Commit Graph

52 Commits

Author SHA1 Message Date
George Hickman
dfaa4c3359 Add session_login function (#5955)
* Add session_login function

* Make helper do more things and use it

---------

Co-authored-by: Raphael Michel <michel@rami.io>
2026-03-16 17:39:04 +01:00
Raphael Michel
1463ee9227 Fix token message translation 2026-02-22 17:26:19 +01:00
luelista
7e45837295 Security hardening for 2FA configuration (#5685)
* reduce default RecentAuthenticationRequiredMixin timeout to 15 min
* never cache pages with RecentAuthenticationRequiredMixin
* show emergency codes only once after generating
2026-02-19 12:43:23 +01:00
luelista
1cb2d443f9 Validation of user email addresses (#5434)
* Validation of user email addresses
* Improve email and password change forms
2025-11-07 11:17:34 +01:00
Raphael Michel
177a7d07fc Update license header (#5540) 2025-10-10 15:32:46 +02:00
Richard Schreiber
15d15f978f Fix logging when changing user notifications (#5470) 2025-09-24 09:58:23 +02:00
Raphael Michel
5d56cd3917 Fix missing atomicity for handling forms and logs (might be the reason for Z#23178997) (#4755) 2025-02-05 16:56:38 +01:00
Raphael Michel
4ea4189e6d Allow team admins to require two-factor authentication (#4034)
* Allow team admins to require two-factor authentication

* Add API tests

* Improve logic

* ADd button tooltip
2024-04-02 17:15:16 +02:00
Raphael Michel
57738f19bf Update webauthn requirement from ==0.4.* to ==2.0.* (#3880)
* Get rid of unmaintained dependency python-u2flib-server

* Update webauthn requirement from ==0.4.* to ==2.0.*

* Fix tests

* Update src/pretix/control/views/auth.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/views/auth.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/views/user.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/views/user.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/views/user.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2024-02-14 13:27:24 +01:00
Raphael Michel
7b58ddbfde Don't use Django's redirect() for user-supplied paths 2022-11-17 11:46:03 +01:00
Richard Schreiber
551bd3e284 Fix #2556 -- Remove attestation from 2FA-device registration
As we currently do not verify attestation in 2FA-device registration, we can safely remove it. This circumvents a bug in webkit when registering Touch-ID as 2FA-device on M1 Macs. See https://bugs.webkit.org/show_bug.cgi?id=224042

For more info on why we do not use attestation, see https://fidoalliance.org/fido-technotes-the-truth-about-attestation/
2022-03-25 12:25:15 +01:00
ser8phin
169a6c51b4 Add check to force users to change password (#2284) 2021-11-11 11:10:33 +01:00
Raphael Michel
a93287207b pretix Community Edition moves to AGPLv3-based license (#2023) 2021-04-12 10:33:47 +02:00
Raphael Michel
23c38a3742 Fix late-night bug in UserNotificationsDisableView 2020-11-10 15:09:09 +01:00
Raphael Michel
20ec388b03 Fix disabling notifications when logged in 2020-11-09 20:05:14 +01:00
julia-luna
b51108ab22 Confirm disabling all notifications (#1845) 2020-11-05 18:40:53 +01:00
Raphael Michel
e836da09cd Fix bug in a combination of timeouts and custom auth backends 2020-09-16 18:09:53 +02:00
Raphael Michel
af23d6e4bf Upgrade to Django 3.0 and other dependencies (#1568)
* Upgrade Django to 3.0 and other dependencies to recent versions

* Fix otp version contsraint

* Remove six dependency

* Resolve some warnings

* Fix failing tests

* Update django-countries

* Resolve all RemovedInDjango31Warnings in test suite

* Run isort

* Fix import

* Update PostgreSQL version on travis
2020-03-23 15:02:20 +01:00
Raphael Michel
027a785ab5 Log out other sessions after email or 2FA changes 2020-03-22 11:04:51 +01:00
Raphael Michel
1d3ac5f02f Fix StaticDevice.MultipleObjectsReturned
PRETIXEU-1YX
2020-03-16 11:41:33 +01:00
Maico Timmerman
9a32668ee1 Make next url authentication backend dependent (#1609)
* Make next url authentication backend dependent

* Rename authentication next_url to get_next_url.

