

src/pretix/control/templates/pretixcontrol/event/live.html

@@ -19,7 +19,7 @@
                         </p>
                         <ul>
                             {% for issue in issues %}
-                                <li>{{ issue|safe }}</li>
+                                <li>{{ issue }}</li>
                             {% endfor %}
                         </ul>
                     </div>
@@ -42,7 +42,7 @@
                         </p>
                         <ul>
                             {% for issue in issues %}
-                                <li>{{ issue|safe }}</li>
+                                <li>{{ issue }}</li>
                             {% endfor %}
                         </ul>
                     </div>

src/pretix/control/templates/pretixcontrol/event/payment.html

@@ -12,7 +12,7 @@
                 <table class="table table-payment-providers">
                     <tbody>
                     {% for provider in providers %}
-                        <tr>
+                        <tr{% if provider.highlight %} class="success-left"{% endif %}>
                             <td>
                                 <strong>{{ provider.verbose_name }}</strong>
                             </td>
@@ -56,7 +56,7 @@
                             <td colspan="4">
                                 <br>
                                 {% url "control:event.settings.plugins" event=request.event.slug organizer=request.organizer.slug as plugin_settings_url %}
-                                <a href="{{ plugin_settings_url }}#tab-0-1-open" class="btn btn-default">
+                                <a href="{{ plugin_settings_url }}?go=payment#tab-0-1-open" class="btn btn-default">
                                     <i class="fa fa-plus"></i> {% trans "Enable additional payment plugins" %}
                                 </a>
                             </td>

src/pretix/control/templates/pretixcontrol/event/plugins.html

@@ -28,6 +28,7 @@
     </div>
     <form action="" method="post" class="form-horizontal form-plugins">
         {% csrf_token %}
+        <input type="hidden" name="go" value="{{ request.GET.go }}">
         <div id="plugin_search_results" class="panel panel-default collapse">
             <div class="panel-heading">
                 <button type="button" class="close" aria-label="Close"><span aria-hidden="true">×</span></button>

src/pretix/control/templates/pretixcontrol/event/settings.html

@@ -30,6 +30,7 @@
                 {% bootstrap_field form.date_admission layout="control" %}
                 {% bootstrap_field form.currency layout="control" %}
                 {% bootstrap_field sform.contact_mail layout="control" %}
+                {% bootstrap_field sform.contact_url layout="control" %}
                 {% bootstrap_field sform.imprint_url layout="control" %}
                 {% bootstrap_field form.is_public layout="control" %}
                 {% bootstrap_field form.all_sales_channels layout="control" %}

src/pretix/control/templates/pretixcontrol/items/index.html

@@ -156,11 +156,11 @@
                                     <br/>
                                     <small class="text-muted">
                                         {% if not i.tax_rule.price_includes_tax %}
-                                            {% blocktrans trimmed with rate=i.tax_rule.rate|floatformat:-2 taxname=i.tax_rule.name %}
+                                            {% blocktrans trimmed with rate=i.tax_rule.rate|tax_rate_format taxname=i.tax_rule.name %}
                                                 <strong>plus</strong> {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         {% else %}
-                                            {% blocktrans trimmed with rate=i.tax_rule.rate|floatformat:-2 taxname=i.tax_rule.name|default:s_taxes %}
+                                            {% blocktrans trimmed with rate=i.tax_rule.rate|tax_rate_format taxname=i.tax_rule.name|default:s_taxes %}
                                                 incl. {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         {% endif %}

src/pretix/control/templates/pretixcontrol/order/cancel.html

@@ -2,6 +2,7 @@
 {% load i18n %}
 {% load bootstrap3 %}
 {% load money %}
+{% load wrap_in %}
 {% block title %}
     {% trans "Cancel order" %}
 {% endblock %}
@@ -26,7 +27,7 @@
         {% if form.cancellation_fee %}
             {% if fee %}
                 {% with fee|money:request.event.currency as f %}
-                    <p>{% blocktrans trimmed with fee="<strong>"|add:f|add:"</strong>"|safe %}
+                    <p>{% blocktrans trimmed with fee=f|wrap_in:"strong" %}
                         The configured cancellation fee for a self-service cancellation would be {{ fee }} for this
                         order, but for a cancellation performed by you, you need to set the cancellation fee here:
                     {% endblocktrans %}</p>

src/pretix/control/templates/pretixcontrol/order/change.html

@@ -284,6 +284,14 @@
                             </div>
                             <div class="col-sm-4">
                                 {% bootstrap_field position.form.operation_secret layout='inline' %}
+                                {% if position.issued_gift_cards.exists %}
+                                    <div class="alert alert-info">
+                                        {% blocktrans trimmed %}
+                                        Ticket secrets of order positions that have been used to issue a gift card can not
+                                        be changed. Only the link will be changed in this case.
+                                        {% endblocktrans %}
+                                    </div>
+                                {% endif %}
                             </div>
                         </div>
 

src/pretix/control/templates/pretixcontrol/order/index.html

@@ -705,7 +705,7 @@
                                     {% if line.tax_rate %}
                                         <br/>
                                         <small>
-                                            {% blocktrans trimmed with rate=line.tax_rate|floatformat:-2 taxname=line.tax_rule.name|default:s_taxes %}
+                                            {% blocktrans trimmed with rate=line.tax_rate|tax_rate_format taxname=line.tax_rule.name|default:s_taxes %}
                                                 <strong>plus</strong> {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         </small>
@@ -715,7 +715,7 @@
                                     {% if line.tax_rate and line.price %}
                                         <br/>
                                         <small>
-                                            {% blocktrans trimmed with rate=line.tax_rate|floatformat:-2 taxname=line.tax_rule.name|default:s_taxes %}
+                                            {% blocktrans trimmed with rate=line.tax_rate|tax_rate_format taxname=line.tax_rule.name|default:s_taxes %}
                                                 incl. {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         </small>
@@ -755,7 +755,7 @@
                                     {% if fee.tax_rate %}
                                         <br/>
                                         <small>
-                                            {% blocktrans trimmed with rate=fee.tax_rate|floatformat:-2 taxname=fee.tax_rule.name|default:s_taxes %}
+                                            {% blocktrans trimmed with rate=fee.tax_rate|tax_rate_format taxname=fee.tax_rule.name|default:s_taxes %}
                                                 <strong>plus</strong> {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         </small>
@@ -765,7 +765,7 @@
                                     {% if fee.tax_rate %}
                                         <br/>
                                         <small>
-                                            {% blocktrans trimmed with rate=fee.tax_rate|floatformat:-2 taxname=fee.tax_rule.name|default:s_taxes %}
+                                            {% blocktrans trimmed with rate=fee.tax_rate|tax_rate_format taxname=fee.tax_rule.name|default:s_taxes %}
                                                 incl. {{ rate }}% {{ taxname }}
                                             {% endblocktrans %}
                                         </small>
@@ -903,7 +903,7 @@
                                             <tr>
                                                 <td colspan="1"></td>
                                                 <td colspan="5">
-                                                    {{ p.html_info|safe }}
+                                                    {{ p.html_info }}
                                                     {% if staff_session %}
                                                         <p>
                                                             <a href="" class="btn btn-default btn-xs admin-only" data-expandpayment data-id="{{ p.pk }}">
@@ -1018,7 +1018,7 @@
                                                             </dl>
                                                         {% endif %}
                                                         {% if r.html_info %}
-                                                            {{ r.html_info|safe }}
+                                                            {{ r.html_info }}
                                                         {% endif %}
                                                         {% if staff_session %}
                                                             <p>

src/pretix/control/templates/pretixcontrol/organizers/device_connect.html

@@ -2,6 +2,7 @@
 {% load i18n %}
 {% load static %}
 {% load bootstrap3 %}
+{% load escapejson %}
 {% block inner %}
     <h1>{% trans "Connect to device:" %} {{ device.name }}</h1>
 
@@ -18,7 +19,7 @@
                 {% trans "Open the app that you want to connect and optionally reset it to the original state." %}
             </li>
             <li>{% trans "Scan the following configuration code:" %}<br><br>
-                <script type="text/json" data-replace-with-qr>{{ qrdata|safe }}</script><br>
+                <script type="application/json" data-replace-with-qr>{{ qrdata|escapejson_dumps }}</script><br>
                 {% trans "If your app/device does not support scanning a QR code, you can also enter the following information:" %}
                 <br>
                 <strong>{% trans "System URL:" %}</strong> <code id="system_url">{{ settings.SITE_URL }}</code>

src/pretix/control/templates/pretixcontrol/organizers/devices.html

@@ -137,6 +137,15 @@
                             </td>
                             <td>
                                 {{ d.software_brand|default_if_none:"" }} {{ d.software_version|default_if_none:"" }}
+                                {% if staff_session %}
+                                    <details class="admin-only">
+                                        <summary>
+                                            <i class="fa fa-angle-down collapse-indicator"></i>
+                                            {% trans "Details" %}
+                                        </summary>
+                                        <pre class="admin-only">{{ d.info|pprint }}</pre>
+                                    </details>
+                                {% endif %}
                             </td>
                             <td>
                                 {% if d.initialized %}

src/pretix/control/templates/pretixcontrol/organizers/edit.html

@@ -34,6 +34,7 @@
                         {% endif %}
                         {% bootstrap_field sform.imprint_url layout="control" %}
                         {% bootstrap_field sform.contact_mail layout="control" %}
+                        {% bootstrap_field sform.contact_url layout="control" %}
                         {% bootstrap_field sform.organizer_info_text layout="control" %}
                         {% bootstrap_field sform.event_team_provisioning layout="control" %}
                         {% if sform.allowed_restricted_plugins %}

