CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity
14,573 Commits 313 Branches 205 Tags
28b13667ced38fc764e2be41d52d01140cd24802
Commit Graph
13351 Commits
Author SHA1 Message Date
Richard SchreiberandGitHub 28b13667ce Widget: add beta-flag to URL (#6338) 2026-07-03 12:04:54 +02:00
Raphael Michel 120317a8f2 Fix linter issue 2026-07-03 11:00:48 +02:00
Raphael Michel 7d5b00a610 Fix linter issues 2026-07-03 10:54:44 +02:00
Mira WellerandRaphael Michel 7a5f96369a Harden StaffSession handling 2026-07-03 10:41:39 +02:00
Mira WellerandRaphael Michel 458c3d4b83 CSP refactor 2026-07-03 10:33:35 +02:00
Raphael Michel d10d061e45 Merge branch 'check-csp' into 'master' 
Check CSP components before rendering, prevent format string traversal

See merge request pretix/pretix!33
 2026-07-03 10:26:23 +02:00
Mira WellerandRaphael Michel d30bca50f7 Check CSP components before rendering, prevent format string traversal 2026-07-03 10:26:23 +02:00
Phin WolkwitzandGitHub 3903aca7c9 Add Thai translations to community languages (Z#23239401) (#6334) 2026-07-02 17:44:28 +02:00
Raphael MichelandGitHub 493c920aba Install django-querytagger (#6332) 
* Install django-querytagger

* Update pyproject.toml
 2026-07-02 14:40:02 +02:00
Raphael MichelandGitHub 09b7bc00b0 Organizer calendar: Respect event_calendar_future_only (Z#23238776) (#6326) 
We initially didn't do this for two reasons:

- Performance implications of calling the settings store for every event
  that shows up in the calendar. As of d43e85da, we need that anyways.
- Performance implications of filtering in Python except SQL but... it
  can't really be worse than not filtering at all.
- We don't easily know if it's valid for all events so we can't stop
  rendering the unused calendar rows. That's an acceptable issue for
  now, still better than nothing. We can always optimize later.

So we might as well implement it.
 2026-07-02 14:31:44 +02:00
Raphael MichelandGitHub 18cb9c1816 Drop line numbers from gettext .po files (#6330) 
Knowing what file a string comes from is useful, but the line number is less
useful and changes a lot, causing very unreadable diffs of translation
files. I propose we drop them and only include the file names
 2026-07-02 10:21:09 +02:00
Richard SchreiberandGitHub c3e0120f9f Improve calendar explorability for VoiceOver on iOS 2026-07-02 08:13:09 +02:00
Raphael Michel 67f7fec134 Fix flake8 issue 2026-07-01 18:01:50 +02:00
Raphael Michel c2c97f31ca Bump version to 2026.7.0.dev0 2026-07-01 16:33:10 +02:00
Raphael Michel fd565ecdb2 Bump version to 2026.6.0 2026-07-01 16:33:07 +02:00
Nikita MitasovandRaphael Michel f35b13b686 Translations: Update Russian 
Currently translated at 18.9% (1200 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ru/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-esandRaphael Michel 550bb675f5 Translations: Update Spanish 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/es/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-esandRaphael Michel adc9c9d514 Translations: Update Spanish 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/es/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-esandRaphael Michel 8441c4bc7a Translations: Update French 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/fr/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-esandRaphael Michel 97ff252c09 Translations: Update French 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/fr/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-esandRaphael Michel d3ca2ac1e5 Translations: Update German 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-07-01 16:32:06 +02:00
Raphael MichelandMira Weller 6eebaaa563 [SECURITY] Hardening for user impersonation feature (CVE-2026-13602) 
---------

Co-authored-by: Mira Weller <weller@pretix.eu>
 2026-07-01 15:15:43 +02:00
Raphael MichelandMira Weller c9781f012b [SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602) 
- Add central framebreaker page via safelink helper
- Update paypal, paypal2 and stripe plugins to use central framebreaker
- Add CSP header to cookies.html

