CGM_Public/pretix_cgo
3
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Bank transfer: Fix incorrect HTML escaping in QR Code (fix #4780) (#6201)

Browse Source 
* Fix EPC QR beneficiary escaping

* Fix EPC QR script encoding

Keep EPC QR helper output as a plain string and serialize payment QR payloads as JSON script data before the QR replacement JavaScript parses them. This preserves apostrophes without relying on mark_safe in the helper.

Assisted-by: OpenAI GPT-5 <noreply@openai.com>

* "type safety"

---------

Co-authored-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com>
Co-authored-by: Raphael Michel <michel@rami.io>
This commit is contained in:
Puneet Dixit
2026-07-06 12:52:29 +02:00
committed by GitHub
co-authored by Puneet Dixit Raphael Michel
parent 3b285a89dd
commit 3270c4e583
5 changed files with 53 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/static/pretixcontrol/js/ui/main.js
+3 -1
View File
@@ -666,10 +666,12 @@ var form_handlers = function (el) {
el.find("script[data-replace-with-qr]").each(function () {
var $div = $("<div>");
var qrText = this.getAttribute("type") === "application/json" && this.textContent.startsWith('"') ?
JSON.parse(this.textContent) : $(this).html();
$div.insertBefore($(this));
$div.qrcode(
{
text: $(this).html(),
text: qrText,
correctLevel: 0, // M
width: $(this).attr("data-size") ? parseInt($(this).attr("data-size")) : 256,
height: $(this).attr("data-size") ? parseInt($(this).attr("data-size")) : 256,
src/pretix/static/pretixpresale/js/ui/main.js
+6 -4
View File
@@ -131,10 +131,12 @@ var form_handlers = function (el) {
el.find("script[data-replace-with-qr]").each(function () {
var $div = $("<div>");
var qrText = this.getAttribute("type") === "application/json" && this.textContent.startsWith('"') ?
JSON.parse(this.textContent) : $(this).html();
$div.insertBefore($(this));
$div.qrcode(
{
text: $(this).html(),
text: qrText,
correctLevel: 0, // M
width: $(this).attr("data-size") ? parseInt($(this).attr("data-size")) : 256,
height: $(this).attr("data-size") ? parseInt($(this).attr("data-size")) : 256,
@@ -345,7 +347,7 @@ function setup_basics(el) {
}).on('click', function (event) {
setCurrentTab(this);
});
var firstTab = tabs.first().get(0);
var lastTab = tabs.last().get(0);
setCurrentTab(tabs.filter('[aria-selected=true]').get(0));
@@ -658,7 +660,7 @@ $(function () {
var currentTimeDisplayParts = [];
timeFormatParts.forEach(function(format) {
currentTimeDisplayParts.push([format, $("<span></span>").appendTo(currentTimeDisplay)])
});
});
var duration = this.getAttribute("data-duration").split(":").reduce(function(previousValue, currentValue, currentIndex) {
return previousValue + (currentIndex ? parseInt(currentValue, 10) * 60 : parseInt(currentValue, 10) * 60 * 60);
}, 0);
@@ -671,7 +673,7 @@ $(function () {
currentTimeBar.remove();
return;
}
var offset = thisCalendar.querySelector("h3").getBoundingClientRect().width;
var dx = Math.round(offset + (thisCalendar.scrollWidth-offset)*(currentTimeDelta/duration));
currentTimeDisplayParts.forEach(function(part) {