src/pretix/control/templates/pretixcontrol/pdf/index.html

@@ -19,9 +19,7 @@
         {% endif %}
     </h1>
 
-    <script type="application/json" id="editor-data">
-        {{ layout|safe }}
-    </script>
+    {{ layout|json_script:"editor-data" }}
     <div class="row">
         <div class="col-md-9">
             <div class="panel panel-default panel-pdf-editor">
@@ -562,11 +560,10 @@
             </div>
         </div>
     </div>
-    <script type="text/plain" id="schema-url">{% static "schema/pdf-layout.schema.json" %}</script>
     <script type="text/javascript" src="{% static "pdfjs/pdf.js" %}"></script>
-    <script type="text/javascript" src="{% static "ajv/ajv2020.bundle.min.js" %}"></script>
     <script type="text/javascript" src="{% static "fabric/fabric.min.js" %}"></script>
     <script type="text/javascript" src="{% static "pretixcontrol/js/ui/editor.js" %}"></script>
+    <script type="text/javascript" src="{% static "schema/pdf-layout.validate.js" %}"></script>
     <img src="{% static 'pretixpresale/pdf/powered_by_pretix_dark.png' %}" id="poweredby-dark" class="sr-only">
     <img src="{% static 'pretixpresale/pdf/powered_by_pretix_white.png' %}" id="poweredby-white" class="sr-only">
     {% for family, styles in fonts.items %}

src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html

@@ -1,6 +1,7 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% load escapejson %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Add a two-factor authentication device" %}</h1>
@@ -32,7 +33,7 @@
         </li>
         <li>
             {% trans "Add a new account to the app by scanning the following barcode:" %}
-            <div class="qrcode-canvas" data-qrdata="#qrdata"></div>
+            <script type="application/json" data-replace-with-qr>{{ qrdata|escapejson_dumps }}</script>
             <p>
                 <a data-toggle="collapse" href="#no_scan">
                     {% trans "Can't scan the barcode?" %}
@@ -81,9 +82,4 @@
         </li>
     </ol>
 
-    <script type="text/json" id="qrdata">
-        {{ qrdata|safe }}
-
-
-    </script>
 {% endblock %}

src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html

@@ -3,6 +3,7 @@
 {% load bootstrap3 %}
 {% load static %}
 {% load compress %}
+{% load escapejson %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Add a two-factor authentication device" %}</h1>
@@ -26,9 +27,7 @@
         {% trans "Device registration failed." %}
     </div>
     <script type="text/json" id="webauthn-enroll">
-        {{ jsondata|safe }}
-
-
+        {{ jsondata|escapejson }}
     </script>
     {% compress js %}
         <script type="text/javascript" src="{% static "pretixcontrol/js/base64js.js" %}"></script>

src/pretix/control/templates/pretixcontrol/user/reauth.html

@@ -3,6 +3,7 @@
 {% load bootstrap3 %}
 {% load compress %}
 {% load static %}
+{% load escapejson %}
 {% block content %}
     <form class="form-signin" id="webauthn-form" action="" method="post">
         {% csrf_token %}
@@ -43,7 +44,7 @@
 
         {% if jsondata %}
             <script type="text/json" id="webauthn-login">
-            {{ jsondata|safe }}
+                {{ jsondata|escapejson }}
             </script>
         {% endif %}
         {% compress js %}

src/pretix/control/templates/pretixcontrol/vouchers/bulk_edit.html

@@ -0,0 +1,83 @@
+{% extends "pretixcontrol/items/base.html" %}
+{% load i18n %}
+{% load bootstrap3 %}
+{% load eventsignal %}
+{% load eventurl %}
+{% block title %}{% trans "Change multiple vouchers" %}{% endblock %}
+{% block inside %}
+    <h1>
+        {% trans "Change multiple vouchers" %}
+        <small>
+            {% blocktrans trimmed with number=vouchers.count %}
+                {{ number }} selected
+            {% endblocktrans %}
+        </small>
+    </h1>
+    <form action="" method="post" class="form-horizontal">
+        {% csrf_token %}
+        <div class="hidden">
+            {% for v in vouchers %}
+                <input type="hidden" name="voucher" value="{{ v.pk }}">
+            {% endfor %}
+        </div>
+        {% bootstrap_form_errors form %}
+            <fieldset>
+                <legend>{% trans "Voucher details" %}</legend>
+                {% bootstrap_field form.max_usages layout="bulkedit" %}
+                {% bootstrap_field form.valid_until layout="bulkedit" %}
+                {% bootstrap_field form.itemvar layout="bulkedit" %}
+
+                <div class="bulk-edit-field-group">
+                    <label class="field-toggle">
+                        <input type="checkbox" name="_bulk" value="{{ form.prefix }}__price" {% if form.prefix|add:"__price" in bulk_selected %}checked{% endif %}>
+                        {% trans "change" context "form_bulk" %}
+                    </label>
+                    <div class="field-content">
+                        <div class="form-group">
+                            <label class="col-md-3 control-label" for="id_tag">{% trans "Price effect" %}</label>
+                            <div class="col-md-5">
+                                {% bootstrap_field form.price_mode show_label=False form_group_class="" %}
+                            </div>
+                            <div class="col-md-4">
+                                {% bootstrap_field form.value show_label=False form_group_class="" %}
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="form-group">
+                    <div class="col-md-9 col-md-offset-3">
+                        <div class="controls">
+                            <div class="alert alert-info">
+                                {% blocktrans trimmed %}
+                                    If you choose "any product" for a specific quota and choose to reserve quota for this
+                                    voucher above, the product can still be unavailable to the voucher holder if another quota
+                                    associated with the product is sold out!
+                                {% endblocktrans %}
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                {% if form.subevent %}
+                    {% bootstrap_field form.subevent layout="bulkedit" %}
+                {% endif %}
+            </fieldset>
+            <fieldset>
+                <legend>{% trans "Advanced settings" %}</legend>
+                {% bootstrap_field form.block_quota layout="bulkedit" %}
+                {% bootstrap_field form.allow_ignore_quota layout="bulkedit" %}
+                {% bootstrap_field form.min_usages layout="bulkedit" %}
+                {% bootstrap_field form.budget addon_after=request.event.currency layout="bulkedit" %}
+                {% bootstrap_field form.tag layout="bulkedit" %}
+                {% bootstrap_field form.comment layout="bulkedit" %}
+                {% bootstrap_field form.show_hidden_items layout="bulkedit" %}
+                {% bootstrap_field form.all_addons_included layout="bulkedit" %}
+                {% bootstrap_field form.all_bundles_included layout="bulkedit" %}
+            </fieldset>
+            <div class="form-group submit-group">
+                <button type="submit" class="btn btn-primary btn-save">
+                    {% trans "Save" %}
+                </button>
+            </div>
+    </form>
+{% endblock %}

src/pretix/control/templates/pretixcontrol/vouchers/index.html

@@ -99,6 +99,9 @@
         </p>
         <form action="{% url "control:event.vouchers.bulkaction"  organizer=request.event.organizer.slug event=request.event.slug %}" method="post">
             {% csrf_token %}
+            {% for field in filter_form %}
+                {{ field.as_hidden }}
+            {% endfor %}
             <div class="table-responsive">
                 <table class="table table-hover table-quotas">
                     <thead>
@@ -112,38 +115,50 @@
                         {% endif %}
                         <th>
                             {% trans "Voucher code" %}
-                            <a href="?{% url_replace request 'ordering' '-code' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'ordering' 'code' %}"><i class="fa fa-caret-up"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' '-code' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'code' %}"><i class="fa fa-caret-up"></i></a>
                         </th>
                         <th>
                             {% trans "Redemptions" %}
-                            <a href="?{% url_replace request 'ordering' '-redeemed' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'ordering' 'redeemed' %}"><i class="fa fa-caret-up"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' '-redeemed' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'redeemed' %}"><i class="fa fa-caret-up"></i></a>
                         </th>
                         <th>
                             {% trans "Expiry" %}
-                            <a href="?{% url_replace request 'ordering' '-valid_until' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'ordering' 'valid_until' %}"><i class="fa fa-caret-up"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' '-valid_until' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'valid_until' %}"><i class="fa fa-caret-up"></i></a>
                         </th>
                         <th>
                             {% trans "Tag" %}
-                            <a href="?{% url_replace request 'ordering' '-tag' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'ordering' 'tag' %}"><i class="fa fa-caret-up"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' '-tag' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'tag' %}"><i class="fa fa-caret-up"></i></a>
                         </th>
                         <th>
                             {% trans "Product" %}
-                            <a href="?{% url_replace request 'ordering' '-item' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'ordering' 'item' %}"><i class="fa fa-caret-up"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' '-item' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'filter-ordering' 'item' %}"><i class="fa fa-caret-up"></i></a>
                         </th>
                         {% if request.event.has_subevents %}
                             <th>
                                 {% trans "Date" context "subevent" %}
-                                <a href="?{% url_replace request 'ordering' '-subevent' %}"><i class="fa fa-caret-down"></i></a>
-                                <a href="?{% url_replace request 'ordering' 'subevent' %}"><i class="fa fa-caret-up"></i></a>
+                                <a href="?{% url_replace request 'filter-ordering' '-subevent' %}"><i class="fa fa-caret-down"></i></a>
+                                <a href="?{% url_replace request 'filter-ordering' 'subevent' %}"><i class="fa fa-caret-up"></i></a>
                             </th>
                         {% endif %}
                         <th></th>
                     </tr>
+                    {% if "event.vouchers:write" in request.eventpermset and page_obj.paginator.num_pages > 1 %}
+                        <tr class="table-select-all warning hidden">
+                            <td>
+                                <input type="checkbox" name="__ALL" id="__all" data-results-total="{{ page_obj.paginator.count }}">
+                            </td>
+                            <td colspan="5">
+                                <label for="__all">
+                                    {% trans "Select all results on other pages as well" %}
+                                </label>
+                            </td>
+                        </tr>
+                    {% endif %}
                     </thead>
                     <tbody>
                     {% for v in vouchers %}
@@ -211,6 +226,10 @@
                         <i class="fa fa-trash" aria-hidden="true"></i>
                         {% trans "Delete selected" %}
                     </button>
+                    <button type="submit" class="btn btn-primary btn-save" name="action" value="edit"
+                            formaction="{% url "control:event.vouchers.bulkedit"  organizer=request.event.organizer.slug event=request.event.slug %}">
+                        <i class="fa fa-edit"></i>{% trans "Edit selected" %}
+                    </button>
                 </div>
             {% endif %}
         </form>