---------

Co-authored-by: Mira Weller <weller@pretix.eu>
 2026-07-01 15:15:43 +02:00
Mira WellerRaphael MichelRaphael Michel
 		000bf54105 [SECURITY] Allowlisting and changed salts for safelink and safelink_callback (CVE-2026-13602) 
---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
 2026-07-01 15:15:43 +02:00
Lukas BockstallerandGitHub e42d3d632f filter out the 404 log records from django.request (#6324) 2026-07-01 11:33:04 +02:00
Lukas BockstallerandGitHub 3bf5a5e478 include settings attribute during type checking (#6323) 
* include settings attribute during type checking

* isort
 2026-07-01 11:32:54 +02:00
Raphael Michel a6f31df0d4 Do not assign domain across organizers when copying events 2026-06-30 18:51:49 +02:00
Raphael MichelandGitHub d40492748a Event product list: Hotfix for pathological performance in large event series (#6318) 
* Event product list: Hotfix for pathological performance

* Stop outputting bullsht numbers to widget
 2026-06-29 19:02:06 +02:00
Richard SchreiberandGitHub f4ca230af7 Improve voucher import unique code checks (#6311) 
* Check for duplicate codes in import

* Check for existing codes instead of failing on db-level

* as we do not lock, catch IntegrityErrors due to race-conditions on import

* fix flake8
 2026-06-29 14:37:41 +02:00
Richard SchreiberandGitHub 4fb1748bf6 Fix handling country=None in attendee profiles (#6309) 
* Fix handling country=None in AttendeeProfile describe

* Update checkoutflow.py

* fix more occurences

* handle country=None in InvoiceAddress even if it is not allowed
 2026-06-29 14:32:01 +02:00
Raphael Michel 9d668af102 Discover translatable strings in .ts files (Z#23238475) 2026-06-28 17:51:40 +02:00
Raphael MichelandRaphael Michel 80fd4a3b2a Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael MichelandRaphael Michel 65bb2283d4 Translations: Update German 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael MichelandRaphael Michel 00751e8911 Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael MichelandRaphael Michel 957a066475 Translations: Update German 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael Michel 7e077bdd7e Subevent detail: Fix incorrect ticket count (Z#23238481) 2026-06-28 17:43:22 +02:00
Raphael Michel e80d84ec3c Update po files 
[CI skip]

Signed-off-by: Raphael Michel <michel@rami.io>
 2026-06-28 16:44:09 +02:00
Kim LozanoandRaphael Michel dc3b742d8c Translations: Update Catalan 
Currently translated at 29.7% (1875 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ca/

powered by weblate
 2026-06-28 16:42:32 +02:00
Raphael MichelGitHubpajowu
 		1f5fe1b237 SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468) (#6260) 
* SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468)

* SMTP SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (#6264)

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
 2026-06-26 16:45:20 +02:00
Raphael Michel a8997f8971 [SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Raphael MichelandRaphael Michel eb068f524c [SECURITY] Prevent reading of any local files in reportlab (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Raphael MichelandRaphael Michel f615595547 [SECURITY] Disable outbound and file access for reportlab (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel 8bd78eefcf [SECURITY] Fix reflected XSS in redirection page (CVE-2026-57533) 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel 848f7fa0e5 [SECURITY] Fix stored XSS in ticket confirmation page (CVE-2026-13225) 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel 3442a543c8 [SECURITY] Hardening: Don't use |safe on confirm_messages 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel f88c24863d [SECURITY] Fix XSS in ticket layout JSON (CVE-2026-57532) 2026-06-25 16:46:13 +02:00
Richard SchreiberandGitHub e8492cad3c Seating: fix handling optional position attribute (#6303) 2026-06-24 09:47:08 +02:00
Richard SchreiberandGitHub 7ea5a2b59e PDF: add placeholder invoice_custom_field (#6298) 2026-06-24 09:46:43 +02:00
luelistaandGitHub 4c373518d0 Fix event meta property handling when cloning across organizers (Z#23231419) (#6306) 2026-06-23 19:01:32 +02:00
luelistaandGitHub 1521c0cfcd Fix URL matching in EventQRCode (Z#23237781) (#6304) 2026-06-23 18:34:31 +02:00