fix display of attendee_name in list of memberships

fix contrast for $text-muted on $table-bg-accent
unify label and title for view customer account
2024-11-27 12:40:46 +01:00 · 2024-11-25 10:25:53 +01:00 · 2024-11-25 09:54:24 +01:00 · 2024-11-22 13:29:16 +01:00 · 2024-11-22 13:24:24 +01:00 · 2024-11-22 13:17:34 +01:00
452 changed files with 263109 additions and 164271 deletions
@@ -38,7 +38,7 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-pip-
      - name: Install system dependencies
-        run: sudo apt update && sudo apt install gettext unzip
+        run: sudo apt update && sudo apt install -y gettext unzip
      - name: Install Python dependencies
        run: pip3 install -U setuptools build pip check-manifest
      - name: Run check-manifest
@@ -37,7 +37,7 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-pip-
      - name: Install system packages
-        run: sudo apt update && sudo apt install enchant-2 hunspell aspell-en
+        run: sudo apt update && sudo apt install -y enchant-2 hunspell aspell-en
      - name: Install Dependencies
        run: pip3 install -Ur requirements.txt
        working-directory: ./doc
@@ -35,9 +35,9 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-pip-
      - name: Install system packages
-        run: sudo apt update && sudo apt install gettext
+        run: sudo apt update && sudo apt -y install gettext
      - name: Install Dependencies
-        run: pip3 install -e ".[dev]"
+        run: pip3 install uv && uv pip install --system -e ".[dev]"
      - name: Compile messages
        run: python manage.py compilemessages
        working-directory: ./src
@@ -62,7 +62,7 @@ jobs:
      - name: Install system packages
        run: sudo apt update && sudo apt install enchant-2 hunspell hunspell-de-de aspell-en aspell-de
      - name: Install Dependencies
-        run: pip3 install -e ".[dev]"
+        run: pip3 install uv && uv pip install --system -e ".[dev]"
      - name: Spellcheck translations
        run: potypo
        working-directory: ./src
@@ -35,7 +35,7 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-pip-
      - name: Install Dependencies
-        run: pip3 install -e ".[dev]" psycopg2-binary
+        run: pip3 install uv && uv pip install --system -e ".[dev]" psycopg2-binary
      - name: Run isort
        run: isort -c .
        working-directory: ./src
@@ -55,7 +55,7 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-pip-
      - name: Install Dependencies
-        run: pip3 install -e ".[dev]" psycopg2-binary
+        run: pip3 install uv && uv pip install --system -e ".[dev]" psycopg2-binary
      - name: Run flake8
        run: flake8 .
        working-directory: ./src
@@ -5,7 +5,6 @@ on:
    branches: [ master ]
    paths-ignore:
      - 'doc/**'
-      - 'src/pretix/locale/**'
  pull_request:
    branches: [ master ]
    paths-ignore:
@@ -31,15 +30,21 @@ jobs:
            python-version: "3.9"
          - database: sqlite
            python-version: "3.10"
+    services:
+      postgres:
+        image: postgres:15
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: pretix
+        options: >-
+          --health-cmd "pg_isready -U postgres -d pretix"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
    steps:
      - uses: actions/checkout@v4
-      - uses: harmon758/postgresql-action@v1
-        with:
-          postgresql version: '15'
-          postgresql db: 'pretix'
-          postgresql user: 'postgres'
-          postgresql password: 'postgres'
-        if: matrix.database == 'postgres'
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
@@ -51,9 +56,9 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-pip-
      - name: Install system dependencies
-        run: sudo apt update && sudo apt install gettext
+        run: sudo apt update && sudo apt install -y gettext
      - name: Install Python dependencies
-        run: pip3 install --ignore-requires-python -e ".[dev]" psycopg2-binary  # We ignore that flake8 needs newer python as we don't run flake8 during tests
+        run: pip3 install uv && uv pip install --system -e ".[dev]" psycopg2-binary
      - name: Run checks
        run: python manage.py check
        working-directory: ./src
@@ -65,15 +70,15 @@ jobs:
        run: make all compress
      - name: Run tests
        working-directory: ./src
-        run: PRETIX_CONFIG_FILE=tests/travis_${{ matrix.database }}.cfg py.test -n 3 -p no:sugar --cov=./ --cov-report=xml --reruns 3 tests --maxfail=100
+        run: PRETIX_CONFIG_FILE=tests/ci_${{ matrix.database }}.cfg py.test -n 3 -p no:sugar --cov=./ --cov-report=xml tests --maxfail=100
      - name: Run concurrency tests
        working-directory: ./src
-        run: PRETIX_CONFIG_FILE=tests/travis_${{ matrix.database }}.cfg py.test tests/concurrency_tests/ --reruns 0 --reuse-db
+        run: PRETIX_CONFIG_FILE=tests/ci_${{ matrix.database }}.cfg py.test tests/concurrency_tests/ --reuse-db
        if: matrix.database == 'postgres'
      - name: Upload coverage
-        uses: codecov/codecov-action@v1
+        uses: codecov/codecov-action@v4
        with:
          file: src/coverage.xml
          token: ${{ secrets.CODECOV_TOKEN }}
-          fail_ci_if_error: true
+          fail_ci_if_error: false
        if: matrix.database == 'postgres' && matrix.python-version == '3.11'
@@ -10,7 +10,7 @@ tests:
        - cd src
        - python manage.py check
        - make all compress
-        - PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg py.test --reruns 3 -n 3 tests --maxfail=100
+        - PRETIX_CONFIG_FILE=tests/ci_sqlite.cfg py.test -n 3 tests --maxfail=100
    except:
        - pypi
 pypi:
@@ -0,0 +1 @@
+17
@@ -10,6 +10,8 @@ recursive-include src/pretix/helpers/locale *
 recursive-include src/pretix/base/templates *
 recursive-include src/pretix/control/templates *
 recursive-include src/pretix/presale/templates *
+recursive-include src/pretix/plugins/autocheckin/templates *
+recursive-include src/pretix/plugins/autocheckin/static *
 recursive-include src/pretix/plugins/banktransfer/templates *
 recursive-include src/pretix/plugins/banktransfer/static *
 recursive-include src/pretix/plugins/manualpayment/templates *
@@ -294,6 +294,10 @@ Example::
    setting is not provided, pretix will generate a random secret on the first start
    and will store it in the filesystem for later usage.

+``secret_fallback0`` ... ``secret_fallback9``
+    Prior versions of the secret to be used by Django for signing and verification purposes that will still
+    be accepted but no longer be used for new signing.
+
 ``debug``
    Whether or not to run in debug mode. Default is ``False``.

@@ -231,11 +231,10 @@ The following snippet is an example on how to configure a nginx proxy for pretix
        }
    }
    server {
-        listen 443 default_server;
-        listen [::]:443 ipv6only=on default_server;
+        listen 443 ssl default_server;
+        listen [::]:443 ipv6only=on ssl default_server;
        server_name pretix.mydomain.com;

-        ssl on;
        ssl_certificate /path/to/cert.chain.pem;
        ssl_certificate_key /path/to/key.pem;

@@ -65,7 +65,7 @@ Package dependencies
 To build and run pretix, you will need the following debian packages::

    # apt-get install git build-essential python3-dev python3-venv python3 python3-pip \
-                      python3-dev libxml2-dev libxslt1-dev libffi-dev zlib1g-dev libssl-dev \
+                      libxml2-dev libxslt1-dev libffi-dev zlib1g-dev libssl-dev \
                      gettext libpq-dev libjpeg-dev libopenjp2-7-dev

 Config file
@@ -216,11 +216,10 @@ The following snippet is an example on how to configure a nginx proxy for pretix
        }
    }
    server {
-        listen 443 default_server;
-        listen [::]:443 ipv6only=on default_server;
+        listen 443 ssl default_server;
+        listen [::]:443 ipv6only=on ssl default_server;
        server_name pretix.mydomain.com;

-        ssl on;
        ssl_certificate /path/to/cert.chain.pem;
        ssl_certificate_key /path/to/key.pem;

@@ -73,4 +73,11 @@ This release includes a migration that changes retroactively fills an `organizer
 `pretixbase_logentry`. If you have a large database, the migration step of the upgrade might take significantly
 longer than usual, so plan the update accordingly.

+Upgrade to 2024.7.0 or newer
+"""""""""""""""""""""""""""""
+
+This release includes a migration that changes how sales channels are referred on orders.
+If you have a large database, the migration step of the upgrade might take significantly longer than usual, so plan
+the update accordingly.
+
 .. _blog: https://pretix.eu/about/en/blog/
@@ -0,0 +1,259 @@
+.. _rest-autocheckinrules:
+
+Auto check-in rules
+===================
+
+This feature requires the bundled ``pretix.plugins.autocheckin`` plugin to be active for the event in order to work properly.
+
+Resource description
+--------------------
+
+Auto check-in rules specify that tickets should under specific conditions automatically be considered checked in after
+they have been purchased.
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal ID of the rule
+list                                  integer                    ID of the check-in list to check the ticket in on. If
+                                                                 ``None``, the system will select all matching check-in lists.
+mode                                  string                     ``"placed"`` if the rule should be evaluated right after
+                                                                 an order has been created, ``"paid"`` if the rule should
+                                                                 be evaluated after the order has been fully paid.
+all_sales_channels                    boolean                    If ``true`` (default), the rule applies to tickets sold on all sales channels.
+limit_sales_channels                  list of strings            List of sales channel identifiers the rule should apply to
+                                                                 if ``all_sales_channels`` is ``false``.
+all_products                          boolean                    If ``true`` (default), the rule affects all products and variations.
+limit_products                        list of integers           List of item IDs, if ``all_products`` is not set. If the
+                                                                 product listed here has variations, all variations will be matched.
+limit_variations                      list of integers           List of product variation IDs, if ``all_products`` is not set.
+                                                                 The parent product does not need to be part of ``limit_products``.
+all_payment_methods                   boolean                    If ``true`` (default), the rule applies to tickets paid with all payment methods.
+limit_payment_methods                 list of strings            List of payment method identifiers the rule should apply to
+                                                                 if ``all_payment_methods`` is ``false``.
+===================================== ========================== =======================================================
+
+.. versionadded:: 2024.7
+
+Endpoints
+---------
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/auto_checkin_rules/
+
+   Returns a list of all rules configured for an event.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/auto_checkin_rules/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "list": 12345,
+            "mode": "placed",
+            "all_sales_channels": false,
+            "limit_sales_channels": ["web"],
+            "all_products": false,
+            "limit_products": [2, 3],
+            "limit_variations": [456],
+            "all_payment_methods": true,
+            "limit_payment_methods": []
+          }
+        ]
+      }
+
+   :query page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of a valid organizer
+   :param event: The ``slug`` field of the event to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view it.
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/auto_checkin_rules/(id)/
+
+   Returns information on one rule, identified by its ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/auto_checkin_rules/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "list": 12345,
+        "mode": "placed",
+        "all_sales_channels": false,
+        "limit_sales_channels": ["web"],
+        "all_products": false,
+        "limit_products": [2, 3],
+        "limit_variations": [456],
+        "all_payment_methods": true,
+        "limit_payment_methods": []
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param id: The ``id`` field of the rule to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event/rule does not exist **or** you have no permission to view it.
+
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/auto_checkin_rules/
+
+   Create a new rule.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/auto_checkin_rules/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 166
+
+      {
+        "list": 12345,
+        "mode": "placed",
+        "all_sales_channels": false,
+        "limit_sales_channels": ["web"],
+        "all_products": false,
+        "limit_products": [2, 3],
+        "limit_variations": [456],
+        "all_payment_methods": true,
+        "limit_payment_methods": []
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "list": 12345,
+        "mode": "placed",
+        "all_sales_channels": false,
+        "limit_sales_channels": ["web"],
+        "all_products": false,
+        "limit_products": [2, 3],
+        "limit_variations": [456],
+        "all_payment_methods": true,
+        "limit_payment_methods": []
+      }
+
+   :param organizer: The ``slug`` field of the organizer to create a rule for
+   :param event: The ``slug`` field of the event to create a rule for
+   :statuscode 201: no error
+   :statuscode 400: The rule could not be created due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to create rules.
+
+
+.. http:patch:: /api/v1/organizers/(organizer)/events/(event)/auto_checkin_rules/(id)/
+
+   Update a rule. You can also use ``PUT`` instead of ``PATCH``. With ``PUT``, you have to provide all fields of
+   the resource, other fields will be reset to default. With ``PATCH``, you only need to provide the fields that you
+   want to change.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      PATCH /api/v1/organizers/bigevents/events/sampleconf/auto_checkin_rules/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 34
+
+      {
+        "mode": "paid",
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: text/javascript
+
+      {
+        "id": 1,
+        "list": 12345,
+        "mode": "placed",
+        "all_sales_channels": false,
+        "limit_sales_channels": ["web"],
+        "all_products": false,
+        "limit_products": [2, 3],
+        "limit_variations": [456],
+        "all_payment_methods": true,
+        "limit_payment_methods": []
+      }
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param event: The ``slug`` field of the event to modify
+   :param id: The ``id`` field of the rule to modify
+   :statuscode 200: no error
+   :statuscode 400: The rule could not be modified due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event/rule does not exist **or** you have no permission to change it.
+
+
+.. http:delete:: /api/v1/organizers/(organizer)/events/(event)/auto_checkin_rules/(id)/
+
+   Delete a rule.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      DELETE /api/v1/organizers/bigevents/events/sampleconf/auto_checkin_rules/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 204 No Content
+      Vary: Accept
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param event: The ``slug`` field of the event to modify
+   :param id: The ``id`` field of the rule to delete
+   :statuscode 204: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event/rule does not exist **or** you have no permission to change it **or** this rule cannot be deleted since it is currently in use.
@@ -40,6 +40,11 @@ answers                               list of objects            Answers to user
 seat                                  objects                    The assigned seat (or ``null``)
 ├ id                                  integer                    Internal ID of the seat instance
 ├ name                                string                     Human-readable seat name
+├ zone_name                           string                     Name of the zone the seat is in
+├ row_name                            string                     Name/number of the row the seat is in
+├ row_label                           string                     Additional label of the row (or ``null``)
+├ seat_number                         string                     Number of the seat within the row
+├ seat_label                          string                     Additional label of the seat (or ``null``)
 └ seat_guid                           string                     Identifier of the seat within the seating plan
 ===================================== ========================== =======================================================

@@ -23,6 +23,22 @@ position                              integer                    An integer, use
 is_addon                              boolean                    If ``true``, items within this category are not on sale
                                                                 on their own but the category provides a source for
                                                                 defining add-ons for other products.
+cross_selling_mode                    string                     If ``null``, cross-selling is disabled for this category.
+                                                                 If ``"only"``, it is only visible in the cross-selling
+                                                                 step.
+                                                                 If ``"both"``, it is visible on the normal index page
+                                                                 as well.
+                                                                 Only available if ``is_addon`` is ``false``.
+cross_selling_condition               string                     Only relevant if ``cross_selling_mode`` is not ``null``.
+                                                                 If ``"always"``, always show in cross-selling step.
+                                                                 If ``"products"``, only show if the cart contains one of
+                                                                 the products listed in ``cross_selling_match_products``.
+                                                                 If ``"discounts"``, only show products that qualify for
+                                                                 a discount according to discount rules.
+cross_selling_match_products          list of integer            Only relevant if ``cross_selling_condition`` is
+                                                                 ``"products"``. Internal ID of the items of which at
+                                                                 least one needs to be in the cart for this category to
+                                                                 be shown.
 ===================================== ========================== =======================================================


@@ -60,7 +76,10 @@ Endpoints
            "internal_name": "",
            "description": {"en": "Tickets are what you need to get in."},
            "position": 1,
-            "is_addon": false
+            "is_addon": false,
+            "cross_selling_mode": null,
+            "cross_selling_condition": null,
+            "cross_selling_match_products": []
          }
        ]
      }
@@ -102,7 +121,10 @@ Endpoints
        "internal_name": "",
        "description": {"en": "Tickets are what you need to get in."},
        "position": 1,
-        "is_addon": false
+        "is_addon": false,
+        "cross_selling_mode": null,
+        "cross_selling_condition": null,
+        "cross_selling_match_products": []
      }