src/pretix/control/templates/pretixcontrol/vouchers/tags.html

@@ -49,11 +49,11 @@
                         <td>
                             <strong>
                             {% if t.tag %}
-                                <a href="{% url "control:event.vouchers" organizer=request.event.organizer.slug event=request.event.slug %}?tag={{ '"'|add:t.tag|add:'"'|urlencode }}">
+                                <a href="{% url "control:event.vouchers" organizer=request.event.organizer.slug event=request.event.slug %}?filter-tag={{ '"'|add:t.tag|add:'"'|urlencode }}">
                                     {{ t.tag }}
                                 </a>
                             {% else %}
-                                <a href="{% url "control:event.vouchers" organizer=request.event.organizer.slug event=request.event.slug %}?tag={{ '<>'|urlencode }}">
+                                <a href="{% url "control:event.vouchers" organizer=request.event.organizer.slug event=request.event.slug %}?filter-tag={{ '<>'|urlencode }}">
                                     {% trans "Empty tag" %}
                                 </a>
                             {% endif %}

src/pretix/control/urls.py

@@ -370,6 +370,7 @@ urlpatterns = [
         re_path(r'^discounts/add$', discounts.DiscountCreate.as_view(), name='event.items.discounts.add'),
         re_path(r'^vouchers/$', vouchers.VoucherList.as_view(), name='event.vouchers'),
         re_path(r'^vouchers/tags/$', vouchers.VoucherTags.as_view(), name='event.vouchers.tags'),
+        re_path(r'^vouchers/tags/typeahead$', typeahead.voucher_tag_typeahead, name='event.vouchers.tags.typeahead'),
         re_path(r'^vouchers/rng$', vouchers.VoucherRNG.as_view(), name='event.vouchers.rng'),
         re_path(r'^vouchers/item_select$', typeahead.itemvarquota_select2, name='event.vouchers.itemselect2'),
         re_path(r'^vouchers/(?P<voucher>\d+)/$', vouchers.VoucherUpdate.as_view(), name='event.voucher'),
@@ -382,6 +383,7 @@ urlpatterns = [
         re_path(r'^vouchers/bulk_add$', vouchers.VoucherBulkCreate.as_view(), name='event.vouchers.bulk'),
         re_path(r'^vouchers/bulk_add/mail_preview$', vouchers.VoucherBulkMailPreview.as_view(), name='event.vouchers.bulk.mail_preview'),
         re_path(r'^vouchers/bulk_action$', vouchers.VoucherBulkAction.as_view(), name='event.vouchers.bulkaction'),
+        re_path(r'^vouchers/bulk_edit$', vouchers.VoucherBulkUpdateView.as_view(), name='event.vouchers.bulkedit'),
         re_path(r'^vouchers/import/$', modelimport.VoucherImportView.as_view(), name='event.vouchers.import'),
         re_path(r'^vouchers/import/(?P<file>[^/]+)/$', modelimport.VoucherProcessView.as_view(), name='event.vouchers.import.process'),
         re_path(r'^orders/(?P<code>[0-9A-Z]+)/transition$', orders.OrderTransition.as_view(),

src/pretix/control/views/auth.py

@@ -65,6 +65,7 @@ from pretix.base.forms.auth import (
 from pretix.base.metrics import pretix_failed_logins, pretix_successful_logins
 from pretix.base.models import TeamInvite, U2FDevice, User, WebAuthnDevice
 from pretix.helpers.http import get_client_ip, redirect_to_url
+from pretix.helpers.ratelimit import rate_limit, rate_limit_reset
 from pretix.helpers.security import handle_login_source, session_login
 
 logger = logging.getLogger(__name__)
@@ -243,7 +244,8 @@ def invite(request, token):
     if request.user.is_authenticated:
         if inv.team.members.filter(pk=request.user.pk).exists():
             messages.error(request, _('You cannot accept the invitation for "{}" as you already are part of '
-                                      'this team.').format(inv.team.name))
+                                      'this team. If you want to add a different user or create a new account, '
+                                      'log out and click the invitation link again.').format(inv.team.name))
             return redirect('control:index')
         else:
             with transaction.atomic():
@@ -318,19 +320,12 @@ class Forgot(TemplateView):
         if self.form.is_valid():
             email = self.form.cleaned_data['email']
 
-            has_redis = settings.HAS_REDIS
-
             try:
                 user = User.objects.get(is_active=True, auth_backend='native', email__iexact=email)
 
-                if has_redis:
-                    from django_redis import get_redis_connection
-                    rc = get_redis_connection("redis")
-                    if rc.exists('pretix_pwreset_%s' % (user.id)):
-                        user.log_action('pretix.control.auth.user.forgot_password.denied.repeated')
-                        raise RepeatedResetDenied()
-                    else:
-                        rc.setex('pretix_pwreset_%s' % (user.id), 3600 * 24, '1')
+                if rate_limit("pwreset", user.pk, max_num=1, expire_time=3600 * 24):
+                    user.log_action('pretix.control.auth.user.forgot_password.denied.repeated')
+                    raise RepeatedResetDenied()
 
             except User.DoesNotExist:
                 logger.warning('Backend password reset for unregistered e-mail \"' + email + '\" requested.')
@@ -343,6 +338,7 @@ class Forgot(TemplateView):
                 user.log_action('pretix.control.auth.user.forgot_password.mail_sent')
 
             finally:
+                has_redis = settings.HAS_REDIS
                 if has_redis:
                     messages.info(request, _('If the address is registered to valid account, then we have sent you an email containing further instructions. '
                                              'Please note that we will send at most one email every 24 hours.'))
@@ -411,11 +407,7 @@ class Recover(TemplateView):
             messages.success(request, _('You can now login using your new password.'))
             user.log_action('pretix.control.auth.user.forgot_password.recovered')
 
-            has_redis = settings.HAS_REDIS
-            if has_redis:
-                from django_redis import get_redis_connection
-                rc = get_redis_connection("redis")
-                rc.delete('pretix_pwreset_%s' % user.id)
+            rate_limit_reset("pwreset", user.pk)
             return redirect('control:auth.login')
         else:
             return self.get(request, *args, **kwargs)

src/pretix/control/views/dashboards.py

@@ -49,7 +49,7 @@ from django.shortcuts import render
 from django.template.loader import get_template
 from django.urls import reverse
 from django.utils.formats import date_format
-from django.utils.html import escape
+from django.utils.html import conditional_escape, escape, format_html
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _, ngettext, pgettext
 
@@ -112,7 +112,7 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs):
 
     return [
         {
-            'content': None if lazy else NUM_WIDGET.format(num=intcomma(tickc), text=_('Attendees (ordered)')),
+            'content': None if lazy else format_html(NUM_WIDGET, num=intcomma(tickc), text=_('Attendees (ordered)')),
             'lazy': 'attendees-ordered',
             'display_size': 'small',
             'priority': 100,
@@ -122,7 +122,7 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs):
             }) + ('?subevent={}'.format(subevent.pk) if subevent else '')
         },
         {
-            'content': None if lazy else NUM_WIDGET.format(num=intcomma(paidc), text=_('Attendees (paid)')),
+            'content': None if lazy else format_html(NUM_WIDGET, num=intcomma(paidc), text=_('Attendees (paid)')),
             'lazy': 'attendees-paid',
             'display_size': 'small',
             'priority': 100,
@@ -132,7 +132,8 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs):
             }) + ('?subevent={}'.format(subevent.pk) if subevent else '')
         },
         {
-            'content': None if lazy else NUM_WIDGET.format(
+            'content': None if lazy else format_html(
+                NUM_WIDGET,
                 num=money_filter(round_decimal(rev, sender.currency), sender.currency, hide_currency=True),
                 text=_('Total revenue ({currency})').format(currency=sender.currency)
             ),
@@ -145,7 +146,7 @@ def base_widgets(sender, subevent=None, lazy=False, **kwargs):
             }) + ('?subevent={}'.format(subevent.pk) if subevent else '')
         },
         {
-            'content': None if lazy else NUM_WIDGET.format(num=prodc, text=_('Active products')),
+            'content': None if lazy else format_html(NUM_WIDGET, num=prodc, text=_('Active products')),
             'lazy': 'active-products',
             'display_size': 'small',
             'priority': 100,
@@ -209,8 +210,8 @@ def waitinglist_widgets(sender, subevent=None, lazy=False, **kwargs):
                             quota_cache[q.pk] = (quota_cache[q.pk][0], quota_cache[q.pk][1] - min(wlt['cnt'], row[1]))
 
