CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity
14,548 Commits 313 Branches 205 Tags
6eebaaa56355d5e7afcd58dd2024096fa3d1f0f8
Commit Graph
13330 Commits
Author SHA1 Message Date
Raphael MichelandMira Weller 6eebaaa563 [SECURITY] Hardening for user impersonation feature (CVE-2026-13602) 
---------

Co-authored-by: Mira Weller <weller@pretix.eu>
 2026-07-01 15:15:43 +02:00
Raphael MichelandMira Weller c9781f012b [SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602) 
- Add central framebreaker page via safelink helper
- Update paypal, paypal2 and stripe plugins to use central framebreaker
- Add CSP header to cookies.html

---------

Co-authored-by: Mira Weller <weller@pretix.eu>
 2026-07-01 15:15:43 +02:00
Mira WellerRaphael MichelRaphael Michel
 		000bf54105 [SECURITY] Allowlisting and changed salts for safelink and safelink_callback (CVE-2026-13602) 
---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
 2026-07-01 15:15:43 +02:00
Lukas BockstallerandGitHub e42d3d632f filter out the 404 log records from django.request (#6324) 2026-07-01 11:33:04 +02:00
Lukas BockstallerandGitHub 3bf5a5e478 include settings attribute during type checking (#6323) 
* include settings attribute during type checking

* isort
 2026-07-01 11:32:54 +02:00
Raphael Michel a6f31df0d4 Do not assign domain across organizers when copying events 2026-06-30 18:51:49 +02:00
Raphael MichelandGitHub d40492748a Event product list: Hotfix for pathological performance in large event series (#6318) 
* Event product list: Hotfix for pathological performance

* Stop outputting bullsht numbers to widget
 2026-06-29 19:02:06 +02:00
Richard SchreiberandGitHub f4ca230af7 Improve voucher import unique code checks (#6311) 
* Check for duplicate codes in import

* Check for existing codes instead of failing on db-level

* as we do not lock, catch IntegrityErrors due to race-conditions on import

* fix flake8
 2026-06-29 14:37:41 +02:00
Richard SchreiberandGitHub 4fb1748bf6 Fix handling country=None in attendee profiles (#6309) 
* Fix handling country=None in AttendeeProfile describe

* Update checkoutflow.py

* fix more occurences

* handle country=None in InvoiceAddress even if it is not allowed
 2026-06-29 14:32:01 +02:00
Raphael Michel 9d668af102 Discover translatable strings in .ts files (Z#23238475) 2026-06-28 17:51:40 +02:00
Raphael MichelandRaphael Michel 80fd4a3b2a Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael MichelandRaphael Michel 65bb2283d4 Translations: Update German 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael MichelandRaphael Michel 00751e8911 Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael MichelandRaphael Michel 957a066475 Translations: Update German 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael Michel 7e077bdd7e Subevent detail: Fix incorrect ticket count (Z#23238481) 2026-06-28 17:43:22 +02:00
Raphael Michel e80d84ec3c Update po files 
[CI skip]

Signed-off-by: Raphael Michel <michel@rami.io>
 2026-06-28 16:44:09 +02:00
Kim LozanoandRaphael Michel dc3b742d8c Translations: Update Catalan 
Currently translated at 29.7% (1875 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ca/

powered by weblate
 2026-06-28 16:42:32 +02:00
Raphael MichelGitHubpajowu
 		1f5fe1b237 SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468) (#6260) 
* SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468)

* SMTP SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (#6264)

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
 2026-06-26 16:45:20 +02:00
Raphael Michel a8997f8971 [SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Raphael MichelandRaphael Michel eb068f524c [SECURITY] Prevent reading of any local files in reportlab (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Raphael MichelandRaphael Michel f615595547 [SECURITY] Disable outbound and file access for reportlab (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel 8bd78eefcf [SECURITY] Fix reflected XSS in redirection page (CVE-2026-57533) 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel 848f7fa0e5 [SECURITY] Fix stored XSS in ticket confirmation page (CVE-2026-13225) 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel 3442a543c8 [SECURITY] Hardening: Don't use |safe on confirm_messages 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel f88c24863d [SECURITY] Fix XSS in ticket layout JSON (CVE-2026-57532) 2026-06-25 16:46:13 +02:00
Richard SchreiberandGitHub e8492cad3c Seating: fix handling optional position attribute (#6303) 2026-06-24 09:47:08 +02:00
Richard SchreiberandGitHub 7ea5a2b59e PDF: add placeholder invoice_custom_field (#6298) 2026-06-24 09:46:43 +02:00
luelistaandGitHub 4c373518d0 Fix event meta property handling when cloning across organizers (Z#23231419) (#6306) 2026-06-23 19:01:32 +02:00
luelistaandGitHub 1521c0cfcd Fix URL matching in EventQRCode (Z#23237781) (#6304) 2026-06-23 18:34:31 +02:00
Raphael MichelGitHubpajowu
 		d14dc4c5ff Test order deletion: Improve bulk performance (Z#23237160) (#6274) 
* Test order deletion: Improve bulk performance (Z#23237160)

* Apply suggestion from @pajowu

Co-authored-by: pajowu <engelhardt@pretix.eu>

* Fix style issue

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
 2026-06-22 09:49:27 +02:00
Raphael MichelandGitHub 5db1a5b8af Rename confusingly named helpers for URL generation (#6280) 
* Rename confusingly named helpers for URL generation

* new name

* fix old call

* Revert "new name"

This reverts commit a6e9a488b62b9bc7c2800c402e432765a838cbc6.