   :param organizer: The ``slug`` field of the organizer to fetch
@@ -130,7 +152,10 @@ Endpoints
        "internal_name": "",
        "description": {"en": "Tickets are what you need to get in."},
        "position": 1,
-        "is_addon": false
+        "is_addon": false,
+        "cross_selling_mode": null,
+        "cross_selling_condition": null,
+        "cross_selling_match_products": []
      }

   **Example response**:
@@ -147,7 +172,10 @@ Endpoints
        "internal_name": "",
        "description": {"en": "Tickets are what you need to get in."},
        "position": 1,
-        "is_addon": false
+        "is_addon": false,
+        "cross_selling_mode": null,
+        "cross_selling_condition": null,
+        "cross_selling_match_products": []
      }

   :param organizer: The ``slug`` field of the organizer of the event to create a category for
@@ -193,7 +221,10 @@ Endpoints
        "internal_name": "",
        "description": {"en": "Tickets are what you need to get in."},
        "position": 1,
-        "is_addon": true
+        "is_addon": true,
+        "cross_selling_mode": null,
+        "cross_selling_condition": null,
+        "cross_selling_match_products": []
      }

   :param organizer: The ``slug`` field of the organizer to modify
@@ -31,7 +31,6 @@ subevent                              integer                    ID of the date
 position_count                        integer                    Number of tickets that match this list (read-only).
 checkin_count                         integer                    Number of check-ins performed on this list (read-only).
 include_pending                       boolean                    If ``true``, the check-in list also contains tickets from orders in pending state.
-auto_checkin_sales_channels           list of strings            All items on the check-in list will be automatically marked as checked-in when purchased through any of the listed sales channels.
 allow_multiple_entries                boolean                    If ``true``, subsequent scans of a ticket on this list should not show a warning but instead be stored as an additional check-in.
 allow_entry_after_exit                boolean                    If ``true``, subsequent scans of a ticket on this list are valid if the last scan of the ticket was an exit scan.
 rules                                 object                     Custom check-in logic. The contents of this field are currently not considered a stable API and modifications through the API are highly discouraged.
@@ -90,10 +89,7 @@ Endpoints
            "allow_entry_after_exit": true,
            "exit_all_at": null,
            "rules": {},
-            "addon_match": false,
-            "auto_checkin_sales_channels": [
-              "pretixpos"
-            ]
+            "addon_match": false
          }
        ]
      }
@@ -145,10 +141,7 @@ Endpoints
        "allow_entry_after_exit": true,
        "exit_all_at": null,
        "rules": {},
-        "addon_match": false,
-        "auto_checkin_sales_channels": [
-          "pretixpos"
-        ]
+        "addon_match": false
      }

   :param organizer: The ``slug`` field of the organizer to fetch
@@ -245,10 +238,7 @@ Endpoints
        "subevent": null,
        "allow_multiple_entries": false,
        "allow_entry_after_exit": true,
-        "addon_match": false,
-        "auto_checkin_sales_channels": [
-          "pretixpos"
-        ]
+        "addon_match": false
      }

   **Example response**:
@@ -270,10 +260,7 @@ Endpoints
        "subevent": null,
        "allow_multiple_entries": false,
        "allow_entry_after_exit": true,
-        "addon_match": false,
-        "auto_checkin_sales_channels": [
-          "pretixpos"
-        ]
+        "addon_match": false
      }

   :param organizer: The ``slug`` field of the organizer of the event/item to create a list for
@@ -325,10 +312,7 @@ Endpoints
        "subevent": null,
        "allow_multiple_entries": false,
        "allow_entry_after_exit": true,
-        "addon_match": false,
-        "auto_checkin_sales_channels": [
-          "pretixpos"
-        ]
+        "addon_match": false
      }

   :param organizer: The ``slug`` field of the organizer to modify
@@ -341,7 +325,7 @@ Endpoints

 .. http:delete:: /api/v1/organizers/(organizer)/events/(event)/checkinlist/(id)/

-   Delete a check-in list. Note that this also deletes the information on all check-ins performed via this list.
+   Delete a check-in list. **Note that this also deletes the information on all check-ins performed via this list.**

   **Example request**:

@@ -96,6 +96,8 @@ Endpoints

   :query integer page: The page number in case of a multi-page result set, default is 1
   :query string secret: Only show gift cards with the given secret.
+   :query string value: Only show gift cards with the given value.
+   :query boolean expired: Filter for gift cards that are (not) expired.
   :query boolean testmode: Filter for gift cards that are (not) in test mode.
   :query boolean include_accepted: Also show gift cards issued by other organizers that are accepted by this organizer.
   :query string expand: If you pass ``"owner_ticket"``, the respective field will be shown as a nested value instead of just an ID.
@@ -44,5 +44,7 @@ at :ref:`plugin-docs`.
   scheduled_exports
   shredders
   sendmail_rules
+   auto_checkin_rules
   billing_invoices
-   billing_var
+   billing_var
+   seats
@@ -217,6 +217,9 @@ List of all invoices
   :query boolean is_cancellation: If set to ``true`` or ``false``, only invoices with this value for the field
                                   ``is_cancellation`` will be returned.
   :query string order: If set, only invoices belonging to the order with the given order code will be returned.
+                        This parameter may be given multiple times. In this case, all invoices matching one of the inputs will be returned.
+   :query string number: If set, only invoices with the given invoice number will be returned.
+                        This parameter may be given multiple times. In this case, all invoices matching one of the inputs will be returned.
   :query string refers: If set, only invoices referring to the given invoice will be returned.
   :query string locale: If set, only invoices with the given locale will be returned.
   :query string ordering: Manually set the ordering of results. Valid fields to be used are ``date`` and
@@ -349,12 +352,12 @@ Fetching individual invoices

   :param organizer: The ``slug`` field of the organizer to fetch
   :param event: The ``slug`` field of the event to fetch
-   :param invoice_no: The ``invoice_no`` field of the invoice to fetch
+   :param number: The ``number`` field of the invoice to fetch
   :statuscode 200: no error
   :statuscode 401: Authentication failure
   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.

-.. http:get:: /api/v1/organizers/(organizer)/events/(event)/invoices/(invoice_no)/download/
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/invoices/(number)/download/

   Download an invoice in PDF format.

@@ -381,7 +384,7 @@ Fetching individual invoices

   :param organizer: The ``slug`` field of the organizer to fetch
   :param event: The ``slug`` field of the event to fetch
-   :param invoice_no: The ``invoice_no`` field of the invoice to fetch
+   :param number: The ``number`` field of the invoice to fetch
   :statuscode 200: no error
   :statuscode 401: Authentication failure
   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
@@ -394,7 +397,7 @@ Modifying invoices

 Invoices cannot be edited directly, but the following actions can be triggered:

-.. http:post:: /api/v1/organizers/(organizer)/events/(event)/invoices/(invoice_no)/reissue/
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/invoices/(number)/reissue/

   Cancels the invoice and creates a new one.

@@ -416,13 +419,13 @@ Invoices cannot be edited directly, but the following actions can be triggered:

   :param organizer: The ``slug`` field of the organizer to fetch
   :param event: The ``slug`` field of the event to fetch
-   :param invoice_no: The ``invoice_no`` field of the invoice to reissue
+   :param number: The ``number`` field of the invoice to reissue
   :statuscode 200: no error
   :statuscode 400: The invoice has already been canceled
   :statuscode 401: Authentication failure
   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to change this resource.

-.. http:post:: /api/v1/organizers/(organizer)/events/(event)/invoices/(invoice_no)/regenerate/
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/invoices/(number)/regenerate/

   Re-generates the invoice from order data.

@@ -444,7 +447,7 @@ Invoices cannot be edited directly, but the following actions can be triggered:

   :param organizer: The ``slug`` field of the organizer to fetch
   :param event: The ``slug`` field of the event to fetch
-   :param invoice_no: The ``invoice_no`` field of the invoice to regenerate
+   :param number: The ``number`` field of the invoice to regenerate
   :statuscode 200: no error
   :statuscode 400: The invoice has already been canceled
   :statuscode 401: Authentication failure
@@ -164,6 +164,7 @@ Endpoints
      }

   :query integer page: The page number in case of a multi-page result set, default is 1
+   :query string search: Filter the list by the value of the variation (substring search).
   :query boolean active: If set to ``true`` or ``false``, only items with this value for the field ``active`` will be
                          returned.
   :param organizer: The ``slug`` field of the organizer to fetch
@@ -392,6 +392,7 @@ Endpoints
      }

   :query integer page: The page number in case of a multi-page result set, default is 1
+   :query string search: Filter the list by internal name or name of the item (substring search).
   :query boolean active: If set to ``true`` or ``false``, only items with this value for the field ``active`` will be
                          returned.
   :query integer category: If set to the ID of a category, only items within that category will be returned.
@@ -42,6 +42,8 @@ payment_date                          date                       **DEPRECATED AN
 payment_provider                      string                     **DEPRECATED AND INACCURATE** Payment provider used for this order
 total                                 money (string)             Total value of this order
 comment                               string                     Internal comment on this order
+api_meta                              object                     Meta data for that order. Only available through API, no guarantees
+                                                                 on the content structure. You can use this to save references to your system.
 custom_followup_at                    date                       Internal date for a custom follow-up action
 checkin_attention                     boolean                    If ``true``, the check-in app should show a warning
                                                                 that this ticket requires special attention if a ticket
@@ -102,6 +104,10 @@ url                                   string                     The full URL to
 payments                              list of objects            List of payment processes (see below)
 refunds                               list of objects            List of refund processes (see below)
 last_modified                         datetime                   Last modification of this object
+cancellation_date                     datetime                   Time of order cancellation (or ``null``). **Note**:
+                                                                 Will not be set for partial cancellations and is not
+                                                                 reliable for orders that have been cancelled,
+                                                                 reactivated and cancelled again.
 ===================================== ========================== =======================================================


@@ -149,6 +155,9 @@ last_modified                         datetime                   Last modificati

   The ``expires`` attribute can now be passed during order creation.

+.. versionchanged:: 2024.11
+
+   The ``cancellation_date`` attribute has been added and can also be used as an ordering key.

 .. _order-position-resource:

@@ -201,8 +210,20 @@ checkins                              list of objects            List of **succe
 ├ datetime                            datetime                   Time of check-in
 ├ type                                string                     Type of scan (defaults to ``entry``)
 ├ gate                                integer                    Internal ID of the gate. Can be ``null``.
-├ device                              integer                    Internal ID of the device. Can be ``null``.
+├ device                              integer                    Internal ID of the device. Can be ``null``. **Deprecated**, since this ID is not otherwise used in the API and is therefore not very useful.
+├ device_id                           integer                    Attribute ``device_id`` of the device. Can be ``null``.
 └ auto_checked_in                     boolean                    Indicates if this check-in been performed automatically by the system
+print_logs                            list of objects            List of print jobs recorded e.g. by the pretix apps
+├ id                                  integer                    Internal ID of the print job
+├ successful                          boolean                    Whether the print job successfully resulted in a print.
+                                                                 This is not expected to be 100 % reliable information (since
+                                                                 printer feedback is never perfect) and there is no guarantee
+                                                                 that unsuccessful jobs will be logged.
+├ device_id                           integer                    Attribute ``device_id`` of the device that recorded the print. Can be ``null``.
+├ datetime                            datetime                   Time of printing
+├ source                              string                     Source of print job, e.g. name of the app used.
+├ type                                string                     Type of print (currently ``badge``, ``ticket``, ``certificate``, or ``other``)
+└ info                                object                     Additional data with client-dependent structure.
 downloads                             list of objects            List of ticket download options
 ├ output                              string                     Ticket output provider (e.g. ``pdf``, ``passbook``)
 └ url                                 string                     Download URL
@@ -215,6 +236,11 @@ answers                               list of objects            Answers to user
 seat                                  objects                    The assigned seat. Can be ``null``.
 ├ id                                  integer                    Internal ID of the seat instance
 ├ name                                string                     Human-readable seat name
+├ zone_name                           string                     Name of the zone the seat is in
+├ row_name                            string                     Name/number of the row the seat is in
+├ row_label                           string                     Additional label of the row (or ``null``)
+├ seat_number                         string                     Number of the seat within the row
+├ seat_label                          string                     Additional label of the seat (or ``null``)
 └ seat_guid                           string                     Identifier of the seat within the seating plan
 pdf_data                              object                     Data object required for ticket PDF generation. By default,
                                                                 this field is missing. It will be added only if you add the
@@ -225,6 +251,10 @@ pdf_data                              object                     Data object req

   The attributes ``blocked``, ``valid_from`` and ``valid_until`` have been added.

+.. versionchanged:: 2024.9
+
+   The attribute ``print_logs`` has been added.
+
 .. _order-payment-resource:

 Order payment resource
@@ -391,10 +421,21 @@ List of all orders
                    "type": "entry",
                    "gate": null,
                    "device": 2,
+                    "device_id": 1,
                    "datetime": "2017-12-25T12:45:23Z",
                    "auto_checked_in": false
                  }
                ],
+                "print_logs": [
+                  {
+                    "id": 1,
+                    "type": "badge",
+                    "datetime": "2017-12-25T12:45:23Z",
+                    "device_id": 1,
+                    "source": "pretixSCAN",
+                    "info": {}
+                  }
+                ],
                "answers": [
                  {
                    "question": 12,
@@ -430,14 +471,15 @@ List of all orders
                "provider": "banktransfer"
              }
            ],
-            "refunds": []
+            "refunds": [],
+            "cancellation_date": null
          }
        ]
      }

   :query integer page: The page number in case of a multi-page result set, default is 1
   :query string ordering: Manually set the ordering of results. Valid fields to be used are ``datetime``, ``code``,
-                           ``last_modified``, and ``status``. Default: ``datetime``
+                           ``last_modified``, ``status`` and ``cancellation_date``. Default: ``datetime``
   :query string code: Only return orders that match the given order code
   :query string status: Only return orders in the given order status (see above)
   :query string search: Only return orders matching a given search query (matching for names, email addresses, and company names)
@@ -455,10 +497,13 @@ List of all orders
   :query datetime modified_since: Only return orders that have changed since the given date. Be careful: We only
       recommend using this in combination with ``testmode=false``, since test mode orders can vanish at any time and
       you will not notice it using this method.
-   :query datetime created_since: Only return orders that have been created since the given date.
+   :query datetime created_since: Only return orders that have been created since the given date (inclusive).
+   :query datetime created_before: Only return orders that have been created before the given date (exclusive).
   :query integer subevent: Only return orders with a position that contains this subevent ID. *Warning:* Result will also include orders if they contain mixed subevents, and it will even return orders where the subevent is only contained in a canceled position.
   :query datetime subevent_after: Only return orders that contain a ticket for a subevent taking place after the given date. This is an exclusive after, and it considers the **end** of the subevent (or its start, if the end is not set).
   :query datetime subevent_before: Only return orders that contain a ticket for a subevent taking place after the given date. This is an exclusive before, and it considers the **start** of the subevent.
+   :query string sales_channel: Only return orders with the given sales channel identifier (e.g. ``"web"``).
+   :query string payment_provider: Only return orders that contain a payment using the given payment provider. Note that this also searches for partial incomplete, or failed payments within the order and is not useful to get a sum of payment amounts without further processing.
   :query string exclude: Exclude a field from the output, e.g. ``fees`` or ``positions.downloads``. Can be used as a performance optimization. Can be passed multiple times.
   :query string include: Include only the given field in the output, e.g. ``fees`` or ``positions.downloads``. Can be used as a performance optimization. Can be passed multiple times. ``include`` is applied before ``exclude``, so ``exclude`` takes precedence.
   :param organizer: The ``slug`` field of the organizer to fetch
@@ -554,6 +599,7 @@ Fetching individual orders
        "fees": [],
        "total": "23.00",
        "comment": "",
+        "api_meta": {},
        "custom_followup_at": null,
        "checkin_attention": false,
        "checkin_text": null,
@@ -614,10 +660,22 @@ Fetching individual orders
                "type": "entry",
                "gate": null,
                "device": 2,
+                "device_id": 1,
                "datetime": "2017-12-25T12:45:23Z",
                "auto_checked_in": false
              }
            ],
+            "print_logs": [
+              {
+                "id": 1,
+                "type": "badge",
+                "successful": true,
+                "datetime": "2017-12-25T12:45:23Z",
+                "device_id": 1,
+                "source": "pretixSCAN",
+                "info": {}
+              }
+            ],
            "answers": [
              {
                "question": 12,
@@ -653,7 +711,8 @@ Fetching individual orders
            "provider": "banktransfer"
          }
        ],
-        "refunds": []
+        "refunds": [],
+        "cancellation_date": null
      }

   :param organizer: The ``slug`` field of the organizer to fetch
@@ -734,6 +793,8 @@ Updating order fields

   * ``comment``

+   * ``api_meta``
+
   * ``custom_followup_at``

   * ``invoice_address`` (you always need to supply the full object, or ``null`` to delete the current address)
@@ -963,8 +1024,8 @@ Creating orders
      * ``internal_reference``
      * ``vat_id``
      * ``vat_id_validated`` (optional) – If you need support for reverse charge (rarely the case), you need to check
-       yourself if the passed VAT ID is a valid EU VAT ID. In that case, set this to ``true``. Only valid VAT IDs will
-       trigger reverse charge taxation. Don't forget to set ``is_business`` as well!
+         yourself if the passed VAT ID is a valid EU VAT ID. In that case, set this to ``true``. Only valid VAT IDs will
+         trigger reverse charge taxation. Don't forget to set ``is_business`` as well!

