Commit Graph
13325 Commits
Author SHA1 Message Date
Mira Weller 9eb2a822a7 rebase migrations 2026-06-26 22:13:11 +02:00
Mira Weller 7352eb5563 Log as warnings 2026-06-26 15:12:07 +02:00
Mira Weller f797ead5c4 If duplicated EventMetaProperties can not be merged, make sure the "_DUPLICATE_" ones are not publicly visible 2026-06-26 15:10:45 +02:00
Mira Weller 96327f0f38 Remove comment 2026-06-26 15:09:04 +02:00
Mira Weller 8bdf5e7c07 If no matching EventMetaProperty exists in the correct organizer, the newly created one should never be publicly visible. 2026-06-26 15:08:57 +02:00
Mira Weller 4986d1673d Logging 2026-06-26 15:08:50 +02:00
Mira Weller 18b8372681 Revert "Reduced version without schema change and DB migration"
This reverts commit 2851a54c55e807b7217057551ad45ec3a2fabe28.
2026-06-26 10:29:08 +02:00
Mira Weller 6df5895d52 Reduced version without schema change and DB migration 2026-06-26 10:29:08 +02:00
luelistaandRaphael Michel 3195476b1f Apply suggestions from code review
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
2026-06-26 10:29:08 +02:00
Mira Weller 3110259f8a Old Python compat 2026-06-26 10:29:08 +02:00
Mira Weller 604ea5384a handle new duplicates in EventMetaValue.{event,property} 2026-06-26 10:29:08 +02:00
Mira Weller 7d37b21b5a add migrations with fixups 2026-06-26 10:29:08 +02:00
Mira Weller 232ee9285d add unique_together on EventMetaProperty (organizer, name) 2026-06-26 10:29:08 +02:00
Raphael Michel a8997f8971 [SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Raphael MichelandRaphael Michel eb068f524c [SECURITY] Prevent reading of any local files in reportlab (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Raphael MichelandRaphael Michel f615595547 [SECURITY] Disable outbound and file access for reportlab (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel 8bd78eefcf [SECURITY] Fix reflected XSS in redirection page (CVE-2026-57533) 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel 848f7fa0e5 [SECURITY] Fix stored XSS in ticket confirmation page (CVE-2026-13225) 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel 3442a543c8 [SECURITY] Hardening: Don't use |safe on confirm_messages 2026-06-25 16:46:13 +02:00
Mira WellerandRaphael Michel f88c24863d [SECURITY] Fix XSS in ticket layout JSON (CVE-2026-57532) 2026-06-25 16:46:13 +02:00
Richard SchreiberandGitHub e8492cad3c Seating: fix handling optional position attribute (#6303) 2026-06-24 09:47:08 +02:00
Richard SchreiberandGitHub 7ea5a2b59e PDF: add placeholder invoice_custom_field (#6298) 2026-06-24 09:46:43 +02:00
luelistaandGitHub 4c373518d0 Fix event meta property handling when cloning across organizers (Z#23231419) (#6306) 2026-06-23 19:01:32 +02:00
luelistaandGitHub 1521c0cfcd Fix URL matching in EventQRCode (Z#23237781) (#6304) 2026-06-23 18:34:31 +02:00
d14dc4c5ff Test order deletion: Improve bulk performance (Z#23237160) (#6274)
* Test order deletion: Improve bulk performance (Z#23237160)

* Apply suggestion from @pajowu

Co-authored-by: pajowu <engelhardt@pretix.eu>

* Fix style issue

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
2026-06-22 09:49:27 +02:00
Raphael MichelandGitHub 5db1a5b8af Rename confusingly named helpers for URL generation (#6280)
* Rename confusingly named helpers for URL generation

* new name

* fix old call

* Revert "new name"

This reverts commit a6e9a488b62b9bc7c2800c402e432765a838cbc6.

* New name
2026-06-22 09:11:55 +02:00
Nikita MitasovandRaphael Michel 86a51afe9e Translations: Update Russian
Currently translated at 19.0% (1199 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ru/

powered by weblate
2026-06-22 09:11:47 +02:00
NikolaiandRaphael Michel ea9c85a1b4 Translations: Update Danish
Currently translated at 62.5% (3945 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/da/

powered by weblate
2026-06-22 09:11:47 +02:00
Nikita MitasovandRaphael Michel 226ff9b044 Translations: Update Russian
Currently translated at 18.7% (1183 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ru/

powered by weblate
2026-06-22 09:11:47 +02:00
Szurofka MártonandRaphael Michel d8991d8138 Translations: Update Hungarian
Currently translated at 64.6% (119 of 184 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/hu/

powered by weblate
2026-06-22 09:11:47 +02:00
Nikita MitasovandRaphael Michel 83642ec9f3 Translations: Update Russian
Currently translated at 18.6% (1174 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ru/

powered by weblate
2026-06-22 09:11:47 +02:00
luelistaandGitHub d0307b9936 Use OrderPosition.all instead of .objects in metrics (#6285) 2026-06-21 12:46:07 +02:00
Martin Gross c083ce904a Checkin API: Provide 'reason' for RequiredMediaExchangeError (PRETIXEU-DHW) 2026-06-19 12:41:32 +02:00
694b915d89 include errors.js by default and make it coop with async_task_replace_page (Z#23236752) (#6284)
* load errors.js as standard and make it coop with async_task_replace_page