         widgets.append({
-            'content': None if lazy else NUM_WIDGET.format(
-                num=intcomma(happy), text=_('available to give to people on waiting list')
+            'content': None if lazy else format_html(
+                NUM_WIDGET, num=intcomma(happy), text=_('available to give to people on waiting list')
             ),
             'lazy': 'waitinglist-avail',
             'priority': 50,
@@ -220,7 +221,9 @@ def waitinglist_widgets(sender, subevent=None, lazy=False, **kwargs):
             })
         })
         widgets.append({
-            'content': None if lazy else NUM_WIDGET.format(num=intcomma(wles.count()), text=_('total waiting list length')),
+            'content': None if lazy else format_html(
+                NUM_WIDGET, num=intcomma(wles.count()), text=_('total waiting list length')
+            ),
             'lazy': 'waitinglist-length',
             'display_size': 'small',
             'priority': 50,
@@ -247,9 +250,10 @@ def quota_widgets(sender, subevent=None, lazy=False, **kwargs):
         if not lazy:
             status, left = qa.results[q] if q in qa.results else q.availability(allow_cache=True)
         widgets.append({
-            'content': None if lazy else NUM_WIDGET.format(
+            'content': None if lazy else format_html(
+                NUM_WIDGET,
                 num='{}/{}'.format(intcomma(left), intcomma(q.size)) if q.size is not None else '\u221e',
-                text=_('{quota} left').format(quota=escape(q.name))
+                text=format_html(_('{quota} left'), quota=q.name)
             ),
             'lazy': 'quota-{}'.format(q.pk),
             'display_size': 'small',
@@ -268,7 +272,8 @@ def shop_state_widget(sender, **kwargs):
     return [{
         'display_size': 'small',
         'priority': 1000,
-        'content': '<div class="shopstate">{t1}<br><span class="{cls}"><span class="fa {icon}"></span> {state}</span>{t2}</div>'.format(
+        'content': format_html(
+            '<div class="shopstate">{t1}<br><span class="{cls}"><span class="fa {icon}"></span> {state}</span>{t2}</div>',
             t1=_('Your ticket shop is'), t2=_('Click here to change'),
             state=_('live') if sender.live and not sender.testmode else (
                 _('live and in test mode') if sender.live else (
@@ -299,9 +304,10 @@ def checkin_widget(sender, subevent=None, lazy=False, **kwargs):
     qs = sender.checkin_lists.filter(subevent=subevent)
     for cl in qs:
         widgets.append({
-            'content': None if lazy else NUM_WIDGET.format(
+            'content': None if lazy else format_html(
+                NUM_WIDGET,
                 num='{}/{}'.format(intcomma(cl.inside_count), intcomma(cl.position_count)),
-                text=_('Present – {list}').format(list=escape(cl.name))
+                text=format_html(_('Present – {list}'), list=cl.name)
             ),
             'lazy': 'checkin-{}'.format(cl.pk),
             'display_size': 'small',
@@ -340,6 +346,12 @@ def welcome_wizard_widget(sender, **kwargs):
     }]
 
 
+def build_json_response(widgets):
+    for widget in widgets:
+        widget['content'] = conditional_escape(widget['content'])
+    return JsonResponse({'widgets': widgets})
+
+
 def event_index(request, organizer, event):
     from pretix.control.forms.event import CommentForm
 
@@ -418,7 +430,7 @@ def event_index_widgets_lazy(request, organizer, event):
     for r, result in event_dashboard_widgets.send(sender=request.event, subevent=subevent, lazy=False):
         widgets.extend(result)
 
-    return JsonResponse({'widgets': widgets})
+    return build_json_response(widgets)
 
 
 def event_index_log_lazy(request, organizer, event):
@@ -505,7 +517,7 @@ def widgets_for_event_qs(request, qs, user, nmax, lazy=False):
         <a href="{url}" class="event">
             <div class="name">{event}</div>
             <div class="daterange">{daterange}</div>
-            <div class="times">{times}</div>
+            <div class="times">{times}{timezone}</div>
         </a>
         <div class="bottomrow">
             {orders}
@@ -549,14 +561,16 @@ def widgets_for_event_qs(request, qs, user, nmax, lazy=False):
                 status = ('success', _('On sale'))
 
         widgets.append({
-            'content': tpl.format(
+            'content': format_html(
+                tpl,
                 event=escape(event.name),
                 times=_('Event series') if event.has_subevents else (
                     ((date_format(event.date_admission.astimezone(tz), 'TIME_FORMAT') + ' / ')
                      if event.date_admission and event.date_admission != event.date_from else '')
                     + (date_format(event.date_from.astimezone(tz), 'TIME_FORMAT') if event.date_from else '')
-                ) + (
-                    ' <span class="fa fa-globe text-muted" data-toggle="tooltip" title="{}"></span>'.format(tzname)
+                ),
+                timezone=(
+                    format_html(' <span class="fa fa-globe text-muted" data-toggle="tooltip" title="{}"></span>', tzname)
                     if tzname != request.timezone and not event.has_subevents else ''
                 ),
                 url=reverse('control:event.index', kwargs={
@@ -564,7 +578,8 @@ def widgets_for_event_qs(request, qs, user, nmax, lazy=False):
                     'organizer': event.organizer.slug
                 }),
                 orders=(
-                    '<a href="{orders_url}" class="orders">{orders_text}</a>'.format(
+                    format_html(
+                        '<a href="{orders_url}" class="orders">{orders_text}</a>',
                         orders_url=reverse('control:event.orders', kwargs={
                             'event': event.slug,
                             'organizer': event.organizer.slug
@@ -631,7 +646,7 @@ def user_index_widgets_lazy(request):
         request.user,
         8
     )
-    return JsonResponse({'widgets': widgets})
+    return build_json_response(widgets)
 
 
 def user_index(request):

src/pretix/control/views/event.py

@@ -41,7 +41,7 @@ from collections import OrderedDict, defaultdict
 from decimal import Decimal
 from io import BytesIO
 from itertools import groupby
-from urllib.parse import urlparse, urlsplit
+from urllib.parse import quote, urlsplit
 from zoneinfo import ZoneInfo
 
 import bleach
@@ -64,7 +64,6 @@ from django.shortcuts import get_object_or_404, redirect
 from django.urls import NoReverseMatch, reverse
 from django.utils.functional import cached_property
 from django.utils.html import conditional_escape, format_html
-from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils.safestring import mark_safe
 from django.utils.timezone import now
 from django.utils.translation import gettext, gettext_lazy as _, gettext_noop
@@ -83,7 +82,7 @@ from pretix.base.models import Event, LogEntry, Order, TaxRule, Voucher
 from pretix.base.models.event import EventMetaValue
 from pretix.base.services import tickets
 from pretix.base.services.invoices import build_preview_invoice_pdf
-from pretix.base.signals import register_ticket_outputs
+from pretix.base.signals import get_defining_app, register_ticket_outputs
 from pretix.base.templatetags.rich_text import markdown_compile_email
 from pretix.control.forms.event import (
     CancelSettingsForm, CommentForm, ConfirmTextFormset, EventDeleteForm,
@@ -97,7 +96,9 @@ from pretix.control.permissions import EventPermissionRequiredMixin
 from pretix.control.views.mailsetup import MailSettingsSetupView
 from pretix.control.views.user import RecentAuthenticationRequiredMixin
 from pretix.helpers.database import rolledback_transaction
-from pretix.multidomain.urlreverse import build_absolute_uri, get_event_domain
+from pretix.multidomain.urlreverse import (
+    eventreverse_absolute, get_event_domain,
+)
 from pretix.presale.views.widget import (
     version_default as widget_version_default,
 )
@@ -440,6 +441,7 @@ class EventPlugins(EventSettingsViewMixin, EventPermissionRequiredMixin, Templat
         plugins_available = {
             p.module: p for p in self.available_plugins(self.object)
         }
+        plugin_enabled = None
 
         with transaction.atomic():
             save_organizer = False
@@ -489,6 +491,7 @@ class EventPlugins(EventSettingsViewMixin, EventPermissionRequiredMixin, Templat
                                 format_html(_('The plugin {} is now active.'),
                                             format_html("<strong>{}</strong>", pluginmeta.name)),
                             ]
+                        plugin_enabled = module
                         messages.success(self.request, mark_safe("".join(info)))
                     else:
                         self.request.event.log_action('pretix.event.plugins.disabled', user=self.request.user,
@@ -498,13 +501,19 @@ class EventPlugins(EventSettingsViewMixin, EventPermissionRequiredMixin, Templat
             self.object.save()
             if save_organizer:
                 self.object.organizer.save()
-        return redirect(self.get_success_url())
+        return redirect(self.get_success_url(plugin_enabled))
 
-    def get_success_url(self) -> str:
-        return reverse('control:event.settings.plugins', kwargs={
-            'organizer': self.request.organizer.slug,
-            'event': self.request.event.slug,
-        })
+    def get_success_url(self, plugin_enabled) -> str:
+        if plugin_enabled and self.request.POST.get('go') == 'payment':
+            return reverse('control:event.settings.payment', kwargs={
+                'organizer': self.request.organizer.slug,
+                'event': self.request.event.slug,
+            }) + '?highlight=' + quote(plugin_enabled) + '#'
+        else:
+            return reverse('control:event.settings.plugins', kwargs={
+                'organizer': self.request.organizer.slug,
+                'event': self.request.event.slug,
+            })
 
 
 class PaymentProviderSettings(EventSettingsViewMixin, EventPermissionRequiredMixin, TemplateView, SingleObjectMixin):
@@ -670,6 +679,8 @@ class PaymentSettings(WritePermissionMixin, EventSettingsViewMixin, EventSetting
             p.sales_channels = [sales_channels[channel] for channel in p.settings.get('_restrict_to_sales_channels', as_type=list, default=['web'])]
             if p.is_meta:
                 p.show_enabled = p.settings._enabled in (True, 'True')
+            if self.request.GET.get('highlight') and getattr(get_defining_app(p), 'name', None) == self.request.GET.get('highlight'):
+                p.highlight = True
         return context
 