   * ``positions``

@@ -1567,10 +1628,22 @@ List of all order positions
                "type": "entry",
                "gate": null,
                "device": 2,
+                "device_id": 1,
                "datetime": "2017-12-25T12:45:23Z",
                "auto_checked_in": false
              }
            ],
+            "print_logs": [
+              {
+                "id": 1,
+                "type": "badge",
+                "successful": true,
+                "datetime": "2017-12-25T12:45:23Z",
+                "device_id": 1,
+                "source": "pretixSCAN",
+                "info": {}
+              }
+            ],
            "answers": [
              {
                "question": 12,
@@ -1681,10 +1754,22 @@ Fetching individual positions
            "type": "entry",
            "gate": null,
            "device": 2,
+            "device_id": 1,
            "datetime": "2017-12-25T12:45:23Z",
            "auto_checked_in": false
          }
        ],
+        "print_logs": [
+          {
+            "id": 1,
+            "type": "badge",
+            "successful": true,
+            "datetime": "2017-12-25T12:45:23Z",
+            "device_id": 1,
+            "source": "pretixSCAN",
+            "info": {}
+          }
+        ],
        "answers": [
          {
            "question": 12,
@@ -1781,6 +1866,10 @@ Manipulating individual positions

   The endpoints to manage blocks have been added.

+.. versionchanged:: 2024.9
+
+   The API now supports logging ticket and badge prints.
+
 .. http:patch:: /api/v1/organizers/(organizer)/events/(event)/orderpositions/(id)/

   Updates specific fields on an order position. Currently, only the following fields are supported:
@@ -2040,6 +2129,59 @@ Manipulating individual positions
   :statuscode 401: Authentication failure
   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to update this order position.

+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/orderpositions/(id)/printlog/
+
+   Creates a print log, stating that this ticket has been printed.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/orderpositions/23442/printlog/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+     {
+       "datetime": "2024-09-19T13:37:00+02:00",
+       "source": "pretixPOS",
+       "type": "badge",
+       "info": {
+         "cashier": 1234
+       }
+     }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/pdf
+
+     {
+       "id": 1234,
+       "device_id": null,
+       "datetime": "2024-09-19T13:37:00+02:00",
+       "source": "pretixPOS",
+       "type": "badge",
+       "info": {
+         "cashier": 1234
+       }
+     }
+
+   :param organizer: The ``slug`` field of the organizer to create a log for
+   :param event: The ``slug`` field of the event to create a log for
+   :param id: The ``id`` field of the order position to create a log for
+   :statuscode 201: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource
+                    **or** downloads are not available for this order position at this time. The response content will
+                    contain more details.
+   :statuscode 404: The requested order position or download provider does not exist.
+   :statuscode 409: The file is not yet ready and will now be prepared. Retry the request after waiting for a few
+                    seconds.
+
 Changing order contents
 -----------------------

@@ -51,7 +51,7 @@ Endpoints
        "results": [
          {
            "identifier": "web",
-            "name": {
+            "label": {
              "en": "Online shop"
            },
            "type": "web",
@@ -88,7 +88,7 @@ Endpoints

      {
        "identifier": "web",
-        "name": {
+        "label": {
          "en": "Online shop"
        },
        "type": "web",
@@ -116,7 +116,7 @@ Endpoints

      {
        "identifier": "api.custom",
-        "name": {
+        "label": {
          "en": "Custom integration"
        },
        "type": "api",
@@ -133,7 +133,7 @@ Endpoints

      {
        "identifier": "api.custom",
-        "name": {
+        "label": {
          "en": "Custom integration"
        },
        "type": "api",
@@ -178,7 +178,7 @@ Endpoints

      {
        "identifier": "web",
-        "name": {
+        "label": {
          "en": "Online shop"
        },
        "type": "web",
@@ -313,7 +313,7 @@ Endpoints for event exports
   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to delete this resource.

 Endpoints for organizer exports
---------------------------
+-------------------------------

 .. http:get:: /api/v1/organizers/(organizer)/scheduled_exports/

@@ -553,4 +553,4 @@ Endpoints for organizer exports
   :statuscode 403: The requested organizer does not exist **or** you have no permission to delete this resource.


-.. _RFC 5545: https://datatracker.ietf.org/doc/html/rfc5545#section-3.8.5.3
+.. _RFC 5545: https://datatracker.ietf.org/doc/html/rfc5545#section-3.8.5.3
@@ -0,0 +1,262 @@
+.. _`rest-seats`:
+
+Seats
+=====
+
+The seat resource represents the seats in a seating plan in a specific event or subevent.
+
+Resource description
+--------------------
+
+The seat resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal ID of this seat
+subevent                              integer                    Internal ID of the subevent this seat belongs to
+zone_name                             string                     Name of the zone the seat is in
+row_name                              string                     Name/number of the row the seat is in
+row_label                             string                     Additional label of the row (or ``null``)
+seat_number                           string                     Number of the seat within the row
+seat_label                            string                     Additional label of the seat (or ``null``)
+seat_guid                             string                     Identifier of the seat within the seating plan
+product                               integer                    Internal ID of the product that is mapped to this seat
+blocked                               boolean                    Whether this seat is blocked manually.
+orderposition                         integer / object           Internal ID of an order position reserving this seat.
+cartposition                          integer / object           Internal ID of a cart position reserving this seat.
+voucher                               integer / object           Internal ID of a voucher reserving this seat.
+===================================== ========================== =======================================================
+
+Endpoints
+---------
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/seats/
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/subevents/(subevent_id)/seats/
+
+   Returns a list of all seats in the specified event or subevent. Depending on whether the event has subevents, the
+   according endpoint has to be used.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/seats/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+        HTTP/1.1 200 OK
+        Vary: Accept
+        Content-Type: application/json
+
+        {
+            "count": 500,
+            "next": "https://pretix.eu/api/v1/organizers/bigevents/events/sampleconf/seats/?page=2",
+            "previous": null,
+            "results": [
+                {
+                    "id": 1633,
+                    "subevent": null,
+                    "zone_name": "Ground floor",
+                    "row_name": "1",
+                    "row_label": null,
+                    "seat_number": "1",
+                    "seat_label": null,
+                    "seat_guid": "b9746230-6f31-4f41-bbc9-d6b60bdb3342",
+                    "product": 104,
+                    "blocked": false,
+                    "orderposition": null,
+                    "cartposition": null,
+                    "voucher": 51
+                },
+                {
+                    "id": 1634,
+                    "subevent": null,
+                    "zone_name": "Ground floor",
+                    "row_name": "1",
+                    "row_label": null,
+                    "seat_number": "2",
+                    "seat_label": null,
+                    "seat_guid": "1d29fe20-8e1e-4984-b0ee-2773b0d07e07",
+                    "product": 104,
+                    "blocked": true,
+                    "orderposition": 4321,
+                    "cartposition": null,
+                    "voucher": null
+                },
+                // ...
+            ]
+        }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1.
+   :query string zone_name: Only show seats with the given zone_name.
+   :query string row_name: Only show seats with the given row_name.
+   :query string row_label: Only show seats with the given row_label.
+   :query string seat_number: Only show seats with the given seat_number.
+   :query string seat_label: Only show seats with the given seat_label.
+   :query string seat_guid: Only show seats with the given seat_guid.
+   :query boolean blocked: Only show seats with the given blocked status.
+   :query boolean is_available: Only show seats that are (not) currently available.
+   :query string expand: If you pass ``"orderposition"``, ``"cartposition"``, or ``"voucher"``, the respective field will be
+                         shown as a nested value instead of just an ID. This requires permission to access that object.
+                         The nested objects are identical to the respective resources, except that order positions
+                         will have an attribute of the format ``"order": {"code": "ABCDE", "event": "eventslug"}`` to make
+                         matching easier, and won't include the `seat` attribute, as that would be redundant.
+                         The parameter can be given multiple times.
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param subevent_id: The ``id`` field of the subevent to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+   :statuscode 404: Endpoint without subevent id was used for event with subevents, or vice versa.
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/seats/(id)/
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/subevents/(subevent_id)/seats/(id)/
+
+   Returns information on one seat, identified by its ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+        GET /api/v1/organizers/bigevents/events/sampleconf/seats/1634/?expand=orderposition HTTP/1.1
+        Host: pretix.eu
+        Accept: application/json
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+        HTTP/1.1 200 OK
+        Vary: Accept
+        Content-Type: application/json
+
+        {
+            "id": 1634,
+            "subevent": null,
+            "zone_name": "Ground floor",
+            "row_name": "1",
+            "row_label": null,
+            "seat_number": "2",
+            "seat_label": null,
+            "seat_guid": "1d29fe20-8e1e-4984-b0ee-2773b0d07e07",
+            "product": 104,
+            "blocked": true,
+            "orderposition": {
+                "id": 134,
+                "order": {
+                    "code": "U0HW7",
+                    "event": "sampleconf"
+                },
+                "positionid": 1,
+                "item": 104,
+                "variation": 59,
+                "price": "60.00",
+                "attendee_name": "",
+                "attendee_name_parts": {
+                    "_scheme": "given_family"
+                },
+                "company": null,
+                "street": null,
+                "zipcode": null,
+                "city": null,
+                "country": null,
+                "state": null,
+                "discount": null,
+                "attendee_email": null,
+                "voucher": null,
+                "tax_rate": "0.00",
+                "tax_value": "0.00",
+                "secret": "4rfgp263jduratnsvwvy6cc6r6wnptbj",
+                "addon_to": null,
+                "subevent": null,
+                "checkins": [],
+                "downloads": [],
+                "answers": [],
+                "tax_rule": null,
+                "pseudonymization_id": "ZSNYSG3URZ",
+                "canceled": false,
+                "valid_from": null,
+                "valid_until": null,
+                "blocked": null,
+                "voucher_budget_use": null
+            },
+            "cartposition": null,
+            "voucher": null
+        }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param subevent_id: The ``id`` field of the subevent to fetch
+   :param id: The ``id`` field of the seat to fetch
+   :query string expand: If you pass ``"orderposition"``, ``"cartposition"``, or ``"voucher"``, the respective field will be
+                         shown as a nested value instead of just an ID. This requires permission to access that object.
+                         The nested objects are identical to the respective resources, except that order positions
+                         will have an attribute of the format ``"order": {"code": "ABCDE", "event": "eventslug"}`` to make
+                         matching easier, and won't include the `seat` attribute, as that would be redundant.
+                         The parameter can be given multiple times.
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+   :statuscode 404: Seat does not exist; or the endpoint without subevent id was used for event with subevents, or vice versa.
+
+.. http:patch:: /api/v1/organizers/(organizer)/events/(event)/seats/(id)/
+.. http:patch:: /api/v1/organizers/(organizer)/events/(event)/subevents/(id)/seats/(id)/
+
+   Update a seat.
+
+   You can only change the ``blocked`` field.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+        PATCH /api/v1/organizers/bigevents/events/sampleconf/seats/1636/ HTTP/1.1
+        Host: pretix.eu
+        Accept: application/json, text/javascript
+        Content-Type: application/json
+
+        {
+            "blocked": true
+        }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+        HTTP/1.1 200 OK
+        Vary: Accept
+        Content-Type: application/json
+
+        {
+            "id": 1636,
+            "subevent": null,
+            "zone_name": "Ground floor",
+            "row_name": "1",
+            "row_label": null,
+            "seat_number": "4",
+            "seat_label": null,
+            "seat_guid": "6c0e29e5-05d6-421f-99f3-afd01478ecad",
+            "product": 104,
+            "blocked": true,
+            "orderposition": null,
+            "cartposition": null,
+            "voucher": null
+        },
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param event: The ``slug`` field of the event to modify
+   :param subevent_id: The ``id`` field of the subevent to modify
+   :param id: The ``id`` field of the seat to modify
+   :statuscode 200: no error
+   :statuscode 400: The seat could not be modified due to invalid submitted data
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer or event does not exist **or** you have no permission to change this resource.
+   :statuscode 404: Seat does not exist; or the endpoint without subevent id was used for event with subevents, or vice versa.
@@ -1,6 +1,8 @@
 Scheduled email rules
 =====================

+This feature requires the bundled ``pretix.plugins.sendmail`` plugin to be active for the event in order to work properly.
+
 Resource description
 --------------------

@@ -48,6 +50,7 @@ send_to                               string                     Can be ``"order
                                                                 or ``"both"``.
                                                                 date. Otherwise it is relative to the event start date.
 ===================================== ========================== =======================================================
+
 .. versionchanged:: 2023.7

    The ``include_pending`` field has been  deprecated.
@@ -136,6 +136,7 @@ Endpoints
      }

   :query page: The page number in case of a multi-page result set, default is 1
+   :query is_public: If set to ``true``/``false``, only subevents with a matching value of ``is_public`` are returned.
   :query active: If set to ``true``/``false``, only events with a matching value of ``active`` are returned.
   :query is_future: If set to ``true`` (``false``), only events that happen currently or in the future are (not) returned.
   :query is_past: If set to ``true`` (``false``), only events that are over are (not) returned.
@@ -467,6 +468,7 @@ Endpoints
      }

   :query page: The page number in case of a multi-page result set, default is 1
+   :query is_public: If set to ``true``/``false``, only subevents with a matching value of ``is_public`` are returned.
   :query active: If set to ``true``/``false``, only events with a matching value of ``active`` are returned.
   :query event__live: If set to ``true``/``false``, only events with a matching value of ``live`` on the parent event are returned.
   :query is_future: If set to ``true`` (``false``), only events that happen currently or in the future are (not) returned.
@@ -20,8 +20,9 @@ internal_name                         string                     An optional nam
 rate                                  decimal (string)           Tax rate in percent
 price_includes_tax                    boolean                    If ``true`` (default), tax is assumed to be included in
                                                                 the specified product price
-eu_reverse_charge                     boolean                    If ``true``, EU reverse charge rules are applied. Will
-                                                                 be ignored if custom rules are set.
+eu_reverse_charge                     boolean                    **DEPRECATED**. If ``true``, EU reverse charge rules
+                                                                 are applied. Will be ignored if custom rules are set.
+                                                                 Use custom rules instead.
 home_country                          string                     Merchant country (required for reverse charge), can be
                                                                 ``null`` or empty string
 keep_gross_if_rate_changes            boolean                    If ``true``, changes of the tax rate based on custom
@@ -41,6 +41,7 @@ The following values for ``action_types`` are valid with pretix core:
    * ``pretix.event.order.modified``
    * ``pretix.event.order.contact.changed``
    * ``pretix.event.order.changed.*``
+    * ``pretix.event.order.deleted`` (can only occur for test mode orders)
    * ``pretix.event.order.refund.created``
    * ``pretix.event.order.refund.created.externally``
    * ``pretix.event.order.refund.requested``
@@ -115,6 +116,7 @@ Endpoints
      }