* Add test for custom authentication backend get_next_url.

* Fix typo in docstring of authentication backend get_next_url.
2020-03-15 11:05:57 +01:00
Raphael Michel
8a6a515b6a Refs #775 -- Pluggable authentication backends (#1447)
* Drag-and-drop: Force csrf_token to be present

* Rough design

* Missing file

* b.visble

* Forms

* Docs

* Tests

* Fix variable
2019-10-17 09:11:03 +02:00
Raphael Michel
2c4ee3b3c7 Replace U2F with WebAuthn (#1392)
* Replace U2F with WebAuthn

* Imports

* Fix backwards compatibility

* Add explanatory comment

* Fix tests
2019-09-10 09:58:31 +02:00
Raphael Michel
e3a4ec93fc Fix user log that always shows empty 2019-08-30 13:01:35 +02:00
Raphael Michel
afd766999c Upgrade to Django 2.1 (#710)
* Upgrade to Django 2.0

* more models

* i18n foo

* Update setup.py

* Fix Sentry exception PRETIXEU-JC

* Enforce slug uniqueness

* Import sorting

* Upgrade to Django 2.1

* Travis config

* Try to fix PostgreSQL failure

* Smaller test matrix

* staticfiles→static

* Include request in all authenticate() calls
2018-08-06 12:48:46 +02:00
Raphael Michel
97bf958b74 Allow to re-auth by using the U2F token 2018-04-26 20:24:03 +02:00
Raphael Michel
9dace592c0 Refs #787 -- Activate 2FA after adding a device by default 2018-04-09 18:48:00 +02:00
Raphael Michel
a284e0c2f7 Add auditable superuser mode (#824)
* Remove is_superuser everywhere

* Session handling

* List of sessions, relative timeout

* Absolute timeout

* Optionally pseudo-force audit comments

* Fix failing tests

* Add tests

* Add docs

* Rebsae migration

* Typos

* Fix tests
2018-03-28 14:16:58 +02:00
Raphael Michel
128203800c Implement notifications for admin users (#700)
* First stab at notification settings

* Add "global" setting for notification levels

* Trigger notification task

* Get users with permission for event

* Actually send notification emails

* More notifications

* Allow to turn off notifications

* Link in email to pause all notifications

* Add NotificationType to wordlist

* Add notification tests

* Add documentation

* Rebase fixes
2017-12-14 22:06:08 +01:00
Jakob Schnell
4614d04be4 Correct english typos (#662)
* Check that vouchers selected via API are for the correct event

* Choose different subject for reminder mails if auto-expiry is off

* correct english typos

As with PR #660, it should be checked whether the changes to the
.po-files are respected in the corresponding src-files.
2017-11-03 11:40:52 +01:00
Raphael Michel
2f15d410fe Add optional timeouts for backend sessions 2017-09-04 19:50:32 +02:00
Ian Williams
60e178d821 Fix #443 -- Show private key in 2FA wizard (#490)
* Syncing fork to upstream (#1)

Sync master with master of pretix/pretix@300f8f6

* Automatically sort new products to the end

* Drop "squash your commits" from the dev guide

* Add variation descriptions and allow to order addons

* Link to Django's runserver options in dev docs

* Allow <br> tags in rich text

* Copy from event: deal with deleted items

* Make validate_cart useful together with addons

* Fix collapsing panels in the addon choice step

* Button text change if addons are present

* Update translations

* Squash migrations and bump version

* Ticket PDFs: Do not hide attendee name if code is hidden

* Add a user guide on payments

* Link PayPal and Stripe documentation in the respective forms

* Hide payment fees if they are all equal to 0.00

* Refs #39 -- New concept of "teams" (#478)