 
@@ -951,7 +962,12 @@ class MailSettingsRendererPreview(MailSettingsPreview):
                     context=context,
                 )
                 r = HttpResponse(v, content_type='text/html')
-                r._csp_ignore = True
+                r['Content-Security-Policy'] = (
+                    # Plugin-provided email templates will contain inline styles or remote images
+                    # but emails should not contain JS
+                    "style-src 'unsafe-inline'; "
+                    "img-src https: data:"
+                )
                 return r
         else:
             raise Http404(_('Unknown email renderer.'))
@@ -1148,8 +1164,11 @@ class EventLive(EventPermissionRequiredMixin, TemplateView):
             if request.POST.get("delete") == "yes":
                 try:
                     with transaction.atomic():
-                        for order in request.event.orders.filter(testmode=True):
-                            order.gracefully_delete(user=self.request.user)
+                        Order.gracefully_delete_bulk(
+                            request.event,
+                            request.event.orders.filter(testmode=True),
+                            user=self.request.user
+                        )
                 except ProtectedError:
                     messages.error(self.request, _('An order could not be deleted as some constraints (e.g. data '
                                                    'created by plug-ins) do not allow it.'))
@@ -1424,11 +1443,16 @@ class TaxUpdate(EventSettingsViewMixin, EventPermissionRequiredMixin, UpdateView
         form.instance.custom_rules = json.dumps([
             f.cleaned_data for f in self.formset.ordered_forms if f not in self.formset.deleted_forms
         ], cls=I18nJSONEncoder)
-        if form.has_changed():
+        if form.has_changed() or self.formset.has_changed():
+            change_data = {
+                k: form.cleaned_data.get(k) for k in form.changed_data
+            }
+            if self.formset.has_changed():
+                change_data["custom_rules"] = [
+                    f.cleaned_data for f in self.formset.ordered_forms if f not in self.formset.deleted_forms
+                ]
             self.object.log_action(
-                'pretix.event.taxrule.changed', user=self.request.user, data={
-                    k: form.cleaned_data.get(k) for k in form.changed_data
-                }
+                'pretix.event.taxrule.changed', user=self.request.user, data=change_data
             )
         return super().form_valid(form)
 
@@ -1734,10 +1758,10 @@ class EventQRCode(EventPermissionRequiredMixin, View):
     permission = None
 
     def get(self, request, *args, filetype, **kwargs):
-        url = build_absolute_uri(request.event, 'presale:event.index')
+        url = eventreverse_absolute(request.event, 'presale:event.index')
 
         if "url" in request.GET:
-            if url_has_allowed_host_and_scheme(request.GET["url"], allowed_hosts=[urlparse(url).netloc]):
+            if request.GET["url"].startswith(url):
                 url = request.GET["url"]
             else:
                 raise PermissionDenied("Untrusted URL")

src/pretix/control/views/mailsetup.py

@@ -28,7 +28,7 @@ from django.core.mail import get_connection
 from django.shortcuts import redirect
 from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
-from django.utils.translation import gettext_lazy as _
+from django.utils.translation import gettext, gettext_lazy as _
 from django.views.generic import TemplateView
 
 from pretix.base import email
@@ -41,6 +41,30 @@ from pretix.control.forms.mailsetup import SimpleMailForm, SMTPMailForm
 logger = logging.getLogger(__name__)
 
 
+def get_cname_record(hostname):
+    try:
+        r = dns.resolver.Resolver()
+        answers = r.resolve(hostname, 'CNAME')
+        answers = list(answers)
+        if len(answers) != 1:
+            logger.exception('Found multiple CNAME records for {}'.format(hostname))
+            return
+        return str(answers[0].target).lower()
+    except:
+        logger.exception('Could not fetch CNAME record for {}'.format(hostname))
+
+
+def get_dmarc_record(hostname):
+    try:
+        r = dns.resolver.Resolver()
+        for resp in r.resolve("_dmarc." + hostname, 'TXT'):
+            data = b''.join(resp.strings).decode()
+            if 'DMARC1' in data.strip():
+                return data
+    except:
+        logger.exception("Could not fetch DMARC record for {}".format(hostname))
+
+
 def get_spf_record(hostname):
     try:
         r = dns.resolver.Resolver()
@@ -49,7 +73,7 @@ def get_spf_record(hostname):
             if data.lower().strip().startswith('v=spf1 '):  # RFC7208, section 4.5
                 return data
     except:
-        logger.exception("Could not fetch SPF record")
+        logger.exception("Could not fetch SPF record for {}".format(hostname))
 
 
 def _check_spf_record(not_found_lookup_parts, spf_record, depth):
@@ -168,10 +192,15 @@ class MailSettingsSetupView(TemplateView):
                 return super().get(request, *args, **kwargs)
 
             session_key = f'sender_mail_verification_code_{self.request.path}_{self.simple_form.cleaned_data.get("mail_from")}'
+            verify_dns = (
+                settings.MAIL_CUSTOM_SENDER_SPF_STRING or
+                (settings.MAIL_CUSTOM_SENDER_DKIM_CNAME and settings.MAIL_CUSTOM_SENDER_DKIM_SELECTOR) or
+                settings.MAIL_CUSTOM_SENDER_DMARC_REQUIRED
+            )
             allow_save = (
                 (not settings.MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED or
                  ('verification' in self.request.POST and self.request.POST.get('verification', '') == self.request.session.get(session_key, None))) and
-                (not settings.MAIL_CUSTOM_SENDER_SPF_STRING or self.request.POST.get('state') == 'save')
+                (not verify_dns or self.request.POST.get('state') == 'save')
             )
 
             if allow_save:
@@ -192,8 +221,8 @@ class MailSettingsSetupView(TemplateView):
 
             spf_warning = None
             spf_record = None
+            hostname = self.simple_form.cleaned_data['mail_from'].split('@')[-1]
             if settings.MAIL_CUSTOM_SENDER_SPF_STRING:
-                hostname = self.simple_form.cleaned_data['mail_from'].split('@')[-1]
                 spf_record = get_spf_record(hostname)
                 if not spf_record:
                     spf_warning = _(
@@ -210,19 +239,56 @@ class MailSettingsSetupView(TemplateView):
                         'this system in the SPF record.'
                     )
 
-            verification = settings.MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED and not spf_warning
+            dkim_warning = None
+            dkim_hostname = None
+            dkim_cname = None
+            if settings.MAIL_CUSTOM_SENDER_DKIM_CNAME and settings.MAIL_CUSTOM_SENDER_DKIM_SELECTOR:
+                dkim_hostname = settings.MAIL_CUSTOM_SENDER_DKIM_SELECTOR + '._domainkey.' + hostname
+                cname_target = get_cname_record(dkim_hostname)
+                dkim_cname = settings.MAIL_CUSTOM_SENDER_DKIM_CNAME
+                if not dkim_cname.endswith("."):
+                    dkim_cname += "."
+                if "%s" in dkim_cname:
+                    dkim_cname = dkim_cname.replace("%s", hostname.replace(".", "-").lower())
+                if not cname_target:
+                    dkim_warning = _(
+                        'We could not find a CNAME record pointing to our DKIM key for domain you are trying to use. '
+                        'This means that there is a very high change most of the emails will be rejected or marked as '
+                        'spam. We strongly recommend setting up DKIM through a CNAME record. You can do so through the '
+                        'DNS settings at the provider you registered your domain with.'
+                    )
+                elif cname_target != dkim_cname:
+                    dkim_warning = _(
+                        'We found a CNAME record for a DKIM key, but it is not pointing to the right location. '
+                        'This means that there is a very high chance most of the emails will be rejected or marked as '
+                        'spam. You should update the DNS settings of your domain.'
+                    )
+
+            dmarc_warning = None
+            dmarc_record = None
+            if settings.MAIL_CUSTOM_SENDER_DMARC_REQUIRED:
+                dmarc_record = get_dmarc_record(hostname)
+                if not dmarc_record:
+                    spf_warning = _(
+                        'We did not find DMARC record for your domain. This means that there is a very high chance '
+                        'most of the emails will be rejected or marked as spam. You should update the DNS settings '
+                        'of your domain.'
+                    )
+
+            verification = settings.MAIL_CUSTOM_SENDER_VERIFICATION_REQUIRED and not spf_warning and not dkim_warning and not dmarc_warning
             if verification:
                 if 'verification' in self.request.POST:
                     messages.error(request, _('The verification code was incorrect, please try again.'))
                 else:
                     self.request.session[session_key] = get_random_string(length=6, allowed_chars='1234567890')
+                    sender_address = self.simple_form.cleaned_data.get('mail_from')
                     mail(
-                        self.simple_form.cleaned_data.get('mail_from'),
-                        _('Sender address verification'),
+                        sender_address,
+                        gettext('Confirm %(address)s as a sender address') % {'address': sender_address},
                         'pretixcontrol/email/email_setup.txt',
                         {
                             'code': self.request.session[session_key],
-                            'address': self.simple_form.cleaned_data.get('mail_from'),
+                            'address': sender_address,
                             'instance': settings.PRETIX_INSTANCE_NAME,
                         },
                         None,
@@ -240,6 +306,12 @@ class MailSettingsSetupView(TemplateView):
                     'spf_warning': spf_warning,
                     'spf_record': spf_record,
                     'spf_key': settings.MAIL_CUSTOM_SENDER_SPF_STRING,
+                    'dkim_warning': dkim_warning,
+                    'dkim_hostname': dkim_hostname,
+                    'dkim_cname': dkim_cname,
+                    'dmarc_warning': dmarc_warning,
+                    'dmarc_record': dmarc_record,
+                    'hostname': hostname,
                     'recp': self.simple_form.cleaned_data.get('mail_from')
                 },
                 using=self.template_engine,