   :query integer page: The page number in case of a multi-page result set, default is 1
+   :query boolean enabled: Only show webhooks that are or are not enabled
   :param organizer: The ``slug`` field of the organizer to fetch
   :statuscode 200: no error
   :statuscode 401: Authentication failure
@@ -17,6 +17,7 @@ First, you need to declare that you are using non-essential cookies by respondin
 signal:

 .. automodule:: pretix.presale.signals
+   :no-index:
   :members: register_cookie_providers

 You are expected to return a list of ``CookieProvider`` objects instantiated from the following class:
@@ -14,7 +14,7 @@ Core
   :members: periodic_task, event_live_issues, event_copy_data, email_filter, register_notification_types, notification,
      item_copy_data, register_sales_channel_types, register_global_settings, quota_availability, global_email_filter,
      register_ticket_secret_generators, gift_card_transaction_display,
-      register_text_placeholders, register_mail_placeholders
+      register_text_placeholders, register_mail_placeholders, device_info_updated

 Order events
 """"""""""""
@@ -22,12 +22,14 @@ Order events
 There are multiple signals that will be sent out in the ordering cycle:

 .. automodule:: pretix.base.signals
+   :no-index:
   :members: validate_cart, validate_cart_addons, validate_order, order_valid_if_pending, order_fee_calculation, order_paid, order_placed, order_canceled, order_reactivated, order_expired, order_modified, order_changed, order_approved, order_denied, order_fee_type_name, allow_ticket_download, order_split, order_gracefully_delete, invoice_line_text

 Check-ins
 """""""""

 .. automodule:: pretix.base.signals
+   :no-index:
   :members: checkin_created


@@ -35,22 +37,25 @@ Frontend
 --------

 .. automodule:: pretix.presale.signals
-   :members: html_head, html_footer, footer_link, global_footer_link, front_page_top, front_page_bottom, front_page_bottom_widget, fee_calculation_for_cart, contact_form_fields, question_form_fields, contact_form_fields_overrides, question_form_fields_overrides, checkout_confirm_messages, checkout_confirm_page_content, checkout_all_optional, html_page_header, render_seating_plan, checkout_flow_steps, position_info, position_info_top, item_description, global_html_head, global_html_footer, global_html_page_header
+   :members: html_head, html_footer, footer_link, global_footer_link, front_page_top, front_page_bottom, front_page_bottom_widget, fee_calculation_for_cart, contact_form_fields, question_form_fields, contact_form_fields_overrides, question_form_fields_overrides, checkout_confirm_messages, checkout_confirm_page_content, checkout_all_optional, html_page_header, render_seating_plan, checkout_flow_steps, position_info, position_info_top, item_description, global_html_head, global_html_footer, global_html_page_header, seatingframe_html_head


 .. automodule:: pretix.presale.signals
-   :members: order_info, order_info_top, order_meta_from_request
+   :no-index:
+   :members: order_info, order_info_top, order_meta_from_request, order_api_meta_from_request

 Request flow
 """"""""""""

 .. automodule:: pretix.presale.signals
+   :no-index:
   :members: process_request, process_response

 Vouchers
 """"""""

 .. automodule:: pretix.presale.signals
+   :no-index:
   :members: voucher_redeem_info

 Backend
@@ -62,24 +67,28 @@ Backend
             item_formsets, order_search_filter_q, order_search_forms

 .. automodule:: pretix.base.signals
+   :no-index:
   :members: logentry_display, logentry_object_link, requiredaction_display, timeline_events, orderposition_blocked_display, customer_created, customer_signed_in

 Vouchers
 """"""""

 .. automodule:: pretix.control.signals
+   :no-index:
   :members: item_forms, voucher_form_class, voucher_form_html, voucher_form_validation

 Dashboards
 """"""""""

 .. automodule:: pretix.control.signals
+   :no-index:
   :members: event_dashboard_widgets, user_dashboard_widgets, event_dashboard_top

 Ticket designs
 """"""""""""""

 .. automodule:: pretix.base.signals
+   :no-index:
   :members: layout_text_variables, layout_image_variables

 .. automodule:: pretix.plugins.ticketoutputpdf.signals
@@ -89,4 +98,9 @@ API
 ---

 .. automodule:: pretix.base.signals
+   :no-index:
   :members: validate_event_settings, api_event_settings_fields
+
+.. automodule:: pretix.api.signals
+   :no-index:
+   :members: register_device_security_profile
@@ -60,6 +60,7 @@ that we'll provide in this plugin:
 Similar signals exist for other objects:

 .. automodule:: pretix.base.signals
+   :no-index:
   :members: voucher_import_columns


@@ -84,8 +84,6 @@ convenient to you:

   .. automethod:: _register_fonts

-   .. automethod:: _register_event_fonts
-
   .. automethod:: _on_first_page

   .. automethod:: _on_other_page
@@ -86,7 +86,10 @@ Signals
 -------

 .. automodule:: pretix.base.signals
+   :no-index:
   :members: register_text_placeholders
+
 .. automodule:: pretix.base.signals
+   :no-index:
   :members: register_mail_placeholders

@@ -17,7 +17,7 @@ The project pretix is split into several components. The main components are:
    create and manage their events, items, orders and tickets.

 **presale**
-    This is the ticket-shop itself, containing all of the parts visible to the
+    This is the ticket shop itself, containing all of the parts visible to the
    end user. Also called "frontend" in parts of this documentation.

 **api**
@@ -136,9 +136,7 @@ It is a good idea to put this command into your git hook ``.git/hooks/pre-commit
 for example, to check for any errors in any staged files when committing::

    #!/bin/bash
-    cd $GIT_DIR/../src
-    export GIT_WORK_TREE=../
-    export GIT_DIR=../.git
+
    source ../env/bin/activate  # Adjust to however you activate your virtual environment
    for file in $(git diff --cached --name-only | grep -E '\.py$' | grep -Ev "migrations|mt940\.py|pretix/settings\.py|make_testdata\.py|testutils/settings\.py|tests/settings\.py|pretix/base/models/__init__\.py|.*_pb2\.py")
    do
@@ -0,0 +1,105 @@
+GetYourGuide
+============
+
+.. note::
+
+    The GetYourGuide integration is currently in Beta. Please contact support@pretix.eu to enable the integration
+    for your pretix.eu organizer account.
+
+Introduction
+------------
+Using third party aggregators, such als GetYourGuide, event organizers can sell tickets to their events not only on
+their own ticket-shop but also on the aggregator's portal. While this service is not for free, it allows event
+organizers to reacher a larger audience that would otherwise not have found their way into the organizers webshop.
+
+Using pretix' integration with GetYourGuide, event organizers can profit from an additional sales and revenue channel,
+while keeping the effort for setting up and maintaining multiple ticket shops to a minimum.
+
+Preparing your organizer account
+--------------------------------
+The first step in enabling the GetYourGuide integration, is to setup a corresponding Sales Channel, which will be used
+to properly attribute the sales generated. This needs to be done only once per organizer account.
+
+To do so, log into the pretix backend, select ``Organizers`` from the navigation and then the organizer in question.
+Extending the ``Settings``-menu, find the ``Sales channels`` configuration and click the ``Add a new channel`` button.
+
+On the following page, you will be able to select ``GetYourGuide`` as the sales channel type and give it a custom name.
+
+Preparing your event
+--------------------
+In order to now sell your events on GetYourGuide, you will need to configure each event in question.
+
+1. Enabling the plugin
+    Within your event, extend the ``Settings`` menu and navigate to ``Plugins``. Activate the plugin in the
+    ``Integrations`` tab.
+
+2. Sell the event on the sales channel
+    Pick the sales channel or channels, on which you would like to sell your event by navigating to the event's general
+    settings page using the ``Sell on all sales channels`` or ``Restrict to specific sales channels`` checkboxes.
+
+3. Configure one or more products to be sold on GetYourGuide
+    Either create a new or edit an existing product, that you would like to sell on GetYourGuide. To do so, you will
+    need to have checked the ``Sell on all sales channels`` or appropriate ``Restrict to specific sales channels``
+    checkbox of the product within it's ``Availability`` tab.
+    In addition, you will also need to set the GetYourGuide equivalent ticket category in the product's accordingly
+    named settings tab. Within your event, there can be only one product per ticket category. Depending on your further
+    configuration, you must at least select one product to be in the ``Adult`` or ``Group`` category.
+
+4. Configuring the GetYourGuide-plugin
+    Once you have configured one or more products to be eligible to be sold on GetYourGuide, you'll need to configure a
+    few basic settings within the event (``Settings`` --> ``GetYourGuide``). The most important settings can be found
+    the in the ``Configuration`` tab, such as the location of the event on sale.
+
+Ticket Categories
+-----------------
+While pretix only uses the ticket category term loosely to group together multiple products for nicer display,
+GetYourGuide is relying on the ticket categories to price the tickets.
+
+First of all, you need to make the decision on how you are planning on selling your tickets on GetYourGuide - in most
+cases, this will reflect your current sales strategy within your pretix shop.
+
+- Individual tickets
+    Every single person attending will need to purchase their own ticket. A family of two adults and two
+    children will have to purchase and pay for a total of 4 tickets.
+    In this case, you will need to offer *at least* a ticket of the ``Adult`` type, but may offer any other ticket
+    category type (Child, Youth, Senior, ...) in addition. But you cannot offer a ``Group`` ticket.
+
+- Group tickets
+    Two groups, consisting of 10 and 20 participants respectively, won't need to purchase a total of 30 tickets, but
+    rather two group tickets. It is up to you to configure the group size limits within the GetYourGuide-settings of your
+    product.
+    Choosing this option, you cannot offer any other ticket categories besides ``Group``.
+
+Setting up event dates and quotas
+---------------------------------
+Of course, in addition to creating products, you will also need to add them to a quota for them to be available for
+sale. The process for doing this is the very same as for any regular event or event series.
+
+.. note::
+
+    When selling individual tickets through GetYourGuide, you will not be able to offer differing quantities for
+    individual ticket categories.
+
+For this reason, we recommend to place all GetYourGuide-eligible products into the same quota. Should you however opt
+to create multiple quotas which create an imbalance, pretix will report only the available number of tickets for the
+lowest relevant quota.
+
+Connecting your event to GetYourGuide
+-------------------------------------
+Once you have set up your event and products and performed all necessary configuration, you may want to use the
+Analyzer-feature of our GetYourGuide-plugin (``Settings`` -> ``GetYourGuide`` -> tab ``Analyzer``).
+
+The Analyzer should not display any blocking error messages and at least one event date that is ready for publishing on
+the GetYourGuide platform.
+
+At this point, you will need to setup your event (called ``product`` in the GetYourGuide universe) on their
+`Supplier Portal`_ and connect it with your pretix shop. To do so, please follow the
+`Connecting a new product to your Reservation System`_ on the GetYourGuide Supply Partner Help Center.
+
+Select ``pretix.eu`` as your reservation system; the required ``product ID`` can be found in the ``Configuration`` tab
+of the GetYourGuide plugin settings page.
+
+From this point on, GetYourGuide will automatically import the availabilities and products and offer them for sale.
+
+.. _Supplier Portal: https://suppliers.getyourguide.com/
+.. _Connecting a new product to your Reservation System: https://supply.getyourguide.support/hc/en-us/articles/18008029689373-Connecting-a-new-product-to-your-Reservation-system
@@ -25,3 +25,4 @@ If you want to **create** a plugin, please go to the
   webinar
   presale-saml
   kulturpass
+   getyourguide
@@ -1,5 +1,5 @@
 KulturPass
-=========
+==========

 .. note::

@@ -158,7 +158,7 @@ expects and - more importantly - supports.
    for a sample configuration in an academic context.

    Note, that you can have multiple attributes with the same ``friendlyName``
-    but different ``name``s. This is often used in systems, where the same
+    but different ``name`` value. This is often used in systems, where the same
    information (for example a persons name) is saved in different fields -
    for example because one institution is returning SAML 1.0 and other
    institutions are returning SAML 2.0 style attributes. Typically, this only
@@ -29,8 +29,8 @@ item_assignments                      list of objects            Products this l
 ===================================== ========================== =======================================================


-Endpoints
---------
+Layout endpoints
+----------------

 .. http:get:: /api/v1/organizers/(organizer)/events/(event)/ticketlayouts/

@@ -268,5 +268,75 @@ Endpoints
   :statuscode 401: Authentication failure
   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to delete this resource.

+Ticket rendering endpoint
+-----------------------------
+
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/ticketpdfrenderer/render_batch/
+
+   With this API call, you can instruct the system to render a set of tickets into one combined PDF file. To specify
+   which tickets to render, you need to submit a list of "parts". For every part, the following fields are supported:
+
+   * ``orderposition`` (``integer``, required): The ID of the order position to render.
+   * ``override_channel`` (``string``, optional): The sales channel ID to be used for layout selection instead of the
+     original channel of the order.
+   * ``override_layout`` (``integer``, optional): The ticket layout ID to be used instead of the auto-selected one.
+
+   If your input parameters validate correctly, a ``202 Accepted`` status code is returned.
+   The body points you to the download URL of the result. Running a ``GET`` request on that result URL will
+   yield one of the following status codes:
+
+    * ``200 OK`` – The export succeeded. The body will be your resulting file. Might be large!
+    * ``409 Conflict`` – Your export is still running. The body will be JSON with the structure ``{"status": "running"}``. ``status`` can be ``waiting`` before the task is actually being processed. Please retry, but wait at least one second before you do.
+    * ``410 Gone`` – Running the export has failed permanently. The body will be JSON with the structure ``{"status": "failed", "message": "Error message"}``
+    * ``404 Not Found`` – The export does not exist / is expired.
+
+   .. warning:: This endpoint is considered **experimental**. It might change at any time without prior notice.
+
+   .. note:: To avoid performance issues, a maximum number of 1000 parts is currently allowed.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/ticketpdfrenderer/render_batch/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+      {
+        "parts": [
+          {
+            "orderposition": 55412
+          },
+          {
+            "orderposition": 55412,
+            "override_channel": "web"
+          },
+          {
+            "orderposition": 55412,
+            "override_layout": 56
+          }
+        ]
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "download": "https://pretix.eu/api/v1/organizers/bigevents/events/sampleconf/ticketpdfrenderer/download/29891ede-196f-4942-9e26-d055a36e98b8/3f279f13-c198-4137-b49b-9b360ce9fcce/"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :statuscode 202: no error
+   :statuscode 400: Invalid input options
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+

 .. _here: https://github.com/pretix/pretix/blob/master/src/pretix/static/schema/pdf-layout.schema.json
@@ -1,4 +1,4 @@
-sphinx==7.3.*
+sphinx==7.4.*
 jinja2==3.1.*
 sphinx-rtd-theme
 sphinxcontrib-httpdomain
@@ -6,5 +6,4 @@ sphinxcontrib-images
 sphinxcontrib-jquery
 sphinxcontrib-spelling==8.*
 sphinxemoji
-pygments-markdown-lexer
 pyenchant==3.2.*
@@ -1,5 +1,5 @@
 -e ../
-sphinx==7.3.*
+sphinx==7.4.*
 jinja2==3.1.*
 sphinx-rtd-theme
 sphinxcontrib-httpdomain
@@ -7,5 +7,4 @@ sphinxcontrib-images
 sphinxcontrib-jquery
 sphinxcontrib-spelling==8.*
 sphinxemoji
-pygments-markdown-lexer
 pyenchant==3.2.*
@@ -31,8 +31,7 @@ Android 9                   Support planned until at least 12/2025.
 Android 8                   Support planned until at least 12/2025.
 Android 7                   Support planned until at least 06/2025.
 Android 6                   Support planned until at least 06/2025.
-Android 5                   | Support planned until at least 06/2025.
-                            | No support for COVID certificate verification.
+Android 5                   Support planned until at least 06/2025.
 Android 4                   Support dropped.
 =========================== ==========================================================

@@ -57,16 +56,17 @@ Android 8                   | Support planned until at least 12/2025.
 Android 7                   | Support planned until at least 12/2024.
                            | Support for Stripe Terminal to be dropped 05/2024.
                            | No support for Cryptovision TSE.
+                            | No support for SumUp.
 Android 6                   | Support planned until at least 12/2024.
                            | No support for Cryptovision TSE.
                            | No support for Fiskal Cloud.
                            | No support for Stripe Terminal.
+                            | No support for SumUp.
 Android 5                   | Support planned until at least 12/2024.
                            | No support for Cryptovision TSE.
                            | No support for Fiskal Cloud.
                            | No support for Stripe Terminal.
                            | No support for SumUp.
-                            | No support for COVID certificate verification.
 Android 4                   Support dropped.
 =========================== ==========================================================

@@ -87,9 +87,6 @@ Android 7                   Support planned until at least 06/2025.
 Android 6                   Support planned until at least 06/2025.
 Android 5                   | Support planned until at least 06/2025.
                            | No support for Evolis printers on some devices.
-Android 4.4                 | Support planned until at least 06/2024.
-                            | No support for USB printers.
-                            | No support for Evolis printers.
 Android 4                   Support dropped.
 =========================== ==========================================================

@@ -175,7 +175,7 @@ without any special behavior.
 Connecting SSO providers (pretix as the SSO client)
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

-To connect an external application as a SSO client, go to "Customer accounts" → "SSO providers" → "Create a new SSO provider"
+To connect an external application as a SSO provider, go to "Customer accounts" → "SSO providers" → "Create a new SSO provider"
 in your organizer account.