* New models

* CRUD UI

* UI for adding/removing team members

* Log display for teams

* Fix invitations, move frontend

* Drop old models (incomplete)

* Drop more old stuff

* Drop even more old stuff

* Fix tests

* Fix permission test

* flake8 fix

* Add tests fore the new code

* Rebase migrations

* Fix typo in method name

* Update translations

* Force ordering of events on dashboard

* Fix typos in events

* Prepare the pretixdroid API for an async mode in the app

* Pretixdroid tests: Ignore microseconds (chopped by mysql)

* pretixdroid API: Add related lookups

* Add idempotenty nonces to pretixdroid API

* pretixdroid: force-accepting unpaids and time display

* Marked webfonts as binary files (#487)

Webfonts now listed as binary in `.gitattributes`.
Works on pretix/pretix#486

* Fix #456 -- Allow products to be excluded from ticket-generation (#483)

* Added non-admission setting to event

`ticket_download_nonadm` now setting in storage. Still need logic for
order page/PDF generation.
Works on pretix/pretix#456.

* Download button considers `ticket_download_nonadm`

Modified Django tags to look at item admission attribute and
`ticket_download_nonadm` setting.
Works on pretix/pretix#456.

* Ticket output for non-admission disabled

PDFs/etc. will only be permitted/generated for items with the
`admission` attribute, or if the `ticket_download_nonadm` event setting
is true. Applies to single and whole-order ticket downloads.
Works on pretix/pretix#456.

* Fixed product exclusion in PDF output

Forgot PDF output was a plugin, now includes same check as base
`BaseTicketOutput.generate_order`.
Works on pretix/pretix#456

* Mail signature (#485)

* added signature field -- no function yet

* added mail signature feature

* fixed style issue

* fixed problem with signature default

* added unit test for mail signatures

* added unit test for mail signatures

* [WIP] Fix #447 -- Sendmail plugin: Create new mail based on an old one (#476)

* send old email content to the new one

* error key event

* test commit

* query bad ID

* query bad ID

* query bad ID

* query bad ID

* Update pretixdroid API version

* Refs #447 -- Extend copying old mails to subject and receipients

* Fixed bugs and added test for date range rendering (#488)

* fixed bug for same dates, added unit check for daterange

* fixed local language override in unit test

* Fix #297 -- pretixdroid: Show metrics in the control panel (#481)

* add checkin status page

add dashboard widget
add checkin page under orders

* modify checkin logic

added new fields in checkin page
added filter items

* add tests for checkins & minor improvement

* support addin_product & noadm setting logic

* remove name ordering check test case

* Fix #379 -- Add logo to event organizers (#431)

* [WIP] Add logo to event organizers.

* Fix indentation issues.

* Refactor code

Refactor code

Refactor code

* Add new migration

* Take files into account for organizer sform (settings form)

* Fix grammer

* Make bootstrap form errors specific to each fieldset

* Display logo on organizer's page

* Fix PR issues

Fix PR issues

Fix PR issues

* Reorder imports

* Remove conflicting migration

* Fix rebase conflict

* Fix #41 -- Drag-and-drop ticket editor

Undo/redo

Useful toolbox

Font selection

Add text content

Use hex for colors

JS-side dump and load

Save

Load layout, proper undo/redo

First steps to Python rendering

More PDF rendering

Copy and paste

Buttons for keyboard actions

Splash Screen

Block unbeforeunload in dirty state

Remove debugging output

Preview

Upload new PDFs via the editor

Fix bugs during PDF reload, link in settings form

New default ticket

Add OpenSans BI

Custom fonts, fix tests

* Added bootstrap-colorpicker

* Allow inline PDF display in CSP header

* Add fontpack to list of plugins

* Update German translation

* Add ticketoutputpdf's assets to MANIFEST.i

* Fix migration of old ticket styles

* Fix iCal download URL

* Multi-line location field, new field for admission time

* Admission date and time in editor

* Remove icon from "add to calendar"

* Try to fix PDF display problems in Safari

* Proxy cachedfiles that are used as editor previews

* Check Event.presale_is_running in more places

* Fix CSS generation with an empty color field

* Fix missing placeholders and reformat the sendmail view

* Fix bug that lead to wrong payment amount when switching payment method to PayPal later

* Update translation

* Revert "Syncing fork to upstream (#1)"

This reverts commit 847d409a00a201d1a03b193a1b4e0bb23c62631e.
Merged wrong, my bad.