src/pretix/control/views/orders.py

@@ -64,7 +64,7 @@ from django.urls import reverse
 from django.utils import formats
 from django.utils.formats import date_format, get_format
 from django.utils.functional import cached_property
-from django.utils.html import conditional_escape, escape
+from django.utils.html import conditional_escape, escape, format_html
 from django.utils.http import url_has_allowed_host_and_scheme
 from django.utils.safestring import mark_safe
 from django.utils.timezone import make_aware, now
@@ -79,7 +79,7 @@ from pretix.base.email import get_email_context
 from pretix.base.exporter import MultiSheetListExporter
 from pretix.base.i18n import language
 from pretix.base.models import (
-    CachedFile, CachedTicket, Checkin, Invoice, InvoiceAddress, Item,
+    CachedFile, CachedTicket, Checkin, GiftCard, Invoice, InvoiceAddress, Item,
     ItemVariation, LogEntry, Order, QuestionAnswer, Quota,
     ScheduledEventExport, generate_secret,
 )
@@ -139,6 +139,7 @@ from pretix.helpers import OF_SELF
 from pretix.helpers.compat import CompatDeleteView
 from pretix.helpers.format import SafeFormatter, format_map
 from pretix.helpers.hierarkey import clean_filename
+from pretix.helpers.iter import chunked_iterable
 from pretix.helpers.json import CustomJSONEncoder
 from pretix.helpers.safedownload import check_token
 from pretix.presale.signals import question_form_fields
@@ -240,7 +241,7 @@ class BaseOrderBulkActionView(OrderSearchMixin, EventPermissionRequiredMixin, As
         raise NotImplementedError()
 
     def execute_bulk(self, queryset: QuerySet, form: forms.Form):
-        qs = self.allowed_for(self.allowed_for(self.get_queryset()))
+        qs = self.allowed_for(self.get_queryset())
         total = qs.count()
         orders_with_successful_action = 0
         for i, o in enumerate(qs):
@@ -394,9 +395,21 @@ class OrderDeleteBulkActionView(BaseOrderBulkActionView):
             testmode=True,
         )
 
-    def execute_single(self, instance, form: forms.Form):
-        instance.gracefully_delete(user=self.request.user)
-        return True
+    def execute_bulk(self, queryset: QuerySet, form: forms.Form):
+        qs = self.allowed_for(self.get_queryset())
+        total = qs.count()
+        all_ids = list(qs.values_list("id", flat=True))
+
+        orders_with_successful_action = 0
+        for chunk in chunked_iterable(all_ids, 1000):
+            Order.gracefully_delete_bulk(
+                self.request.event,
+                qs.filter(id__in=chunk),
+                user=self.request.user,
+            )
+            orders_with_successful_action += len(chunk)
+            self.async_set_progress(orders_with_successful_action / total * 100)
+        return orders_with_successful_action, total
 
 
 class OrderList(OrderSearchMixin, EventPermissionRequiredMixin, PaginationMixin, ListView):
@@ -538,10 +551,10 @@ class OrderDetail(OrderView):
         ctx['refunds'] = self.order.refunds.select_related('payment').order_by('-created')
         for p in ctx['payments']:
             if p.payment_provider:
-                p.html_info = (p.payment_provider.payment_control_render(self.request, p) or "").strip()
+                p.html_info = p.payment_provider.payment_control_render(self.request, p) or ""
         for r in ctx['refunds']:
             if r.payment_provider:
-                r.html_info = (r.payment_provider.refund_control_render(self.request, r) or "").strip()
+                r.html_info = r.payment_provider.refund_control_render(self.request, r) or ""
         ctx['invoices'] = list(self.order.invoices.all().select_related('event'))
         ctx['comment_form'] = CommentForm(initial={
             'comment': self.order.comment,
@@ -1981,7 +1994,7 @@ class OrderChange(OrderView):
         positions = list(self.order.positions.select_related(
             'item', 'item__tax_rule', 'used_membership', 'used_membership__membership_type', 'tax_rule',
             'seat', 'subevent',
-        ).prefetch_related('granted_memberships'))
+        ).prefetch_related('granted_memberships', 'issued_gift_cards'))
         for p in positions:
             p.form = OrderPositionChangeForm(prefix='op-{}'.format(p.pk), instance=p, items=self.items,
                                              initial={'seat': p.seat.seat_guid if p.seat else None},
@@ -2248,6 +2261,12 @@ class OrderContactChange(OrderView):
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data()
         ctx['form'] = self.form
+        if self.order.all_positions.filter(Exists(GiftCard.objects.filter(issued_in=OuterRef('pk')))).exists():
+            self.form.fields['regenerate_secrets'].help_text = format_html(
+                '{}<br><br><strong><span class="fa fa-warning"></span> {}</strong>',
+                self.form.fields['regenerate_secrets'].help_text,
+                _("Ticket secrets of order positions that have been used to issue a gift card can not be changed. Only the link will be changed in this case."),
+            )
         return ctx
 
     @cached_property

src/pretix/control/views/organizer.py

@@ -139,8 +139,8 @@ from pretix.helpers import OF_SELF, GroupConcat
 from pretix.helpers.compat import CompatDeleteView
 from pretix.helpers.dicts import merge_dicts
 from pretix.helpers.format import SafeFormatter, format_map
-from pretix.helpers.urls import build_absolute_uri as build_global_uri
-from pretix.multidomain.urlreverse import build_absolute_uri
+from pretix.helpers.urls import mainreverse_absolute
+from pretix.multidomain.urlreverse import eventreverse_absolute
 from pretix.presale.forms.customer import TokenGenerator
 
 logger = logging.getLogger(__name__)
@@ -1032,14 +1032,16 @@ class TeamMemberView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin,
     def _send_invite(self, instance):
         mail(
             instance.email,
-            _('Account invitation'),
+            gettext('You\'ve been invited to join %(organizer)s') % {
+                'organizer': self.request.organizer.name,
+            },
             'pretixcontrol/email/invitation.txt',
             {
                 'instance': settings.PRETIX_INSTANCE_NAME,
                 'user': self,
                 'organizer': self.request.organizer.name,
                 'team': instance.team.name,
-                'url': build_global_uri('control:auth.invite', kwargs={
+                'url': mainreverse_absolute('control:auth.invite', kwargs={
                     'token': instance.token
                 })
             },
@@ -2851,10 +2853,12 @@ class SSOProviderUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequire
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data(**kwargs)
-        ctx['redirect_uri'] = build_absolute_uri(self.request.organizer, 'presale:organizer.customer.login.return',
-                                                 kwargs={
-                                                     'provider': self.object.pk
-                                                 })
+        ctx['redirect_uri'] = eventreverse_absolute(
+            self.request.organizer, 'presale:organizer.customer.login.return',
+            kwargs={
+                'provider': self.object.pk
+            }
+        )
         return ctx
 
     def get_form_kwargs(self):
@@ -3085,7 +3089,7 @@ class CustomerDetailView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMi
             self.customer.log_action('pretix.customer.password.resetrequested', {}, user=self.request.user)
             ctx = self.customer.get_email_context()
             token = TokenGenerator().make_token(self.customer)
-            ctx['url'] = build_absolute_uri(
+            ctx['url'] = eventreverse_absolute(
                 self.request.organizer,
                 'presale:organizer.customer.recoverpw'
             ) + '?id=' + self.customer.identifier + '&token=' + token

src/pretix/control/views/pdf.py

@@ -70,7 +70,6 @@ class BaseEditorView(EventPermissionRequiredMixin, TemplateView):
         if 'placeholders' in request.GET:
             return self.get_placeholders_help(request)
         resp = super().get(request, *args, **kwargs)
-        resp._csp_ignore = True
         return resp
 
     def get_placeholders_help(self, request):
@@ -284,7 +283,7 @@ class BaseEditorView(EventPermissionRequiredMixin, TemplateView):
         ctx['pdf'] = self.get_current_background()
         ctx['variables'] = self.get_variables()
         ctx['images'] = self.get_images()
-        ctx['layout'] = json.dumps(self.get_current_layout())
+        ctx['layout'] = self.get_current_layout()
         ctx['title'] = self.title
         ctx['locales'] = [p for p in settings.LANGUAGES if p[0] in self.request.event.settings.locales]
         ctx['maxfilesize'] = self.maxfilesize

src/pretix/control/views/subevents.py

@@ -85,6 +85,7 @@ from pretix.control.views import PaginationMixin
 from pretix.control.views.event import MetaDataEditorMixin
 from pretix.helpers import GroupConcat
 from pretix.helpers.compat import CompatDeleteView
+from pretix.helpers.i18n import get_format_without_seconds
 from pretix.helpers.models import modelcopy
 
 
@@ -537,6 +538,7 @@ class SubEventDetail(EventPermissionRequiredMixin, DetailView):
             pcnt=Subquery(
                 OrderPosition.objects.filter(
                     subevent=self.object,
+                    order_id=OuterRef("id"),
                 ).values("subevent").annotate(c=Count("*")).values("c")
             ),
             has_cancellation_request=Exists(CancellationRequest.objects.filter(order=OuterRef("pk"))),
@@ -877,7 +879,7 @@ class SubEventBulkCreate(SubEventEditorMixin, EventPermissionRequiredMixin, Asyn
         ctx['rrule_formset'] = self.rrule_formset
         ctx['time_formset'] = self.time_formset
 