 .. thumbnail:: ../../screens/organizer/customer_ssoprovider_add.png
@@ -449,6 +449,29 @@ Further reading:

 * `Stripe Payment Method Domain registration`_

+
+Content Security Policy
+-----------------------
+
+When using a Content Security Policy (CSP) on your website, you may need to make some adjustments. If your pretix
+shop is running under a custom domain, you need to add the following rules:
+
+* ``script-src``: ``'unsafe-eval' https://pretix.eu`` (adjust to your domain for self-hosted pretix)
+* ``style-src``: ``https://pretix.eu`` (adjust to your domain for self-hosted pretix **and** for custom domain on pretix Hosted)
+* ``connect-src``: ``https://pretix.eu`` (adjust to your domain for self-hosted pretix **and** for custom domain on pretix Hosted)
+* ``frame-src``: ``https://pretix.eu`` (adjust to your domain for self-hosted pretix **and** for custom domain on pretix Hosted)
+* ``img-src``: ``https://pretix.eu`` (adjust to your domain for self-hosted pretix **and** for custom domain on pretix Hosted) and for pretix Hosted additionally add ``https://cdn.pretix.space``
+
+
+External payment providers and Cross-Origin-Opener-Policy
+---------------------------------------------------------
+
+If you use a payment provider that opens a new window during checkout (such as PayPal), be aware that setting
+``Cross-Origin-Opener-Policy: same-origin`` results in an empty popup-window being opened in the foreground. This is
+due to JavaScript not having access to the opened window. To mitigate this, you either need to always open the widget’s
+checkout in a new tab (see :ref:`Always open a new tab`) or set ``Cross-Origin-Opener-Policy: same-origin-allow-popups``
+
+
 Working with Cross-Origin-Embedder-Policy
 -----------------------------------------

@@ -22,29 +22,28 @@ classifiers = [
  "Programming Language :: Python :: 3.9",
  "Programming Language :: Python :: 3.10",
  "Programming Language :: Python :: 3.11",
-  "Framework :: Django :: 4.1",
+  "Framework :: Django :: 4.2",
 ]

 dependencies = [
  "arabic-reshaper==3.0.0",  # Support for Arabic in reportlab
  "babel",
  "BeautifulSoup4==4.12.*",
-  "bleach==5.0.*",
+  "bleach==6.2.*",
  "celery==5.4.*",
  "chardet==5.2.*",
  "cryptography>=3.4.2",
  "css-inline==0.14.*",
  "defusedcsv>=1.1.0",
-  "dj-static",
-  "Django[argon2]==4.2.*",
-  "django-bootstrap3==24.2",
-  "django-compressor==4.5",
+  "Django[argon2]==4.2.*,>=4.2.15",
+  "django-bootstrap3==24.3",
+  "django-compressor==4.5.1",
  "django-countries==7.6.*",
-  "django-filter==24.2",
+  "django-filter==24.3",
  "django-formset-js-improved==0.5.0.3",
  "django-formtools==2.5.1",
  "django-hierarkey==1.2.*",
-  "django-hijack==3.5.*",
+  "django-hijack==3.7.*",
  "django-i18nfield==1.9.*,>=1.9.4",
  "django-libsass==0.9",
  "django-localflavor==4.0",
@@ -56,16 +55,16 @@ dependencies = [
  "django-scopes==2.0.*",
  "django-statici18n==2.5.*",
  "djangorestframework==3.15.*",
-  "dnspython==2.6.*",
+  "dnspython==2.7.*",
  "drf_ujson2==1.7.*",
  "geoip2==4.*",
  "importlib_metadata==8.*",  # Polyfill, we can probably drop this once we require Python 3.10+
  "isoweek",
  "jsonschema",
-  "kombu==5.3.*",
+  "kombu==5.4.*",
  "libsass==0.23.*",
  "lxml",
-  "markdown==3.6",  # 3.3.5 requires importlib-metadata>=4.4, but django-bootstrap3 requires importlib-metadata<3.
+  "markdown==3.7",  # 3.3.5 requires importlib-metadata>=4.4, but django-bootstrap3 requires importlib-metadata<3.
  # We can upgrade markdown again once django-bootstrap3 upgrades or once we drop Python 3.6 and 3.7
  "mt-940==4.30.*",
  "oauthlib==3.2.*",
@@ -73,29 +72,27 @@ dependencies = [
  "packaging",
  "paypalrestsdk==1.13.*",
  "paypal-checkout-serversdk==1.0.*",
-  "PyJWT==2.8.*",
+  "PyJWT==2.9.*",
  "phonenumberslite==8.13.*",
-  "Pillow==10.3.*",
+  "Pillow==11.0.*",
  "pretix-plugin-build",
-  "protobuf==5.27.*",
+  "protobuf==5.28.*",
  "psycopg2-binary",
  "pycountry",
  "pycparser==2.22",
-  "pycryptodome==3.20.*",
-  "pypdf==4.2.*",
-  "python-bidi==0.4.*",  # Support for Arabic in reportlab
+  "pycryptodome==3.21.*",
+  "pypdf==5.1.*",
+  "python-bidi==0.6.*",  # Support for Arabic in reportlab
  "python-dateutil==2.9.*",
  "pytz",
  "pytz-deprecation-shim==0.1.*",
  "pyuca",
-  "qrcode==7.4.*",
-  "redis==5.0.*",
+  "qrcode==8.0",
+  "redis==5.2.*",
  "reportlab==4.2.*",
  "requests==2.31.*",
-  "sentry-sdk==2.5.*",
+  "sentry-sdk==2.18.*",
  "sepaxml==2.6.*",
-  "slimit",
-  "static3==0.7.*",
  "stripe==7.9.*",
  "text-unidecode==1.*",
  "tlds>=2020041600",
@@ -104,30 +101,29 @@ dependencies = [
  "vat_moss_forked==2020.3.20.0.11.0",
  "vobject==0.9.*",
  "webauthn==2.2.*",
-  "zeep==4.2.*"
+  "zeep==4.3.*"
 ]

 [project.optional-dependencies]
 memcached = ["pylibmc"]
 dev = [
-  "aiohttp==3.9.*",
+  "aiohttp==3.11.*",
  "coverage",
  "coveralls",
-  "fakeredis==2.23.*",
+  "fakeredis==2.26.*",
  "flake8==7.1.*",
  "freezegun",
  "isort==5.13.*",
  "pep8-naming==0.14.*",
  "potypo",
-  "pytest-asyncio",
+  "pytest-asyncio>=0.24",
  "pytest-cache",
  "pytest-cov",
  "pytest-django==4.*",
  "pytest-mock==3.14.*",
-  "pytest-rerunfailures==14.*",
  "pytest-sugar",
  "pytest-xdist==3.6.*",
-  "pytest==8.2.*",
+  "pytest==8.3.*",
  "responses",
 ]

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2024.7.0.dev0"
+__version__ = "2024.11.0.dev0"
@@ -62,6 +62,7 @@ INSTALLED_APPS = [
    'pretix.plugins.badges',
    'pretix.plugins.manualpayment',
    'pretix.plugins.returnurl',
+    'pretix.plugins.autocheckin',
    'pretix.plugins.webcheckin',
    'django_countries',
    'oauth2_provider',
@@ -79,6 +80,7 @@ ALL_LANGUAGES = [
    ('de', _('German')),
    ('de-informal', _('German (informal)')),
    ('ar', _('Arabic')),
+    ('eu', _('Basque')),
    ('ca', _('Catalan')),
    ('zh-hans', _('Chinese (simplified)')),
    ('zh-hant', _('Chinese (traditional)')),
@@ -27,7 +27,7 @@ from rest_framework import exceptions
 from rest_framework.authentication import TokenAuthentication

 from pretix.api.auth.devicesecurity import (
-    DEVICE_SECURITY_PROFILES, FullAccessSecurityProfile,
+    FullAccessSecurityProfile, get_all_security_profiles,
 )
 from pretix.base.models import Device

@@ -58,7 +58,8 @@ class DeviceTokenAuthentication(TokenAuthentication):
    def authenticate(self, request):
        r = super().authenticate(request)
        if r and isinstance(r[1], Device):
-            profile = DEVICE_SECURITY_PROFILES.get(r[1].security_profile, FullAccessSecurityProfile)
+            profiles = get_all_security_profiles()
+            profile = profiles.get(r[1].security_profile, FullAccessSecurityProfile())
            if not profile.is_allowed(request):
                raise exceptions.PermissionDenied('Request denied by device security profile.')
        return r
@@ -20,13 +20,40 @@
 # <https://www.gnu.org/licenses/>.
 #
 import logging
+from collections import OrderedDict

+from django.dispatch import receiver
 from django.utils.translation import gettext_lazy as _

+from pretix.api.signals import register_device_security_profile
+
 logger = logging.getLogger(__name__)
+_ALL_PROFILES = None


-class FullAccessSecurityProfile:
+class BaseSecurityProfile:
+    @property
+    def identifier(self) -> str:
+        """
+        Unique identifier for this profile.
+        """
+        raise NotImplementedError()
+
+    @property
+    def verbose_name(self) -> str:
+        """
+        Human-readable name (can be a ``gettext_lazy`` object).
+        """
+        raise NotImplementedError()
+
+    def is_allowed(self, request) -> bool:
+        """
+        Return whether a given request should be allowed.
+        """
+        raise NotImplementedError()
+
+
+class FullAccessSecurityProfile(BaseSecurityProfile):
    identifier = 'full'
    verbose_name = _('Full device access (reading and changing orders and gift cards, reading of products and settings)')

@@ -34,7 +61,7 @@ class FullAccessSecurityProfile:
        return True


-class AllowListSecurityProfile:
+class AllowListSecurityProfile(BaseSecurityProfile):
    allowlist = ()

    def is_allowed(self, request):
@@ -77,6 +104,7 @@ class PretixScanSecurityProfile(AllowListSecurityProfile):
        ('GET', 'api-v1:blockedsecrets-list'),
        ('GET', 'api-v1:order-list'),
        ('GET', 'api-v1:orderposition-pdf_image'),
+        ('POST', 'api-v1:orderposition-printlog'),
        ('GET', 'api-v1:event.settings'),
        ('POST', 'api-v1:upload'),
        ('POST', 'api-v1:checkinrpc.redeem'),
@@ -112,6 +140,7 @@ class PretixScanNoSyncNoSearchSecurityProfile(AllowListSecurityProfile):
        ('GET', 'api-v1:revokedsecrets-list'),
        ('GET', 'api-v1:blockedsecrets-list'),
        ('GET', 'api-v1:orderposition-pdf_image'),
+        ('POST', 'api-v1:orderposition-printlog'),
        ('GET', 'api-v1:event.settings'),
        ('POST', 'api-v1:upload'),
        ('POST', 'api-v1:checkinrpc.redeem'),
@@ -147,6 +176,7 @@ class PretixScanNoSyncSecurityProfile(AllowListSecurityProfile):
        ('GET', 'api-v1:revokedsecrets-list'),
        ('GET', 'api-v1:blockedsecrets-list'),
        ('GET', 'api-v1:orderposition-pdf_image'),
+        ('POST', 'api-v1:orderposition-printlog'),
        ('GET', 'api-v1:event.settings'),
        ('POST', 'api-v1:upload'),
        ('POST', 'api-v1:checkinrpc.redeem'),
@@ -154,87 +184,28 @@ class PretixScanNoSyncSecurityProfile(AllowListSecurityProfile):
    )


-class PretixPosSecurityProfile(AllowListSecurityProfile):
-    identifier = 'pretixpos'
-    verbose_name = _('pretixPOS')
-    allowlist = (
-        ('GET', 'api-v1:version'),
-        ('GET', 'api-v1:device.eventselection'),
-        ('GET', 'api-v1:idempotency.query'),
-        ('GET', 'api-v1:device.info'),
-        ('POST', 'api-v1:device.update'),
-        ('POST', 'api-v1:device.revoke'),
-        ('POST', 'api-v1:device.roll'),
-        ('GET', 'api-v1:event-list'),
-        ('GET', 'api-v1:event-detail'),
-        ('GET', 'api-v1:subevent-list'),
-        ('GET', 'api-v1:subevent-detail'),
-        ('GET', 'api-v1:itemcategory-list'),
-        ('GET', 'api-v1:item-list'),
-        ('GET', 'api-v1:question-list'),
-        ('GET', 'api-v1:quota-list'),
-        ('GET', 'api-v1:taxrule-list'),
-        ('GET', 'api-v1:ticketlayout-list'),
-        ('GET', 'api-v1:ticketlayoutitem-list'),
-        ('GET', 'api-v1:badgelayout-list'),
-        ('GET', 'api-v1:badgeitem-list'),
-        ('GET', 'api-v1:voucher-list'),
-        ('GET', 'api-v1:voucher-detail'),
-        ('GET', 'api-v1:order-list'),
-        ('POST', 'api-v1:order-list'),
-        ('GET', 'api-v1:order-detail'),
-        ('DELETE', 'api-v1:orderposition-detail'),
-        ('PATCH', 'api-v1:orderposition-detail'),
-        ('GET', 'api-v1:orderposition-list'),
-        ('GET', 'api-v1:orderposition-answer'),
-        ('GET', 'api-v1:orderposition-pdf_image'),
-        ('POST', 'api-v1:order-mark-canceled'),
-        ('POST', 'api-v1:orderpayment-list'),
-        ('POST', 'api-v1:orderrefund-list'),
-        ('POST', 'api-v1:orderrefund-done'),
-        ('POST', 'api-v1:cartposition-list'),
-        ('POST', 'api-v1:cartposition-bulk-create'),
-        ('GET', 'api-v1:checkinlist-list'),
-        ('POST', 'api-v1:checkinlistpos-redeem'),
-        ('POST', 'plugins:pretix_posbackend:order.posprintlog'),
-        ('POST', 'plugins:pretix_posbackend:order.poslock'),
-        ('DELETE', 'plugins:pretix_posbackend:order.poslock'),
-        ('DELETE', 'api-v1:cartposition-detail'),
-        ('GET', 'api-v1:giftcard-list'),
-        ('POST', 'api-v1:giftcard-transact'),
-        ('PATCH', 'api-v1:giftcard-detail'),
-        ('GET', 'plugins:pretix_posbackend:posclosing-list'),
-        ('POST', 'plugins:pretix_posbackend:posreceipt-list'),
-        ('POST', 'plugins:pretix_posbackend:posclosing-list'),
-        ('POST', 'plugins:pretix_posbackend:posdebugdump-list'),
-        ('POST', 'plugins:pretix_posbackend:posdebuglogentry-list'),
-        ('POST', 'plugins:pretix_posbackend:posdebuglogentry-bulk-create'),
-        ('GET', 'plugins:pretix_posbackend:poscashier-list'),
-        ('POST', 'plugins:pretix_posbackend:stripeterminal.token'),
-        ('POST', 'plugins:pretix_posbackend:stripeterminal.paymentintent'),
-        ('PUT', 'plugins:pretix_posbackend:file.upload'),
-        ('GET', 'api-v1:revokedsecrets-list'),
-        ('GET', 'api-v1:blockedsecrets-list'),
-        ('GET', 'api-v1:event.settings'),
-        ('GET', 'plugins:pretix_seating:event.event'),
-        ('GET', 'plugins:pretix_seating:event.event.subevent'),
-        ('GET', 'plugins:pretix_seating:event.plan'),
-        ('GET', 'plugins:pretix_seating:selection.simple'),
-        ('POST', 'api-v1:upload'),
-        ('POST', 'api-v1:checkinrpc.redeem'),
-        ('GET', 'api-v1:checkinrpc.search'),
-        ('POST', 'api-v1:reusablemedium-lookup'),
-        ('GET', 'api-v1:reusablemedium-list'),
-        ('POST', 'api-v1:reusablemedium-list'),
-    )
+def get_all_security_profiles():
+    global _ALL_PROFILES
+
+    if _ALL_PROFILES:
+        return _ALL_PROFILES
+
+    types = OrderedDict()
+    for recv, ret in register_device_security_profile.send(None):
+        if isinstance(ret, (list, tuple)):
+            for r in ret:
+                types[r.identifier] = r
+        else:
+            types[ret.identifier] = ret
+    _ALL_PROFILES = types
+    return types


