After enforcing this on application level in commit 4c37351, we can now also add
a unique constraint on DB level and a migration to fix any left over non-unique entries.
---------
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
As a security precaution, we change the contract of some signals such that a
SafeString needs to be returned if HTML should be rendered without further
escaping.
Before, the `{% signal ... %}` and `{% eventsignal ... %}` template tags
called mark_safe themselves on all strings returned from signals. That could
lead to unsafe coding practices, where untrusted values are interpolated into
HTML format strings. However, such interpolations should usually be performed
using helpers such Django's format_html, which automatically escapes inputs
and returns a SafeString.
Now, we call conditional_escape on signal results, so that any HTML not explicitly
marked as safe gets escaped.
Most plugins are not affected by this change as they return a SafeString as a
result of Template.render already.
* Rename confusingly named helpers for URL generation
* new name
* fix old call
* Revert "new name"
This reverts commit a6e9a488b62b9bc7c2800c402e432765a838cbc6.
* New name
* Turn attendee emails on by default for new events (Z#23213656)
I think the thing that makes me most unhappy is that *most* organizers will
probably want to turn off mail_send_order_paid_attendee when they set
ticket_download_pending and I don't think organizers will remember that, but
it also seems complex and weird to create an automatism for it?
* Update src/pretix/base/models/event.py
Co-authored-by: Martin Gross <gross@rami.io>
---------
Co-authored-by: Martin Gross <gross@rami.io>
* Data model draft
* Refactor query and assignment usages of old permissions
* Backend UI
* API serializer
* Big string replace
* Docs, tests and fixes for teams api
* Update docs for device auth
* Eliminate old names
* Make tests pass
* Use new permissions, remove inconsistencies
* Add test for translations
* Show plugin permissions
* Add permission for seating plans
* Fix plugin activation
* Fix failing test
* Refactor to permission groups
* Update doc/api/resources/devices.rst
Co-authored-by: luelista <weller@rami.io>
* Update doc/api/resources/events.rst
Co-authored-by: luelista <weller@rami.io>
* Update src/pretix/api/serializers/organizer.py
Co-authored-by: luelista <weller@rami.io>
* Fix typo
* Fix python version compat
* Replacement after rebase
* Add proper permission handling for exports
* Docs for exporters
* Runtime linting of permission names
* Fix typos
* Show export page even without orders permission
* More legacy compat
* Do not strongly validate before plugins are loaded
* Rebase migration
* Add permission for outgoing mails
* Review notes
* Update doc/api/resources/teams.rst
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
* Clean up logic around exporters
* Review and failures
* Fix migration leading to forbidden combination
* Handle permissions on event copying
* Remove print-statements
* Make test clearer
* Review feedback
* Add AnyPermissionOf
* migration safety
---------
Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
* Fix not allowing program times on event series (API/copy)
* Return 400 when reading endpoint in event series
* add docs program times not available on event series
* fix isort
* Add program times for items
* Fix frontend date validation
* Add ical data for program times [wip]
* Improve ical data for program times
* Remove duplicate code and add comments
* Adjust migration
* Remove program times form for event series
* Add pdf placeholder [wip]
* Improve explanation text with suggestion
Co-authored-by: Raphael Michel <michel@pretix.eu>
* Fix import sorting
* Improve ical generation
* Improve ical entry description
* Fix migration
* Add copyability for program times fot items and events
* Update migration
* Add API endpoints/functions, fix isort
* Improve variable name
Co-authored-by: Richard Schreiber <schreiber@rami.io>
* Remove todo comment
* Add documentation, Change endpoint name
* Change related name
* Remove unnecessary code block
* Add program times to item API
* Fix imports
* Add log text
* Use daterange helper
* Add and update API tests
* Add another API test
* Add program times to cloning tests
* Update query count because of program times query
* Invalidate cached tickets on program time changes
* Reduce invalidation calls
* Update migration after rebase
* Apply improvements to invalidation from review
Co-authored-by: Richard Schreiber <schreiber@rami.io>
* remove unneccessary attr=item param
* remove unnecessary kwargs for formset_factory
* fix local var name being overwritten in for-loop
* fix empty formset being saved
* Use subevent if available
* make code less verbose
* remove double event-label in ical desc
* fix unnecessary var re-assign
* fix ev vs p.subevent
---------
Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
* Event calendar: Only show "waiting list" if products allow it
* Add a simple test
* Review notes
* Update src/pretix/base/models/event.py
Co-authored-by: Richard Schreiber <schreiber@rami.io>
* Update src/pretix/base/models/event.py
Co-authored-by: Richard Schreiber <schreiber@rami.io>
---------
Co-authored-by: Richard Schreiber <schreiber@rami.io>
* [A11y] move timezone info inline instead of tooltip
* Update text as suggested from code review
Co-authored-by: Raphael Michel <michel@rami.io>
* Rebase migration
* Delete src/pretix/base/migrations/0280_event_is_remote.py
---------
Co-authored-by: Raphael Michel <michel@rami.io>
* Allow to use custom domains for some but not all events
* Update src/pretix/multidomain/urlreverse.py
* Apply suggestions from code review
Co-authored-by: Mira <weller@rami.io>
* Logging for domain config changes
---------
Co-authored-by: Mira <weller@rami.io>
Product categories can now be marked as "cross-selling categories", causing them to
appear in the add-on checkout step as additional recommendations, depending on
their cross-selling visibility (always, only if certain products are already in the cart, or
only if they qualify for a discount according to discount rules).
---------
Co-authored-by: Raphael Michel <michel@rami.io>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Allows organizers to test their shop as if it were a different date and time.
Implemented using a time_machine_now() function which is used instead of regular now(), which can overlay the real date time with a value from a ContextVar, assigned from a session value in EventMiddleware.
For more information, see doc/development/implementation/timemachine.rst
---------
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: Raphael Michel <michel@rami.io>
* Prevent transferring files from priv/ to pub/ on event clone
* Also detect file names with node prefix
* Only transfer files in explicitly declared file fields
* Update django-hierarkey
* Add note to documentation about the new behaviour
* Add public filters based on meta data
* Fix licenseheaders
* ignore empty values
* Fix tests
* Full non-widget implementation
* Widget support
* Add a few tests
* Allow to reorder properties
* Fix isort
* Allow to opt-out for specific events
* Fix name clash between new and old field to make migration feasible
* draft
* Implementation that is closer to old one
* Fix tests
* Add tests
* Update src/pretix/control/forms/item.py
Co-authored-by: Richard Schreiber <schreiber@rami.io>
* Review notes
---------
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Raphael Michel