-        tf = get_format('TIME_INPUT_FORMATS')[0]
+        tf = get_format_without_seconds('TIME_INPUT_FORMATS')
         ctx['time_admission_sample'] = time(8, 30, 0).strftime(tf)
         ctx['time_begin_sample'] = time(9, 0, 0).strftime(tf)
         ctx['time_end_sample'] = time(18, 0, 0).strftime(tf)

src/pretix/control/views/typeahead.py

@@ -975,6 +975,21 @@ def subevent_meta_values(request, organizer, event):
     })
 
 
+@event_permission_required('event.vouchers:read')
+def voucher_tag_typeahead(request, **kwargs):
+    q = request.GET.get('q', '')
+    tags = request.event.vouchers.filter(
+        tag__isnull=False,
+        waitinglistentries__isnull=True,
+    ).filter(
+        tag__icontains=q,
+    ).values_list('tag', flat=True).distinct().order_by('tag')[:10]
+
+    return JsonResponse({
+        'results': [{'name': t} for t in tags]
+    })
+
+
 def item_meta_values(request, organizer, event):
     q = request.GET.get('q')
     propname = request.GET.get('property')

src/pretix/control/views/user.py

@@ -80,6 +80,7 @@ from pretix.control.permissions import (
 )
 from pretix.control.views.auth import get_u2f_appid, get_webauthn_rp_id
 from pretix.helpers.http import redirect_to_url
+from pretix.helpers.ratelimit import rate_limit, rate_limit_reset
 from pretix.helpers.security import session_reauth
 from pretix.helpers.u2f import websafe_encode
 
@@ -849,6 +850,7 @@ class UserPasswordChangeView(FormView):
             msgs = []
             msgs.append(_('Your password has been changed.'))
             self.request.user.send_security_notice(msgs)
+            rate_limit_reset("pwreset", self.request.user.pk)
 
             self.request.user.log_action('pretix.user.settings.changed', user=self.request.user, data={'new_pw': True})
 
@@ -879,6 +881,7 @@ class UserEmailChangeView(RecentAuthenticationRequiredMixin, FormView):
 
         return {
             **super().get_form_kwargs(),
+            "request": self.request,
             "user": self.request.user,
         }
 
@@ -908,6 +911,10 @@ class UserEmailVerifyView(View):
             messages.success(self.request, _('Your email address was already verified.'))
             return redirect(reverse('control:user.settings', kwargs={}))
 
+        if rate_limit("emailverify", self.request.user.pk, max_num=2, expire_time=300):
+            messages.error(self.request, _("For security reasons, please wait 5 minutes before you try again."))
+            return redirect(reverse('control:user.settings', kwargs={}))
+
         self.request.user.send_confirmation_code(
             session=self.request.session,
             reason='email_verify',

src/pretix/control/views/users.py

@@ -19,19 +19,23 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
+import hmac
 import json
 from contextlib import contextmanager
 
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import (
-    BACKEND_SESSION_KEY, get_user_model, load_backend, login,
+    BACKEND_SESSION_KEY, HASH_SESSION_KEY, get_user_model, load_backend, login,
+    logout,
 )
 from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.views import redirect_to_login
+from django.core.exceptions import PermissionDenied
 from django.db import transaction
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
-from django.utils.crypto import get_random_string
+from django.utils.crypto import get_random_string, salted_hmac
 from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views import View
@@ -218,11 +222,13 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
 
     def post(self, request, *args, **kwargs):
         self.object = get_object_or_404(User, pk=self.kwargs.get("id"))
+        staff_session = request.user.get_active_staff_session(request.session.session_key)
         self.request.user.log_action('pretix.control.auth.user.impersonated',
                                      user=request.user,
                                      data={
                                          'other': self.kwargs.get("id"),
-                                         'other_email': self.object.email
+                                         'other_email': self.object.email,
+                                         'staff_session': staff_session.pk,
                                      })
         oldkey = request.session.session_key
 
@@ -230,7 +236,15 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
         hijacked = self.object
 
         hijack_history = request.session.get("hijack_history", [])
-        hijack_history.append(request.user._meta.pk.value_to_string(hijacker))
+        hijack_history.append({
+            "user": request.user.pk,
+            # We include the auth_hash, because it is unguessable. So should an attacker gain an attack vector to
+            # modify hijack_history, they can't just insert or change a user that shouldn't be there. We HMAC it
+            # again, though, since we also do not want the auth_hash of the admin user to be in the session of an
+            # unprivileged user to contain the risk if there is some leak of session data.
+            "auth_hash": salted_hmac(key_salt=b"hijack-history-hash", value=request.session[HASH_SESSION_KEY],
+                                     algorithm="sha256", secret=settings.SECRET_KEY).hexdigest(),
+        })
 
         backend = get_used_backend(request)
         backend = f"{backend.__module__}.{backend.__class__.__name__}"
@@ -238,6 +252,12 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
         with signals.no_update_last_login(), keep_session_age(request.session):
             login(request, hijacked, backend=backend)
 
+        request.session.save()
+        staff_session.logs.create(
+            method='(NOTE)',
+            url=f'Begin impersonating user #{hijacked.pk} (request session {oldkey[:8]} -> {request.session.session_key[:8]})',
+        )
+
         request.session["hijack_history"] = hijack_history
 
         signals.hijack_started.send(
@@ -254,13 +274,28 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
 class UserImpersonateStopView(LoginRequiredMixin, View):
 
     def post(self, request, *args, **kwargs):
-        impersonated = request.user
-
-        hijs = request.session['hijacker_session']
+        staff_session_key = request.session['hijacker_session']
+        prev_session_key = request.session.session_key
         hijack_history = request.session.get("hijack_history", [])
         hijacked = request.user
-        user_pk = hijack_history.pop()
-        hijacker = get_object_or_404(get_user_model(), pk=user_pk)
+        prev_session = hijack_history.pop()
+        hijacker = get_object_or_404(get_user_model(), pk=prev_session["user"])
+        staff_session = hijacker.get_active_staff_session(staff_session_key)
+        if not staff_session:
+            raise PermissionDenied
+
+        expected_hash = salted_hmac(
+            key_salt=b"hijack-history-hash",
+            value=hijacker.get_session_auth_hash(),
+            algorithm="sha256",
+            secret=settings.SECRET_KEY
+        ).hexdigest()
+        if not hmac.compare_digest(expected_hash, prev_session["auth_hash"]):
+            # Could be an attacker-controlled hijack history, but could also be e.g. a password change of the admin user
+            # that happened during the hijack session
+            logout(request)
+            return redirect_to_login(request.get_full_path())
+
         backend = get_used_backend(request)
         backend = f"{backend.__module__}.{backend.__class__.__name__}"
         with signals.no_update_last_login(), keep_session_age(request.session):
@@ -275,17 +310,22 @@ class UserImpersonateStopView(LoginRequiredMixin, View):
             hijacked=hijacked,
         )
 
-        ss = request.user.get_active_staff_session(hijs)
-        if ss:
-            request.session.save()
-            ss.session_key = request.session.session_key
-            ss.save()
+        request.session.save()
+        staff_session.session_key = request.session.session_key
+        staff_session.save()
+
+        staff_session.logs.create(
+            method='(NOTE)',
+            url=f'Stop impersonating user #{hijacked.pk} (request session {prev_session_key[:8]}, '
+                f'staff session {staff_session_key[:8]} -> {request.session.session_key[:8]})',
+        )
 
         request.user.log_action('pretix.control.auth.user.impersonate_stopped',
                                 user=request.user,
                                 data={
-                                    'other': impersonated.pk,
-                                    'other_email': impersonated.email
+                                    'other': hijacked.pk,
+                                    'other_email': hijacked.email,
+                                    'staff_session': staff_session.pk,
                                 })
         return redirect(reverse('control:index'))
 

src/pretix/control/views/vouchers.py

@@ -40,9 +40,11 @@ import bleach
 from defusedcsv import csv
 from django.conf import settings
 from django.contrib import messages
-from django.core.exceptions import PermissionDenied, ValidationError
+from django.core.exceptions import (
+    BadRequest, PermissionDenied, ValidationError,
+)
 from django.db import connection, transaction
-from django.db.models import Exists, OuterRef, Sum
+from django.db.models import Count, Exists, OuterRef, Sum
 from django.http import (
     Http404, HttpResponse, HttpResponseBadRequest, HttpResponseRedirect,
     JsonResponse,
@@ -55,7 +57,7 @@ from django.utils.safestring import mark_safe
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from django.views.generic import (
-    CreateView, ListView, TemplateView, UpdateView, View,
+    CreateView, FormView, ListView, TemplateView, UpdateView, View,
 )
 from django_scopes import scopes_disabled
 
@@ -70,17 +72,49 @@ from pretix.base.services.vouchers import vouchers_send
 from pretix.base.templatetags.rich_text import markdown_compile_email
 from pretix.base.views.tasks import AsyncFormView
 from pretix.control.forms.filter import VoucherFilterForm, VoucherTagFilterForm
-from pretix.control.forms.vouchers import VoucherBulkForm, VoucherForm
+from pretix.control.forms.vouchers import (
+    VoucherBulkEditForm, VoucherBulkForm, VoucherForm,
+)
 from pretix.control.permissions import EventPermissionRequiredMixin
 from pretix.control.signals import voucher_form_class
 from pretix.control.views import PaginationMixin
 from pretix.helpers.compat import CompatDeleteView
 from pretix.helpers.format import SafeFormatter, format_map
 from pretix.helpers.models import modelcopy
-from pretix.multidomain.urlreverse import build_absolute_uri
+from pretix.multidomain.urlreverse import eventreverse_absolute
 