-DEVICE_SECURITY_PROFILES = {
-    k.identifier: k() for k in (
-        FullAccessSecurityProfile,
-        PretixScanSecurityProfile,
-        PretixScanNoSyncSecurityProfile,
-        PretixScanNoSyncNoSearchSecurityProfile,
-        PretixPosSecurityProfile,
+@receiver(register_device_security_profile, dispatch_uid="base_register_default_security_profiles")
+def register_default_webhook_events(sender, **kwargs):
+    return (
+        FullAccessSecurityProfile(),
+        PretixScanSecurityProfile(),
+        PretixScanNoSyncSecurityProfile(),
+        PretixScanNoSyncNoSearchSecurityProfile(),
    )
-}
@@ -0,0 +1,82 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-2021 rami.io GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+from django import forms
+from django.core.exceptions import ValidationError
+from django.db.models import Q
+from django.db.models.constants import LOOKUP_SEP
+from django.forms import MultipleChoiceField
+from django_filters import Filter
+from django_filters.conf import settings
+
+
+class MultipleCharField(forms.CharField):
+    widget = forms.MultipleHiddenInput
+
+    def to_python(self, value):
+        if not value:
+            return []
+        elif not isinstance(value, (list, tuple)):
+            raise ValidationError(
+                MultipleChoiceField.default_error_messages["invalid_list"], code="invalid_list"
+            )
+        return [str(val) for val in value]
+
+
+class MultipleCharFilter(Filter):
+    """
+    This filter performs OR(by default) or AND(using conjoined=True) query
+    on the selected inputs.
+    """
+
+    field_class = MultipleCharField
+
+    def __init__(self, *args, **kwargs):
+        self.conjoined = kwargs.pop("conjoined", False)
+        super().__init__(*args, **kwargs)
+
+    def filter(self, qs, value):
+        if not value:
+            # Even though not a noop, no point filtering if empty.
+            return qs
+
+        if not self.conjoined:
+            q = Q()
+        for v in set(value):
+            predicate = self.get_filter_predicate(v)
+            if self.conjoined:
+                qs = self.get_method(qs)(**predicate)
+            else:
+                q |= Q(**predicate)
+
+        if not self.conjoined:
+            qs = self.get_method(qs)(q)
+
+        return qs.distinct() if self.distinct else qs
+
+    def get_filter_predicate(self, v):
+        name = self.field_name
+        if name and self.lookup_expr != settings.DEFAULT_LOOKUP_EXPR:
+            name = LOOKUP_SEP.join([name, self.lookup_expr])
+        try:
+            return {name: getattr(v, self.field.to_field_name)}
+        except (AttributeError, TypeError):
+            return {name: v}
@@ -21,8 +21,9 @@
 #
 import json

-from django.core.exceptions import ValidationError
+from django.db.models import prefetch_related_objects
 from rest_framework import serializers
+from rest_framework.exceptions import ValidationError


 class AsymmetricField(serializers.Field):
@@ -80,22 +81,27 @@ class SalesChannelMigrationMixin:

    def to_internal_value(self, data):
        if "sales_channels" in data:
+            prefetch_related_objects([self.organizer], "sales_channels")
            all_channels = {
                s.identifier for s in
                self.organizer.sales_channels.all()
            }

            if data.get("all_sales_channels") and set(data["sales_channels"]) != all_channels:
-                raise ValidationError(
-                    "If 'all_sales_channels' is set, the legacy attribute 'sales_channels' must not be set or set to "
-                    "the list of all sales channels."
-                )
+                raise ValidationError({
+                    "limit_sales_channels": [
+                        "If 'all_sales_channels' is set, the legacy attribute 'sales_channels' must not be set or set to "
+                        "the list of all sales channels."
+                    ]
+                })

            if data.get("limit_sales_channels") and set(data["sales_channels"]) != set(data["limit_sales_channels"]):
-                raise ValidationError(
-                    "If 'limit_sales_channels' is set, the legacy attribute 'sales_channels' must not be set or set to "
-                    "the same list."
-                )
+                raise ValidationError({
+                    "limit_sales_channels": [
+                        "If 'limit_sales_channels' is set, the legacy attribute 'sales_channels' must not be set or set to "
+                        "the same list."
+                    ]
+                })

            if data["sales_channels"] == all_channels:
                data["all_sales_channels"] = True
@@ -104,11 +110,16 @@ class SalesChannelMigrationMixin:
                data["all_sales_channels"] = False
                data["limit_sales_channels"] = data["sales_channels"]
            del data["sales_channels"]
+
+        if data.get("all_sales_channels"):
+            data["limit_sales_channels"] = []
+
        return super().to_internal_value(data)

    def to_representation(self, value):
        value = super().to_representation(value)
        if value.get("all_sales_channels"):
+            prefetch_related_objects([self.organizer], "sales_channels")
            value["sales_channels"] = sorted([
                s.identifier for s in
                self.organizer.sales_channels.all()
@@ -235,7 +235,7 @@ class CartPositionCreateSerializer(BaseCartPositionCreateSerializer):
        return cid

    def create(self, validated_data):
-        validated_data.pop('sales_channel')
+        validated_data.pop('sales_channel', None)
        addons_data = validated_data.pop('addons', None)
        bundled_data = validated_data.pop('bundled', None)

@@ -26,31 +26,22 @@ from rest_framework.exceptions import ValidationError
 from pretix.api.serializers.event import SubEventSerializer
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
 from pretix.base.media import MEDIA_TYPES
-from pretix.base.models import Checkin, CheckinList, SalesChannel
+from pretix.base.models import Checkin, CheckinList


 class CheckinListSerializer(I18nAwareModelSerializer):
    checkin_count = serializers.IntegerField(read_only=True)
    position_count = serializers.IntegerField(read_only=True)
-    auto_checkin_sales_channels = serializers.SlugRelatedField(
-        slug_field="identifier",
-        queryset=SalesChannel.objects.none(),
-        required=False,
-        allow_empty=True,
-        many=True,
-    )

    class Meta:
        model = CheckinList
        fields = ('id', 'name', 'all_products', 'limit_products', 'subevent', 'checkin_count', 'position_count',
-                  'include_pending', 'auto_checkin_sales_channels', 'allow_multiple_entries', 'allow_entry_after_exit',
+                  'include_pending', 'allow_multiple_entries', 'allow_entry_after_exit',
                  'rules', 'exit_all_at', 'addon_match', 'ignore_in_statistics', 'consider_tickets_used')

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)

-        self.fields['auto_checkin_sales_channels'].child_relation.queryset = self.context['event'].organizer.sales_channels.all()
-
        if 'subevent' in self.context['request'].query_params.getlist('expand'):
            self.fields['subevent'] = SubEventSerializer(read_only=True)

@@ -35,7 +35,7 @@
 import logging

 from django.conf import settings
-from django.core.exceptions import ValidationError
+from django.core.exceptions import PermissionDenied, ValidationError
 from django.db import transaction
 from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
@@ -52,7 +52,8 @@ from pretix.api.serializers import (
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
 from pretix.api.serializers.settings import SettingsSerializer
 from pretix.base.models import (
-    Device, Event, SalesChannel, TaxRule, TeamAPIToken,
+    CartPosition, Device, Event, OrderPosition, SalesChannel, Seat, TaxRule,
+    TeamAPIToken, Voucher,
 )
 from pretix.base.models.event import SubEvent
 from pretix.base.models.items import (
@@ -281,13 +282,17 @@ class EventSerializer(SalesChannelMigrationMixin, I18nAwareModelSerializer):
        from pretix.base.plugins import get_all_plugins

        plugins_available = {
-            p.module for p in get_all_plugins(self.instance)
+            p.module: p for p in get_all_plugins(self.instance)
            if not p.name.startswith('.') and getattr(p, 'visible', True)
        }
+        settings_holder = self.instance if self.instance and self.instance.pk else self.context['organizer']

        for plugin in value.get('plugins'):
            if plugin not in plugins_available:
                raise ValidationError(_('Unknown plugin: \'{name}\'.').format(name=plugin))
+            if getattr(plugins_available[plugin], 'restricted', False):
+                if plugin not in settings_holder.settings.allowed_restricted_plugins:
+                    raise ValidationError(_('Restricted plugin: \'{name}\'.').format(name=plugin))

        return value

@@ -767,6 +772,7 @@ class EventSettingsSerializer(SettingsSerializer):
        'invoice_address_company_required',
        'invoice_address_beneficiary',
        'invoice_address_custom_field',
+        'invoice_address_custom_field_helptext',
        'invoice_name_required',
        'invoice_address_not_asked_free',
        'invoice_show_payments',
@@ -840,6 +846,7 @@ class EventSettingsSerializer(SettingsSerializer):
        'reusable_media_type_nfc_mf0aes_autocreate_giftcard',
        'reusable_media_type_nfc_mf0aes_autocreate_giftcard_currency',
        'reusable_media_type_nfc_mf0aes_random_uid',
+        'seating_allow_blocked_seats_for_channel',
    ]
    readonly_fields = [
        # These are read-only since they are currently only settable on organizers, not events
@@ -890,6 +897,7 @@ class DeviceEventSettingsSerializer(EventSettingsSerializer):
        'locale',
        'last_order_modification_date',
        'show_quota_left',
+        'show_dates_on_frontpage',
        'max_items_per_order',
        'attendee_names_asked',
        'attendee_names_required',
@@ -909,6 +917,7 @@ class DeviceEventSettingsSerializer(EventSettingsSerializer):
        'invoice_address_company_required',
        'invoice_address_beneficiary',
        'invoice_address_custom_field',
+        'invoice_address_custom_field_helptext',
        'invoice_name_required',
        'invoice_address_not_asked_free',
        'invoice_address_from_name',
@@ -965,3 +974,77 @@ class ItemMetaPropertiesSerializer(I18nAwareModelSerializer):
    class Meta:
        model = ItemMetaProperty
        fields = ('id', 'name', 'default', 'required', 'allowed_values')
+
+
+def prefetch_by_id(items, qs, id_attr, target_attr):
+    """
+    Prefetches a related object on each item in the given list of items by searching by id or another
+    unique field. The id value is read from the attribute on item specified in `id_attr`, searched on queryset `qs` by
+    the primary key, and the resulting prefetched model object is stored into `target_attr` on the item.
+    """
+    ids = [getattr(item, id_attr) for item in items if getattr(item, id_attr)]
+    if ids:
+        result = qs.in_bulk(id_list=ids)
+        for item in items:
+            setattr(item, target_attr, result.get(getattr(item, id_attr)))
+
+
+class SeatSerializer(I18nAwareModelSerializer):
+    orderposition = serializers.IntegerField(source='orderposition_id')
+    cartposition = serializers.IntegerField(source='cartposition_id')
+    voucher = serializers.IntegerField(source='voucher_id')
+
+    class Meta:
+        model = Seat
+        read_only_fields = (
+            'id', 'subevent', 'zone_name', 'row_name', 'row_label',
+            'seat_number', 'seat_label', 'seat_guid', 'product',
+            'orderposition', 'cartposition', 'voucher',
+        )
+        fields = (
+            'id', 'subevent', 'zone_name', 'row_name', 'row_label',
+            'seat_number', 'seat_label', 'seat_guid', 'product', 'blocked',
+            'orderposition', 'cartposition', 'voucher',
+        )
+
+    def prefetch_expanded_data(self, items, request, expand_fields):
+        if 'orderposition' in expand_fields:
+            if 'can_view_orders' not in request.eventpermset:
+                raise PermissionDenied('can_view_orders permission required for expand=orderposition')
+            prefetch_by_id(items, OrderPosition.objects.prefetch_related('order'), 'orderposition_id', 'orderposition')
+        if 'cartposition' in expand_fields:
+            if 'can_view_orders' not in request.eventpermset:
+                raise PermissionDenied('can_view_orders permission required for expand=cartposition')
+            prefetch_by_id(items, CartPosition.objects, 'cartposition_id', 'cartposition')
+        if 'voucher' in expand_fields:
+            if 'can_view_vouchers' not in request.eventpermset:
+                raise PermissionDenied('can_view_vouchers permission required for expand=voucher')
+            prefetch_by_id(items, Voucher.objects, 'voucher_id', 'voucher')
+
+    def __init__(self, instance, *args, **kwargs):
+        if not kwargs.get('data'):
+            self.prefetch_expanded_data(instance if hasattr(instance, '__iter__') else [instance],
+                                        kwargs['context']['request'],
+                                        kwargs['context']['expand_fields'])
+
+        super().__init__(instance, *args, **kwargs)
+
+        if 'orderposition' in self.context['expand_fields']:
+            from pretix.api.serializers.media import (
+                NestedOrderPositionSerializer,
+            )
+            self.fields['orderposition'] = NestedOrderPositionSerializer(read_only=True, context=self.context['order_context'])
+            try:
+                del self.fields['orderposition'].fields['seat']
+            except KeyError:
+                pass
+
+        if 'cartposition' in self.context['expand_fields']:
+            from pretix.api.serializers.cart import CartPositionSerializer
+            self.fields['cartposition'] = CartPositionSerializer(read_only=True)
+            del self.fields['cartposition'].fields['seat']
+
+        if 'voucher' in self.context['expand_fields']:
+            from pretix.api.serializers.voucher import VoucherSerializer
+            self.fields['voucher'] = VoucherSerializer(read_only=True)
+            del self.fields['voucher'].fields['seat']
@@ -76,7 +76,9 @@ class InlineItemVariationSerializer(SalesChannelMigrationMixin, I18nAwareModelSe
    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self.fields['require_membership_types'].queryset = lazy(lambda: self.context['event'].organizer.membership_types.all(), QuerySet)
-        self.fields['limit_sales_channels'].child_relation.queryset = lazy(lambda: self.context['event'].organizer.sales_channels.all(), QuerySet)
+        self.fields['limit_sales_channels'].child_relation.queryset = (
+            self.context['event'].organizer.sales_channels.all() if 'event' in self.context else SalesChannel.objects.none()
+        )

    def validate_meta_data(self, value):
        for key in value['meta_data'].keys():
@@ -115,11 +117,15 @@ class ItemVariationSerializer(SalesChannelMigrationMixin, I18nAwareModelSerializ
    def create(self, validated_data):
        meta_data = validated_data.pop('meta_data', None)
        require_membership_types = validated_data.pop('require_membership_types', [])
+        limit_sales_channels = validated_data.pop('limit_sales_channels', [])
        variation = ItemVariation.objects.create(**validated_data)

        if require_membership_types:
            variation.require_membership_types.add(*require_membership_types)