* scope down event

* Update src/pretix/static/pretixbase/js/asynctask.js

Co-authored-by: pajowu <engelhardt@pretix.eu>

* drop the jquery dependency for error.js

Co-authored-by: pajowu <pajowu@pajowu.de>

* include errors.js in error.html

* include errors.js in control base.html

* Update src/pretix/static/pretixbase/js/asynctask.js

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* put errors.js in an IIFE call

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
Co-authored-by: pajowu <pajowu@pajowu.de>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-06-16 15:18:19 +02:00
Raphael MichelandGitHub ea928ea7d4 Widget: Fix handling of HTTP-429 errors 2026-06-16 09:11:33 +02:00
Richard SchreiberandGitHub 36d49fbd77 Question detail: Fix crash in filter 2026-06-15 08:00:55 +02:00
Raphael Michelandpajowu f0cb451c34 LocaleMiddleware: Correctly reset region for backend views 2026-06-12 15:30:06 +02:00
2c7fcd0599 Accounting report: Correctly split subevents with same label (Z#23237301) (#6275)
* Accounting report: Correctly split subevents with same label (Z#23237301)

* Accountingreport: Fix crash for single events

---------

Co-authored-by: Kara Engelhardt <engelhardt@pretix.eu>
2026-06-12 14:36:10 +02:00
MiraandRaphael Michel de28425993 Translations: Update German (informal) (de_Informal)
Currently translated at 100.0% (6302 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
2026-06-11 18:59:48 +02:00
MiraandRaphael Michel f3eb0d2dba Translations: Update German
Currently translated at 100.0% (6302 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
2026-06-11 18:59:48 +02:00
Sébastien BRUNEAUandRaphael Michel 0630e05d50 Translations: Update French
Currently translated at 100.0% (6302 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/fr/

powered by weblate
2026-06-11 18:59:48 +02:00
luelistaandGitHub c4b9cc4143 Allow search by partial giftcard secret with organizer.giftcards:read (#6263) 2026-06-11 16:26:05 +02:00
8c132d8342 Teams: Add a note to the degree of isolation between permissions (#6258)
* Teams: Add a note to the degree of isolation between permissions

* Update src/pretix/control/templates/pretixcontrol/organizers/team_edit.html

Co-authored-by: pajowu <engelhardt@pretix.eu>

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
2026-06-11 16:25:58 +02:00
pajowuandGitHub 8e63fafc62 Devex: Fix vite devserver capturing stdin (#6267)
Pass DEVNULL as stdin to vite, otherwise the vite devserver captures parts of stdin, making things like pasting during debugging impossible
2026-06-11 16:25:48 +02:00
luelistaandGitHub 63ebe16fd3 Fix count in order bulk delete success message (#6270) 2026-06-11 16:25:38 +02:00
775fdd1ccb Check-in API: Add reusable media exchange (#6115)
* Add Reusable Media Exchange to Checkin API

* isort

* Remove debugging leftover

* Apply suggestions from code review

Co-authored-by: robbi5 <maxi@richt.name>

* Add media_exchange_supported to CheckinRPCRedeemInputSerializer

* SecurityProfiles: Add api-v1:reusablemedia-lookup and -detail for SCAN

* Simplify media exchange checks

* Apply suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Wording: re-usable --> reusable

* Deny checkins if media-exchange is required but device does not support it.

* Remove media_exchange_supported-Flag: Checkin will always be denied if media needs to be exchanged; apps will fall back to explanation text

* CheckinRPC: Also perform media exchange

* Use media_policy from item, not as a checkinrpc parameter

* my own review notes

* Fixes, cleanup, rebase

* block expired media

* Fix query

* add logging

* Refactor link_action into media policy, gift card support

* Block illegal policy-type combination

* Drop add_to_reusable_medium, decide all by policy

* Fix test failure

* fix test on postgres

* Expose reusable_media_usage_enforced to devies

* Explicitly set update view

---------

Co-authored-by: robbi5 <maxi@richt.name>
Co-authored-by: Maximilian Richt <richt@pretix.eu>
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
Co-authored-by: Raphael Michel <michel@rami.io>
Co-authored-by: Raphael Michel <michel@pretix.eu>
2026-06-11 16:25:13 +02:00
luelistaandGitHub 784577d86f Fix markup of error template (#6265) 2026-06-10 14:16:46 +02:00
Richard SchreiberandGitHub 07d27e66d1 Use HTTP-REFERER as fallback for vite_origins (#6246) 2026-06-09 13:24:46 +02:00
Richard SchreiberandGitHub b404316dfd [SECURITY] Reusable media export: Respect giftcard permissions (CVE-2026-11764) (#6261) 2026-06-09 13:20:48 +02:00
luelistaandGitHub edf97a13cd Don't show warning if inactive products are used in checkin-rules (Z#23236197) (#6242) 2026-06-09 12:48:03 +02:00