* Formatted OTP secret

New variable `secretGrouped` in `2fa_confirm_totp.html`, user-friendly
version of OTP secret (split every 4 characters).
Works on pretix/pretix#443.

* Adds manual secret entry OTP setup screen

`secretGrouped` exposed in user-friendly fashion. Includes short
instructions, copy-to-clipboard button, and js to hide instructions
unless user clicks on "Can't scan the barcode?" link.
Works on pretix/pretix#443.

* Minor indentation issuer

Fixed indentation issue (L40).
Works on pretix/pretix#443.

* Minor spacing issues

L265 of `user.py` failing flake8 tests, minor spacing fixes.

* Fixes indentation in `2fa_confirm_totp.html`

Per https://github.com/pretix/pretix/pull/490#discussion_r116165041,
fixes an issue with indentation.
Works on pretix/pretix#443, member of pretix/pretix#490.

* Removed `aria-*` attributes

Per https://github.com/pretix/pretix/pull/490#discussion_r116165115,
removes `aria` attributes from sub-tutorial.
Works on pretix/pretix#443, member of pretix/pretix#490.

* Pretix capitalization issue

Per https://github.com/pretix/pretix/pull/490#discussion_r116165193,
fixes an issue with capitalization of pretix.
Works on pretix/pretix#443, member of pretix/pretix#490.
2017-05-17 09:31:28 +02:00
Raphael Michel
867a8132aa Add error messages to forms 2017-04-01 15:23:11 +02:00
Raphael Michel
80bd8d2039 Fix TypeError introduced in 9dacea11 2017-03-31 11:49:25 +02:00
Raphael Michel
9dacea11dd Improve wording 2017-03-31 09:54:07 +02:00
Raphael Michel
888aba5714 2FA: Require recent authentication to change settings 2016-10-09 12:59:43 +02:00
Raphael Michel
067b80cd3c Account history view 2016-10-09 12:59:43 +02:00
Raphael Michel
f82b5ddaae Account security notifications via email 2016-10-09 12:59:43 +02:00
Raphael Michel
01b6fe2e45 2FA: Log actions 2016-10-09 12:59:43 +02:00
Raphael Michel
2611b7619e 2FA: Added tests 2016-10-09 12:59:43 +02:00
Raphael Michel
d7719d0bc7 2FA: Login via U2F 2016-10-09 12:59:43 +02:00
Raphael Michel
aecf263de7 2FA: Registraion of U2F devices 2016-10-09 12:59:43 +02:00
Raphael Michel
582d9dca25 2FA: Implement emergency tokens 2016-10-09 12:59:43 +02:00
Raphael Michel
5796402a2e 2FA: Enable and disable 2016-10-09 12:59:43 +02:00
Raphael Michel
9407fc0bca 2FA: Allow to delete devices 2016-10-09 12:59:43 +02:00
Raphael Michel
2f24af824e 2FA: Support for adding TOTP-based devices 2016-10-09 12:59:43 +02:00
Raphael Michel
e828d711bd Used isort to order all import statements 2015-07-19 20:46:34 +02:00
Raphael Michel
11eb01a92b Added a settings change view for users in the frontend 2015-06-25 20:57:02 +02:00
Raphael Michel
4f1e6bb682 UserSettingsform: Refactor validation 2015-06-05 18:35:02 +02:00
Raphael Michel
423dc9f0aa Refactor: separate forms from view, improve code style 2015-06-03 13:19:59 +02:00