+        if limit_sales_channels:
+            variation.limit_sales_channels.add(*limit_sales_channels)
+
        # Meta data
        if meta_data is not None:
            for key, value in meta_data.items():
@@ -284,6 +290,7 @@ class ItemSerializer(SalesChannelMigrationMixin, I18nAwareModelSerializer):
            self.fields['require_membership_types'].queryset = self.context['event'].organizer.membership_types.all()
            self.fields['grant_membership_type'].queryset = self.context['event'].organizer.membership_types.all()
            self.fields['limit_sales_channels'].child_relation.queryset = self.context['event'].organizer.sales_channels.all()
+            self.fields['variations'].child.fields['limit_sales_channels'].child_relation.queryset = self.context['event'].organizer.sales_channels.all()

    def validate(self, data):
        data = super().validate(data)
@@ -362,7 +369,7 @@ class ItemSerializer(SalesChannelMigrationMixin, I18nAwareModelSerializer):
        require_membership_types = validated_data.pop('require_membership_types', [])
        limit_sales_channels = validated_data.pop('limit_sales_channels', [])
        item = Item.objects.create(**validated_data)
-        if limit_sales_channels:
+        if limit_sales_channels and not validated_data.get('all_sales_channels'):
            item.limit_sales_channels.add(*limit_sales_channels)
        if picture:
            item.picture.save(os.path.basename(picture.name), picture)
@@ -371,10 +378,13 @@ class ItemSerializer(SalesChannelMigrationMixin, I18nAwareModelSerializer):

        for variation_data in variations_data:
            require_membership_types = variation_data.pop('require_membership_types', [])
+            limit_sales_channels = variation_data.pop('limit_sales_channels', [])
            var_meta_data = variation_data.pop('meta_data', {})
            v = ItemVariation.objects.create(item=item, **variation_data)
            if require_membership_types:
                v.require_membership_types.add(*require_membership_types)
+            if limit_sales_channels:
+                v.limit_sales_channels.add(*limit_sales_channels)

            if var_meta_data is not None:
                for key, value in var_meta_data.items():
@@ -431,7 +441,22 @@ class ItemCategorySerializer(I18nAwareModelSerializer):

    class Meta:
        model = ItemCategory
-        fields = ('id', 'name', 'internal_name', 'description', 'position', 'is_addon')
+        fields = (
+            'id', 'name', 'internal_name', 'description', 'position',
+            'is_addon', 'cross_selling_mode',
+            'cross_selling_condition', 'cross_selling_match_products'
+        )
+
+    def validate(self, data):
+        data = super().validate(data)
+
+        full_data = self.to_internal_value(self.to_representation(self.instance)) if self.instance else {}
+        full_data.update(data)
+
+        if full_data.get('is_addon') and full_data.get('cross_selling_mode'):
+            raise ValidationError('is_addon and cross_selling_mode are mutually exclusive')
+
+        return data


 class QuestionOptionSerializer(I18nAwareModelSerializer):
@@ -55,7 +55,7 @@ from pretix.base.models import (
 )
 from pretix.base.models.orders import (
    BlockedTicketSecret, CartPosition, OrderFee, OrderPayment, OrderRefund,
-    RevokedTicketSecret,
+    PrintLog, RevokedTicketSecret,
 )
 from pretix.base.pdf import get_images, get_variables
 from pretix.base.services.cart import error_messages
@@ -165,7 +165,7 @@ class InlineSeatSerializer(I18nAwareModelSerializer):

    class Meta:
        model = Seat
-        fields = ('id', 'name', 'seat_guid')
+        fields = ('id', 'name', 'seat_guid', 'zone_name', 'row_name', 'row_label', 'seat_label', 'seat_number')


 class AnswerSerializer(I18nAwareModelSerializer):
@@ -273,9 +273,35 @@ class AnswerSerializer(I18nAwareModelSerializer):


 class CheckinSerializer(I18nAwareModelSerializer):
+    device_id = serializers.SlugRelatedField(
+        source='device',
+        slug_field='device_id',
+        read_only=True,
+    )
+
    class Meta:
        model = Checkin
-        fields = ('id', 'datetime', 'list', 'auto_checked_in', 'gate', 'device', 'type')
+        fields = ('id', 'datetime', 'list', 'auto_checked_in', 'gate', 'device', 'device_id', 'type')
+
+
+class PrintLogSerializer(serializers.ModelSerializer):
+    device_id = serializers.SlugRelatedField(
+        source='device',
+        slug_field='device_id',
+        read_only=True,
+    )
+
+    class Meta:
+        model = PrintLog
+        fields = (
+            "id",
+            "successful",
+            "datetime",
+            "source",
+            "type",
+            "device_id",
+            "info",
+        )


 class FailedCheckinSerializer(I18nAwareModelSerializer):
@@ -470,6 +496,7 @@ class OrderPositionListSerializer(serializers.ListSerializer):

 class OrderPositionSerializer(I18nAwareModelSerializer):
    checkins = CheckinSerializer(many=True, read_only=True)
+    print_logs = PrintLogSerializer(many=True, read_only=True)
    answers = AnswerSerializer(many=True)
    downloads = PositionDownloadsField(source='*', read_only=True)
    order = serializers.SlugRelatedField(slug_field='code', read_only=True)
@@ -484,7 +511,7 @@ class OrderPositionSerializer(I18nAwareModelSerializer):
        fields = ('id', 'order', 'positionid', 'item', 'variation', 'price', 'attendee_name', 'attendee_name_parts',
                  'company', 'street', 'zipcode', 'city', 'country', 'state', 'discount',
                  'attendee_email', 'voucher', 'tax_rate', 'tax_value', 'secret', 'addon_to', 'subevent', 'checkins',
-                  'downloads', 'answers', 'tax_rule', 'pseudonymization_id', 'pdf_data', 'seat', 'canceled',
+                  'print_logs', 'downloads', 'answers', 'tax_rule', 'pseudonymization_id', 'pdf_data', 'seat', 'canceled',
                  'valid_from', 'valid_until', 'blocked', 'voucher_budget_use')
        read_only_fields = (
            'id', 'order', 'positionid', 'item', 'variation', 'price', 'voucher', 'tax_rate', 'tax_value', 'secret',
@@ -571,9 +598,9 @@ class CheckinListOrderPositionSerializer(OrderPositionSerializer):
        fields = ('id', 'order', 'positionid', 'item', 'variation', 'price', 'attendee_name', 'attendee_name_parts',
                  'company', 'street', 'zipcode', 'city', 'country', 'state',
                  'attendee_email', 'voucher', 'tax_rate', 'tax_value', 'secret', 'addon_to', 'subevent', 'checkins',
-                  'downloads', 'answers', 'tax_rule', 'pseudonymization_id', 'pdf_data', 'seat', 'require_attention',
-                  'order__status', 'order__valid_if_pending', 'order__require_approval', 'valid_from', 'valid_until',
-                  'blocked')
+                  'print_logs', 'downloads', 'answers', 'tax_rule', 'pseudonymization_id', 'pdf_data', 'seat',
+                  'require_attention', 'order__status', 'order__valid_if_pending', 'order__require_approval',
+                  'valid_from', 'valid_until', 'blocked')

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
@@ -585,7 +612,7 @@ class CheckinListOrderPositionSerializer(OrderPositionSerializer):
            self.fields['item'] = ItemSerializer(read_only=True, context=self.context)

        if 'variation' in self.context['expand']:
-            self.fields['variation'] = InlineItemVariationSerializer(read_only=True)
+            self.fields['variation'] = InlineItemVariationSerializer(read_only=True, context=self.context)

        if 'answers.question' in self.context['expand']:
            self.fields['answers'].child.fields['question'] = QuestionSerializer(read_only=True)
@@ -726,12 +753,12 @@ class OrderSerializer(I18nAwareModelSerializer):
            'code', 'event', 'status', 'testmode', 'secret', 'email', 'phone', 'locale', 'datetime', 'expires', 'payment_date',
            'payment_provider', 'fees', 'total', 'comment', 'custom_followup_at', 'invoice_address', 'positions', 'downloads',
            'checkin_attention', 'checkin_text', 'last_modified', 'payments', 'refunds', 'require_approval', 'sales_channel',
-            'url', 'customer', 'valid_if_pending'
+            'url', 'customer', 'valid_if_pending', 'api_meta', 'cancellation_date'
        )
        read_only_fields = (
            'code', 'status', 'testmode', 'secret', 'datetime', 'expires', 'payment_date',
            'payment_provider', 'fees', 'total', 'positions', 'downloads', 'customer',
-            'last_modified', 'payments', 'refunds', 'require_approval', 'sales_channel'
+            'last_modified', 'payments', 'refunds', 'require_approval', 'sales_channel', 'cancellation_date'
        )

    def __init__(self, *args, **kwargs):
@@ -786,7 +813,7 @@ class OrderSerializer(I18nAwareModelSerializer):
        # Even though all fields that shouldn't be edited are marked as read_only in the serializer
        # (hopefully), we'll be extra careful here and be explicit about the model fields we update.
        update_fields = ['comment', 'custom_followup_at', 'checkin_attention', 'checkin_text', 'email', 'locale',
-                         'phone', 'valid_if_pending']
+                         'phone', 'valid_if_pending', 'api_meta']

        if 'invoice_address' in validated_data:
            iadata = validated_data.pop('invoice_address')
@@ -1059,7 +1086,7 @@ class OrderCreateSerializer(I18nAwareModelSerializer):
        fields = ('code', 'status', 'testmode', 'email', 'phone', 'locale', 'payment_provider', 'fees', 'comment', 'sales_channel',
                  'invoice_address', 'positions', 'checkin_attention', 'checkin_text', 'payment_info', 'payment_date',
                  'consume_carts', 'force', 'send_email', 'simulate', 'customer', 'custom_followup_at',
-                  'require_approval', 'valid_if_pending', 'expires')
+                  'require_approval', 'valid_if_pending', 'expires', 'api_meta')

    def validate_payment_provider(self, pp):
        if pp is None:
@@ -1488,6 +1515,7 @@ class OrderCreateSerializer(I18nAwareModelSerializer):
                pos.answers = answers
                pos.pseudonymization_id = "PREVIEW"
                pos.checkins = []
+                pos.print_logs = []
                pos_map[pos.positionid] = pos
            else:
                if pos.voucher:
@@ -29,6 +29,7 @@ from django.utils.translation import gettext_lazy as _
 from rest_framework import serializers
 from rest_framework.exceptions import ValidationError

+from pretix.api.auth.devicesecurity import get_all_security_profiles
 from pretix.api.serializers import AsymmetricField
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
 from pretix.api.serializers.order import CompatibleJSONField
@@ -297,6 +298,7 @@ class DeviceSerializer(serializers.ModelSerializer):
    revoked = serializers.BooleanField(read_only=True)
    initialized = serializers.DateTimeField(read_only=True)
    initialization_token = serializers.DateTimeField(read_only=True)
+    security_profile = serializers.ChoiceField(choices=[], required=False, default="full")

    class Meta:
        model = Device
@@ -306,6 +308,10 @@ class DeviceSerializer(serializers.ModelSerializer):
            'os_name', 'os_version', 'software_brand', 'software_version', 'security_profile'
        )

+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['security_profile'].choices = [(k, v.verbose_name) for k, v in get_all_security_profiles().items()]
+

 class TeamInviteSerializer(serializers.ModelSerializer):
    class Meta:
@@ -32,10 +32,17 @@ from pretix.helpers.periodic import minimum_interval
 register_webhook_events = Signal()
 """
 This signal is sent out to get all known webhook events. Receivers should return an
-instance of a subclass of pretix.api.webhooks.WebhookEvent or a list of such
+instance of a subclass of ``pretix.api.webhooks.WebhookEvent`` or a list of such
 instances.
 """

+register_device_security_profile = Signal()
+"""
+This signal is sent out to get all known device security_profiles. Receivers should
+return an instance of a subclass of ``pretix.api.auth.devicesecurity.BaseSecurityProfile``
+or a list of such instances.
+"""
+

@receiver(periodic_task)
@scopes_disabled()
@@ -87,6 +87,7 @@ event_router.register(r'invoices', order.InvoiceViewSet)
 event_router.register(r'revokedsecrets', order.RevokedSecretViewSet, basename='revokedsecrets')
 event_router.register(r'blockedsecrets', order.BlockedSecretViewSet, basename='blockedsecrets')
 event_router.register(r'taxrules', event.TaxRuleViewSet)
+event_router.register(r'seats', event.SeatViewSet)
 event_router.register(r'waitinglistentries', waitinglist.WaitingListViewSet)
 event_router.register(r'checkinlists', checkin.CheckinListViewSet)
 event_router.register(r'cartpositions', cart.CartPositionViewSet)
@@ -95,6 +96,9 @@ event_router.register(r'exporters', exporters.EventExportersViewSet, basename='e
 event_router.register(r'shredders', shredders.EventShreddersViewSet, basename='shredders')
 event_router.register(r'item_meta_properties', event.ItemMetaPropertiesViewSet)

+subevent_router = routers.DefaultRouter()
+subevent_router.register(r'seats', event.SeatViewSet)
+
 checkinlist_router = routers.DefaultRouter()
 checkinlist_router.register(r'positions', checkin.CheckinListPositionViewSet, basename='checkinlistpos')

@@ -132,6 +136,7 @@ urlpatterns = [
    re_path(r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/settings/$', event.EventSettingsView.as_view(),
            name="event.settings"),
    re_path(r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/', include(event_router.urls)),
+    re_path(r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/subevents/(?P<subevent>\d+)/', include(subevent_router.urls)),
    re_path(r'^organizers/(?P<organizer>[^/]+)/teams/(?P<team>[^/]+)/', include(team_router.urls)),
    re_path(r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/items/(?P<item>[^/]+)/', include(item_router.urls)),
    re_path(r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/questions/(?P<question>[^/]+)/',
@@ -62,6 +62,7 @@ from pretix.base.models import (
    CachedFile, Checkin, CheckinList, Device, Event, Order, OrderPosition,
    Question, ReusableMedium, RevokedTicketSecret, TeamAPIToken,
 )
+from pretix.base.models.orders import PrintLog
 from pretix.base.services.checkin import (
    CheckInError, RequiredQuestionsError, SQLLogic, perform_checkin,
 )
@@ -115,7 +116,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
        if 'subevent' in self.request.query_params.getlist('expand'):
            qs = qs.prefetch_related(
                'subevent', 'subevent__event', 'subevent__subeventitem_set', 'subevent__subeventitemvariation_set',
-                'subevent__seat_category_mappings', 'subevent__meta_values', 'auto_checkin_sales_channels'
+                'subevent__seat_category_mappings', 'subevent__meta_values',
            )
        return qs

@@ -142,7 +143,9 @@ class CheckinListViewSet(viewsets.ModelViewSet):
            data=self.request.data
        )