* New name
 2026-06-22 09:11:55 +02:00
Nikita MitasovandRaphael Michel 86a51afe9e Translations: Update Russian 
Currently translated at 19.0% (1199 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ru/

powered by weblate
 2026-06-22 09:11:47 +02:00
NikolaiandRaphael Michel ea9c85a1b4 Translations: Update Danish 
Currently translated at 62.5% (3945 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/da/

powered by weblate
 2026-06-22 09:11:47 +02:00
Nikita MitasovandRaphael Michel 226ff9b044 Translations: Update Russian 
Currently translated at 18.7% (1183 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ru/

powered by weblate
 2026-06-22 09:11:47 +02:00
Szurofka MártonandRaphael Michel d8991d8138 Translations: Update Hungarian 
Currently translated at 64.6% (119 of 184 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/hu/

powered by weblate
 2026-06-22 09:11:47 +02:00
Nikita MitasovandRaphael Michel 83642ec9f3 Translations: Update Russian 
Currently translated at 18.6% (1174 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ru/

powered by weblate
 2026-06-22 09:11:47 +02:00
luelistaandGitHub d0307b9936 Use OrderPosition.all instead of .objects in metrics (#6285) 2026-06-21 12:46:07 +02:00
Martin Gross c083ce904a Checkin API: Provide 'reason' for RequiredMediaExchangeError (PRETIXEU-DHW) 2026-06-19 12:41:32 +02:00
Lukas BockstallerGitHubpajowupajowuRichard Schreiber
 		694b915d89 include errors.js by default and make it coop with async_task_replace_page (Z#23236752) (#6284) 
* load errors.js as standard and make it coop with async_task_replace_page

* scope down event

* Update src/pretix/static/pretixbase/js/asynctask.js

Co-authored-by: pajowu <engelhardt@pretix.eu>

* drop the jquery dependency for error.js

Co-authored-by: pajowu <pajowu@pajowu.de>

* include errors.js in error.html

* include errors.js in control base.html

* Update src/pretix/static/pretixbase/js/asynctask.js

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* put errors.js in an IIFE call

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
Co-authored-by: pajowu <pajowu@pajowu.de>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
 2026-06-16 15:18:19 +02:00
Raphael MichelandGitHub ea928ea7d4 Widget: Fix handling of HTTP-429 errors 2026-06-16 09:11:33 +02:00
Richard SchreiberandGitHub 36d49fbd77 Question detail: Fix crash in filter 2026-06-15 08:00:55 +02:00
Raphael Michelandpajowu f0cb451c34 LocaleMiddleware: Correctly reset region for backend views 2026-06-12 15:30:06 +02:00
Raphael MichelGitHubKara Engelhardt
 		2c7fcd0599 Accounting report: Correctly split subevents with same label (Z#23237301) (#6275) 
* Accounting report: Correctly split subevents with same label (Z#23237301)

* Accountingreport: Fix crash for single events

---------

Co-authored-by: Kara Engelhardt <engelhardt@pretix.eu>
 2026-06-12 14:36:10 +02:00
MiraandRaphael Michel de28425993 Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6302 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-06-11 18:59:48 +02:00
MiraandRaphael Michel f3eb0d2dba Translations: Update German 
Currently translated at 100.0% (6302 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-06-11 18:59:48 +02:00
Sébastien BRUNEAUandRaphael Michel 0630e05d50 Translations: Update French 
Currently translated at 100.0% (6302 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/fr/

powered by weblate
 2026-06-11 18:59:48 +02:00
luelistaandGitHub c4b9cc4143 Allow search by partial giftcard secret with organizer.giftcards:read (#6263) 2026-06-11 16:26:05 +02:00
Raphael MichelGitHubpajowu
 		8c132d8342 Teams: Add a note to the degree of isolation between permissions (#6258) 
* Teams: Add a note to the degree of isolation between permissions

* Update src/pretix/control/templates/pretixcontrol/organizers/team_edit.html

Co-authored-by: pajowu <engelhardt@pretix.eu>

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
 2026-06-11 16:25:58 +02:00
pajowuandGitHub 8e63fafc62 Devex: Fix vite devserver capturing stdin (#6267) 
Pass DEVNULL as stdin to vite, otherwise the vite devserver captures parts of stdin, making things like pasting during debugging impossible
 2026-06-11 16:25:48 +02:00
luelistaandGitHub 63ebe16fd3 Fix count in order bulk delete success message (#6270) 2026-06-11 16:25:38 +02:00