Merge branch 'pretix:master' into vite-vue3

src/pretix/static/npm_dir/package.json

@@ -5,7 +5,7 @@
   "scripts": {},
   "dependencies": {
     "@babel/core": "^7.28.5",
-    "@babel/preset-env": "^7.28.5",
+    "@babel/preset-env": "^7.29.0",
     "@rollup/plugin-babel": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.3",
     "vue": "^2.7.16",

src/pretix/static/pretixcontrol/js/ui/outgoingmail.js

@@ -0,0 +1,43 @@
+function is_sandbox_supported() {
+    const iframe = document.createElement('iframe');
+    return 'sandbox' in iframe;
+}
+
+function safe_render(url, parent) {
+    // Estimate the height that prevents the user from having to scroll on two levels to see the full email
+    const height = (
+        Math.max(400, window.innerHeight - parent.parent().get(0).getBoundingClientRect().top - document.querySelector("footer").getBoundingClientRect().height - 20)
+    ) + "px";
+
+    const iframe = (
+        // Per the HTML spec, a data: URL in an iframe is treated as its own origin:
+        // https://github.com/whatwg/html/pull/1756
+        // It is unclear, if Firefox complies, and the behaviour around data URLs is quite wild:
+        // https://github.com/whatwg/html/issues/12091
+        // Together with the sandbox attribute disallowing all JavaScript, and the fact
+        // that we sanitize the HTML before we even save it to the database, this should
+        // still be the safest way to render HTML in the context of our backend.
+        $("<iframe>")
+            .height(height)
+            .attr("class", "html-email")
+            .attr("src", url)
+            .attr("sandbox", "allow-popups allow-popups-to-escape-sandbox")
+            .attr("csp", "script-src 'none'; font-src 'none'; connect-src 'none'; form-action 'none'; style-src 'unsafe-inline'")  // respected only by chrome
+            .prop("credentialless", true)  // respected only by chrome
+    );
+
+    console.log(parent, iframe);
+    parent.append(iframe);
+}
+
+$(function () {
+    const script_element = $("#mail_body_html");
+    if (!script_element.length) return;
+    if (!is_sandbox_supported()) {
+        // Browser is too old for <iframe sandbox>
+        $(script_element.parent()).text("Please switch to a modern browser to view HTML content safely.");
+        return;
+    }
+
+    safe_render(JSON.parse(script_element.html()), script_element.parent());
+});

src/pretix/static/pretixcontrol/scss/_mail_preview.scss

@@ -91,3 +91,8 @@ div.mail-preview {
     text-align: right;
   }
 }
+
+iframe.html-email {
+  border: 0;
+  width: 100%;
+}

src/pretix/static/pretixpresale/js/widget/widget.js

@@ -252,7 +252,7 @@ Vue.component('availbox', {
         variation: Object
     },
     mounted: function() {
-        if (this.$root.itemnum === 1 && (!this.$root.categories[0].items[0].has_variations || this.$root.categories[0].items[0].variations.length < 2) && !this.$root.has_seating_plan ? 1 : 0) {
+        if (!this.$root.cart_exists && this.$root.itemnum === 1 && (!this.$root.categories[0].items[0].has_variations || this.$root.categories[0].items[0].variations.length < 2) && !this.$root.has_seating_plan ? 1 : 0) {
             this.$refs.quantity.value = 1;    
             if (this.order_max === 1) {
                 this.$refs.quantity.checked = true;

src/pretix/static/pretixpresale/scss/_event.scss

@@ -99,6 +99,15 @@
     }
 }
 
+.product-appendix-row {
+    border-top: 1px solid $table-border-color;
+    border-bottom: 1px solid $table-border-color;
+    padding: 1.25*$line-height-computed 0;
+    & > :last-child {
+        margin-bottom: 0;
+    }
+}
+
 article.item-with-variations {
     margin: 0 -15px;
     padding: 0 15px;