 
-class VoucherList(PaginationMixin, EventPermissionRequiredMixin, ListView):
+class VoucherQueryMixin:
+
+    @cached_property
+    def request_data(self):
+        if self.request.method == "POST":
+            return self.request.POST
+        return self.request.GET
+
+    @scopes_disabled()  # we have an event check here, and we can save some performance on subqueries
+    def get_queryset(self):
+        qs = self.request.event.vouchers.exclude(
+            Exists(WaitingListEntry.objects.filter(voucher_id=OuterRef('pk')))
+        )
+        if 'voucher' in self.request_data and '__ALL' not in self.request_data:
+            qs = qs.filter(
+                id__in=self.request_data.getlist('voucher')
+            )
+        elif self.request.method == 'GET' or '__ALL' in self.request_data:
+            if self.filter_form.is_valid():
+                qs = self.filter_form.filter_qs(qs)
+        else:
+            raise BadRequest("No vouchers selected")
+
+        return qs
+
+    @cached_property
+    def filter_form(self):
+        return VoucherFilterForm(data=self.request_data, prefix='filter', event=self.request.event)
+
+
+class VoucherList(VoucherQueryMixin, PaginationMixin, EventPermissionRequiredMixin, ListView):
     model = Voucher
     context_object_name = 'vouchers'
     template_name = 'pretixcontrol/vouchers/index.html'
@@ -88,25 +122,15 @@ class VoucherList(PaginationMixin, EventPermissionRequiredMixin, ListView):
 
     @scopes_disabled()  # we have an event check here, and we can save some performance on subqueries
     def get_queryset(self):
-        qs = Voucher.annotate_budget_used(self.request.event.vouchers.exclude(
-            Exists(WaitingListEntry.objects.filter(voucher_id=OuterRef('pk')))
-        ).select_related(
+        return Voucher.annotate_budget_used(super().get_queryset().select_related(
             'item', 'variation', 'seat'
         ))
-        if self.filter_form.is_valid():
-            qs = self.filter_form.filter_qs(qs)
-
-        return qs
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data(**kwargs)
         ctx['filter_form'] = self.filter_form
         return ctx
 
-    @cached_property
-    def filter_form(self):
-        return VoucherFilterForm(data=self.request.GET, event=self.request.event)
-
     def get(self, request, *args, **kwargs):
         if request.GET.get("download", "") == "yes":
             return self._download_csv()
@@ -293,6 +317,12 @@ class VoucherUpdate(EventPermissionRequiredMixin, UpdateView):
                 f.disabled = True
         return form
 
+    def get_form_kwargs(self):
+        return {
+            **super().get_form_kwargs(),
+            "event": self.request.event,
+        }
+
     def get_object(self, queryset=None) -> VoucherForm:
         url = resolve(self.request.path_info)
         try:
@@ -338,7 +368,7 @@ class VoucherUpdate(EventPermissionRequiredMixin, UpdateView):
         }
         if self.object.subevent_id:
             url_params['subevent'] = self.object.subevent_id
-        ctx['url'] = build_absolute_uri(self.request.event, "presale:event.redeem") + "?" + urlencode(url_params)
+        ctx['url'] = eventreverse_absolute(self.request.event, "presale:event.redeem") + "?" + urlencode(url_params)
         return ctx
 
 
@@ -603,26 +633,21 @@ class VoucherRNG(EventPermissionRequiredMixin, View):
         })
 
 
-class VoucherBulkAction(EventPermissionRequiredMixin, View):
+class VoucherBulkAction(VoucherQueryMixin, EventPermissionRequiredMixin, View):
     permission = 'event.vouchers:write'
 
-    @cached_property
-    def objects(self):
-        return self.request.event.vouchers.filter(
-            id__in=self.request.POST.getlist('voucher')
-        )
-
     @transaction.atomic
     def post(self, request, *args, **kwargs):
         if request.POST.get('action') == 'delete':
             return render(request, 'pretixcontrol/vouchers/delete_bulk.html', {
-                'allowed': self.objects.filter(redeemed=0),
-                'forbidden': self.objects.exclude(redeemed=0),
+                'allowed': self.get_queryset().filter(redeemed=0),
+                'forbidden': self.get_queryset().exclude(redeemed=0),
             })
         elif request.POST.get('action') == 'delete_confirm':
             log_entries = []
             to_delete = []
-            for obj in self.objects:
+            to_update = []
+            for obj in self.get_queryset():
                 if obj.allow_delete():
                     log_entries.append(obj.log_action('pretix.voucher.deleted', user=self.request.user, save=False))
                     to_delete.append(obj.pk)
@@ -632,12 +657,14 @@ class VoucherBulkAction(EventPermissionRequiredMixin, View):
                         'bulk': True
                     }, save=False))
                     obj.max_usages = min(obj.redeemed, obj.max_usages)
-                    obj.save(update_fields=['max_usages'])
+                    to_update.append(obj)
 
             if to_delete:
                 CartPosition.objects.filter(addon_to__voucher_id__in=to_delete).delete()
                 CartPosition.objects.filter(voucher_id__in=to_delete).delete()
                 Voucher.objects.filter(pk__in=to_delete).delete()
+            if to_update:
+                Voucher.objects.bulk_update(to_update, ['max_usages'])
 
             LogEntry.bulk_create_and_postprocess(log_entries)
             messages.success(request, _('The selected vouchers have been deleted or disabled.'))
@@ -648,3 +675,117 @@ class VoucherBulkAction(EventPermissionRequiredMixin, View):
             'organizer': self.request.event.organizer.slug,
             'event': self.request.event.slug,
         })
+
+
+class VoucherBulkUpdateView(VoucherQueryMixin, EventPermissionRequiredMixin, FormView):
+    template_name = 'pretixcontrol/vouchers/bulk_edit.html'
+    permission = 'event.vouchers:write'
+    context_object_name = 'vouchers'
+    form_class = VoucherBulkEditForm
+
+    def get_queryset(self):
+        return super().get_queryset().prefetch_related(None).order_by()
+
+    def get(self, request, *args, **kwargs):
+        return HttpResponse(status=405)
+
+    @cached_property
+    def is_submitted(self):
+        # Usually, django considers a form "bound" / "submitted" on every POST request. However, this view is always
+        # called with POST method, even if just to pass the selection of objects to work on, so we want to modify
+        # that behavior
+        return '_bulk' in self.request.POST
+
+    def get_form_kwargs(self):
+        initial = {}
+        mixed_values = set()
+        qs = self.get_queryset().annotate()
+
+        fields = (
+            'valid_until', 'block_quota', 'allow_ignore_quota', 'value', 'tag', 'comment', 'max_usages',
+            'min_usages', 'price_mode', 'subevent', 'show_hidden_items', 'all_addons_included', 'all_bundles_included',
+            'budget',
+        )
+        for f in fields:
+            existing_values = list(qs.order_by(f).values(f).annotate(c=Count('*')))
+            if len(existing_values) == 1:
+                initial[f] = existing_values[0][f]
+            elif len(existing_values) > 1:
+                mixed_values.add(f)
+                if f == "max_usages":
+                    initial[f] = 1
+                else:
+                    initial[f] = None
+
+        existing_values = list(qs.order_by("item", "variation", "quota").values("item", "variation", "quota").annotate(c=Count('*')))
+        if len(existing_values) == 1:
+            i = existing_values[0]
+            if i["quota"]:
+                initial["itemvar"] = f'q-{i["quota"]}'
+            elif i["variation"]:
+                initial["itemvar"] = f'{i["item"]}-{i["variation"]}'
+            elif i["item"]:
+                initial["itemvar"] = f'{i["item"]}'
+            else:
+                initial["itemvar"] = None
+        elif len(existing_values) > 1:
+            mixed_values.add("itemvar")
+            initial["itemvar"] = None
+
+        kwargs = super().get_form_kwargs()
+        kwargs['event'] = self.request.event
+        kwargs['prefix'] = 'bulkedit'
+        kwargs['initial'] = initial
+        kwargs['queryset'] = self.get_queryset()
+        kwargs['mixed_values'] = mixed_values
+        if not self.is_submitted:
+            kwargs['data'] = None
+            kwargs['files'] = None
+        return kwargs
+
+    def get_success_url(self):
+        return reverse('control:event.vouchers', kwargs={
+            'organizer': self.request.event.organizer.slug,
+            'event': self.request.event.slug,
+        })
+
+    def form_valid(self, form):
+        log_entries = []
+
+        # Main form
+        form.save()
+        data = {
+            k: v
+            for k, v in form.cleaned_data.items()
+            if k in form.changed_data
+        }
+        data['_raw_bulk_data'] = self.request.POST.dict()
+        for obj in self.get_queryset():
+            log_entries.append(
+                obj.log_action('pretix.voucher.changed', data=data, user=self.request.user, save=False)
+            )
+
+        LogEntry.bulk_create_and_postprocess(log_entries)
+
+        messages.success(self.request, _('Your changes have been saved.'))
+        return super().form_valid(form)
+
+    def get_context_data(self, **kwargs):
+        ctx = super().get_context_data(**kwargs)
+        ctx['vouchers'] = self.get_queryset()
+        ctx['bulk_selected'] = self.request.POST.getlist("_bulk")
+        return ctx
+
+    @transaction.atomic
+    def post(self, request, *args, **kwargs):
+        form = self.get_form()
+        is_valid = (
+            self.is_submitted and
+            form.is_valid()
+        )
+        if is_valid:
+            return self.form_valid(form)
+        else:
+            if self.is_submitted:
+                messages.error(self.request, _('We could not save your changes. See below for details.'))
+            return self.form_invalid(form)