+    @transaction.atomic
    def perform_destroy(self, instance):
+        instance.checkins.all().delete()
        instance.log_action(
            'pretix.event.checkinlist.deleted',
            user=self.request.user,
@@ -365,8 +368,9 @@ def _checkin_list_position_queryset(checkinlists, ignore_status=False, ignore_pr
        qs = qs.prefetch_related(
            Prefetch(
                lookup='checkins',
-                queryset=Checkin.objects.filter(list_id__in=[cl.pk for cl in checkinlists])
+                queryset=Checkin.objects.filter(list_id__in=[cl.pk for cl in checkinlists]).select_related('device')
            ),
+            Prefetch('print_logs', queryset=PrintLog.objects.select_related('device')),
            'answers', 'answers__options', 'answers__question',
            Prefetch('addons', OrderPosition.objects.select_related('item', 'variation')),
            Prefetch('order', Order.objects.select_related('invoice_address').prefetch_related(
@@ -377,7 +381,8 @@ def _checkin_list_position_queryset(checkinlists, ignore_status=False, ignore_pr
                Prefetch(
                    'positions',
                    OrderPosition.objects.prefetch_related(
-                        Prefetch('checkins', queryset=Checkin.objects.all()),
+                        Prefetch('checkins', queryset=Checkin.objects.select_related('device')),
+                        Prefetch('print_logs', queryset=PrintLog.objects.select_related('device')),
                        'item', 'variation', 'answers', 'answers__options', 'answers__question',
                    )
                )
@@ -389,8 +394,9 @@ def _checkin_list_position_queryset(checkinlists, ignore_status=False, ignore_pr
        qs = qs.prefetch_related(
            Prefetch(
                lookup='checkins',
-                queryset=Checkin.objects.filter(list_id__in=[cl.pk for cl in checkinlists])
+                queryset=Checkin.objects.filter(list_id__in=[cl.pk for cl in checkinlists]).select_related('device')
            ),
+            Prefetch('print_logs', queryset=PrintLog.objects.select_related('device')),
            'answers', 'answers__options', 'answers__question',
            Prefetch('addons', OrderPosition.objects.select_related('item', 'variation'))
        ).select_related('item', 'variation', 'order', 'addon_to', 'order__invoice_address', 'order', 'seat')
@@ -406,7 +412,7 @@ def _checkin_list_position_queryset(checkinlists, ignore_status=False, ignore_pr
                                 'item__variations').select_related('item__tax_rule')

    if expand and 'variation' in expand:
-        qs = qs.prefetch_related('variation')
+        qs = qs.prefetch_related('variation', 'variation__meta_values')

    return qs

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 import base64
+import copy
 import logging

 from cryptography.hazmat.backends.openssl.backend import Backend
@@ -146,6 +147,8 @@ class InitializeView(APIView):
    permission_classes = ()

    def post(self, request, format=None):
+        from pretix.base.signals import device_info_updated
+
        serializer = InitializationRequestSerializer(data=request.data)
        serializer.is_valid(raise_exception=True)

@@ -160,6 +163,8 @@ class InitializeView(APIView):
        if device.revoked:
            raise ValidationError({'token': ['This initialization token has been revoked.']})

+        old_instance = copy.copy(device)
+
        device.initialized = now()
        device.hardware_brand = serializer.validated_data.get('hardware_brand')
        device.hardware_model = serializer.validated_data.get('hardware_model')
@@ -174,6 +179,10 @@ class InitializeView(APIView):

        device.log_action('pretix.device.initialized', data=serializer.validated_data, auth=device)

+        device_info_updated.send(
+            sender=Device, old_device=old_instance, new_device=device
+        )
+
        serializer = DeviceSerializer(device)
        return Response(serializer.data)

@@ -182,9 +191,12 @@ class UpdateView(APIView):
    authentication_classes = (DeviceTokenAuthentication,)

    def post(self, request, format=None):
+        from pretix.base.signals import device_info_updated
+
        serializer = UpdateRequestSerializer(data=request.data)
        serializer.is_valid(raise_exception=True)
        device = request.auth
+        old_instance = copy.copy(device)
        device.hardware_brand = serializer.validated_data.get('hardware_brand')
        device.hardware_model = serializer.validated_data.get('hardware_model')
        device.os_name = serializer.validated_data.get('os_name')
@@ -200,6 +212,10 @@ class UpdateView(APIView):
        device.save()
        device.log_action('pretix.device.updated', data=serializer.validated_data, auth=device)

+        device_info_updated.send(
+            sender=Device, old_device=old_instance, new_device=device
+        )
+
        serializer = DeviceSerializer(device)
        return Response(serializer.data)

@@ -40,19 +40,22 @@ from django.utils.timezone import now
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
 from rest_framework import serializers, views, viewsets
-from rest_framework.exceptions import PermissionDenied, ValidationError
+from rest_framework.exceptions import (
+    NotFound, PermissionDenied, ValidationError,
+)
+from rest_framework.generics import get_object_or_404
 from rest_framework.response import Response

 from pretix.api.auth.permission import EventCRUDPermission
 from pretix.api.pagination import TotalOrderingFilter
 from pretix.api.serializers.event import (
    CloneEventSerializer, DeviceEventSettingsSerializer, EventSerializer,
-    EventSettingsSerializer, ItemMetaPropertiesSerializer, SubEventSerializer,
-    TaxRuleSerializer,
+    EventSettingsSerializer, ItemMetaPropertiesSerializer, SeatSerializer,
+    SubEventSerializer, TaxRuleSerializer,
 )
 from pretix.api.views import ConditionalListView
 from pretix.base.models import (
-    CartPosition, Device, Event, ItemMetaProperty, SeatCategoryMapping,
+    CartPosition, Device, Event, ItemMetaProperty, Seat, SeatCategoryMapping,
    TaxRule, TeamAPIToken,
 )
 from pretix.base.models.event import SubEvent
@@ -162,7 +165,13 @@ class EventViewSet(viewsets.ModelViewSet):
        qs = filter_qs_by_attr(qs, self.request)

        if 'with_availability_for' in self.request.GET:
-            qs = Event.annotated(qs, channel=self.request.GET.get('with_availability_for'))
+            qs = Event.annotated(
+                qs,
+                channel=get_object_or_404(
+                    self.request.organizer.sales_channels,
+                    identifier=self.request.GET.get('with_availability_for')
+                )
+            )

        return qs.prefetch_related(
            'organizer',
@@ -288,7 +297,8 @@ class EventViewSet(viewsets.ModelViewSet):

            if 'all_sales_channels' in serializer.validated_data and 'sales_channels' in serializer.validated_data:
                new_event.all_sales_channels = serializer.validated_data['all_sales_channels']
-                new_event.limit_sales_channels.set(serializer.validated_data['limit_sales_channels'])
+                if not new_event.all_sales_channels:
+                    new_event.limit_sales_channels.set(serializer.validated_data['limit_sales_channels'])
        else:
            serializer.instance.set_defaults()

@@ -361,7 +371,7 @@ with scopes_disabled():

        class Meta:
            model = SubEvent
-            fields = ['active', 'event__live']
+            fields = ['is_public', 'active', 'event__live']

        def ends_after_qs(self, queryset, name, value):
            expr = Q(
@@ -436,13 +446,19 @@ class SubEventViewSet(ConditionalListView, viewsets.ModelViewSet):
        elif self.request.user.is_authenticated:
            qs = SubEvent.objects.filter(
                event__organizer=self.request.organizer,
-                event__in=self.request.user.get_events_with_any_permission()
+                event__in=self.request.user.get_events_with_any_permission(request=self.request)
            )

        qs = filter_qs_by_attr(qs, self.request)

        if 'with_availability_for' in self.request.GET:
-            qs = SubEvent.annotated(qs, channel=self.request.GET.get('with_availability_for'))
+            qs = SubEvent.annotated(
+                qs,
+                channel=get_object_or_404(
+                    self.request.organizer.sales_channels,
+                    identifier=self.request.GET.get('with_availability_for')
+                )
+            )

        return qs.prefetch_related(
            'event',
@@ -654,3 +670,77 @@ class EventSettingsView(views.APIView):
                'request': request
            })
        return Response(s.data)
+
+
+class SeatFilter(FilterSet):
+    is_available = django_filters.BooleanFilter(method="is_available_qs")
+
+    def is_available_qs(self, queryset, name, value):
+        expr = (
+            Q(orderposition_id__isnull=True, cartposition_id__isnull=True, voucher_id__isnull=True)
+        )
+        if self.request.event.settings.seating_minimal_distance:
+            expr = expr & Q(has_closeby_taken=False)
+        if value:
+            return queryset.filter(expr)
+        else:
+            return queryset.exclude(expr)
+
+    class Meta:
+        model = Seat
+        fields = ('zone_name', 'row_name', 'row_label', 'seat_number', 'seat_label', 'seat_guid', 'blocked',)
+
+
+class SeatViewSet(ConditionalListView, viewsets.ModelViewSet):
+    serializer_class = SeatSerializer
+    queryset = Seat.objects.none()
+    write_permission = 'can_change_event_settings'
+    filter_backends = (DjangoFilterBackend, )
+    filterset_class = SeatFilter
+
+    def get_queryset(self):
+        if self.request.event.has_subevents and 'subevent' in self.request.resolver_match.kwargs:
+            try:
+                subevent = self.request.event.subevents.get(pk=self.request.resolver_match.kwargs['subevent'])
+            except SubEvent.DoesNotExist:
+                raise NotFound('Subevent not found')
+            qs = Seat.annotated(
+                event_id=self.request.event.id,
+                subevent=subevent,
+                qs=subevent.seats.all(),
+                annotate_ids=True,
+                minimal_distance=self.request.event.settings.seating_minimal_distance,
+                distance_only_within_row=self.request.event.settings.seating_distance_only_within_row,
+            )
+        elif not self.request.event.has_subevents and 'subevent' not in self.request.resolver_match.kwargs:
+            qs = Seat.annotated(
+                event_id=self.request.event.id,
+                subevent=None,
+                qs=self.request.event.seats.all(),
+                annotate_ids=True,
+                minimal_distance=self.request.event.settings.seating_minimal_distance,
+                distance_only_within_row=self.request.event.settings.seating_distance_only_within_row,
+            )
+        else:
+            raise NotFound('Please use the subevent-specific endpoint' if self.request.event.has_subevents
+                           else 'This event has no subevents')
+
+        return qs
+
+    def get_serializer_context(self):
+        ctx = super().get_serializer_context()
+        ctx['expand_fields'] = self.request.query_params.getlist('expand')
+        ctx['order_context'] = {
+            'event': self.request.event,
+            'pdf_data': None,
+        }
+        return ctx
+
+    def perform_update(self, serializer):
+        super().perform_update(serializer)
+        serializer.instance.event.log_action(
+            "pretix.event.seats.blocks.changed",
+            user=self.request.user,
+            auth=self.request.auth,
+            data={"seats": [serializer.instance.pk]},
+        )
@@ -56,10 +56,17 @@ from pretix.base.models import (
 )
 from pretix.base.services.quotas import QuotaAvailability
 from pretix.helpers.dicts import merge_dicts
+from pretix.helpers.i18n import i18ncomp

 with scopes_disabled():
    class ItemFilter(FilterSet):
        tax_rate = django_filters.CharFilter(method='tax_rate_qs')
+        search = django_filters.CharFilter(method='search_qs')
+
+        def search_qs(self, queryset, name, value):
+            return queryset.filter(
+                Q(internal_name__icontains=value) | Q(name__icontains=i18ncomp(value))
+            )

        def tax_rate_qs(self, queryset, name, value):
            if value in ("0", "None", "0.00"):
@@ -71,6 +78,18 @@ with scopes_disabled():
            model = Item
            fields = ['active', 'category', 'admission', 'tax_rate', 'free_price']

+    class ItemVariationFilter(FilterSet):
+        search = django_filters.CharFilter(method='search_qs')
+
+        def search_qs(self, queryset, name, value):
+            return queryset.filter(
+                Q(value__icontains=i18ncomp(value))
+            )
+
+        class Meta:
+            model = ItemVariation
+            fields = ['active']
+

 class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
    serializer_class = ItemSerializer
@@ -140,6 +159,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
    serializer_class = ItemVariationSerializer
    queryset = ItemVariation.objects.none()
    filter_backends = (DjangoFilterBackend, TotalOrderingFilter,)
+    filterset_class = ItemVariationFilter
    ordering_fields = ('id', 'position')
    ordering = ('id',)
    permission = None
@@ -42,6 +42,7 @@ from pretix.base.models import (
    Checkin, GiftCard, GiftCardAcceptance, GiftCardTransaction, OrderPosition,
    ReusableMedium,
 )
+from pretix.base.models.orders import PrintLog
 from pretix.helpers import OF_SELF
 from pretix.helpers.dicts import merge_dicts

@@ -78,7 +79,8 @@ class ReusableMediaViewSet(viewsets.ModelViewSet):
                queryset=OrderPosition.objects.select_related(
                    'order', 'order__event', 'order__event__organizer', 'seat',
                ).prefetch_related(
-                    Prefetch('checkins', queryset=Checkin.objects.all()),
+                    Prefetch('checkins', queryset=Checkin.objects.select_related('device')),
+                    Prefetch('print_logs', queryset=PrintLog.objects.select_related('device')),
                    'answers', 'answers__options', 'answers__question',
                )
            ),
@@ -49,6 +49,7 @@ from rest_framework.mixins import CreateModelMixin
 from rest_framework.permissions import SAFE_METHODS
 from rest_framework.response import Response

+from pretix.api.filters import MultipleCharFilter
 from pretix.api.models import OAuthAccessToken
 from pretix.api.pagination import TotalOrderingFilter
 from pretix.api.serializers.order import (
@@ -56,7 +57,8 @@ from pretix.api.serializers.order import (
    OrderPaymentCreateSerializer, OrderPaymentSerializer,
    OrderPositionSerializer, OrderRefundCreateSerializer,
    OrderRefundSerializer, OrderSerializer, PriceCalcSerializer,
-    RevokedTicketSecretSerializer, SimulatedOrderSerializer,
+    PrintLogSerializer, RevokedTicketSecretSerializer,
+    SimulatedOrderSerializer,
 )
 from pretix.api.serializers.orderchange import (
    BlockNameSerializer, OrderChangeOperationSerializer,
@@ -74,7 +76,7 @@ from pretix.base.models import (
    TeamAPIToken, generate_secret,
 )
 from pretix.base.models.orders import (
-    BlockedTicketSecret, QuestionAnswer, RevokedTicketSecret,
+    BlockedTicketSecret, PrintLog, QuestionAnswer, RevokedTicketSecret,
 )
 from pretix.base.payment import PaymentException
 from pretix.base.pdf import get_images
@@ -108,6 +110,7 @@ with scopes_disabled():
        status = django_filters.CharFilter(field_name='status', lookup_expr='iexact')
        modified_since = django_filters.IsoDateTimeFilter(field_name='last_modified', lookup_expr='gte')
        created_since = django_filters.IsoDateTimeFilter(field_name='datetime', lookup_expr='gte')
+        created_before = django_filters.IsoDateTimeFilter(field_name='datetime', lookup_expr='lt')
        subevent_after = django_filters.IsoDateTimeFilter(method='subevent_after_qs')
        subevent_before = django_filters.IsoDateTimeFilter(method='subevent_before_qs')
        search = django_filters.CharFilter(method='search_qs')
@@ -115,6 +118,8 @@ with scopes_disabled():
        variation = django_filters.CharFilter(field_name='all_positions', lookup_expr='variation_id', distinct=True)
        subevent = django_filters.CharFilter(field_name='all_positions', lookup_expr='subevent_id', distinct=True)
        customer = django_filters.CharFilter(field_name='customer__identifier')
+        sales_channel = django_filters.CharFilter(field_name='sales_channel__identifier')
+        payment_provider = django_filters.CharFilter(method='provider_qs')

        class Meta:
            model = Order
@@ -138,6 +143,11 @@ with scopes_disabled():
            )
            return qs

+        def provider_qs(self, qs, name, value):
+            return qs.filter(Exists(
+                OrderPayment.objects.filter(order=OuterRef('pk'), provider=value)
+            ))
+
        def subevent_before_qs(self, qs, name, value):
            if getattr(self.request, 'event', None):
                subevents = self.request.event.subevents
@@ -205,7 +215,7 @@ class OrderViewSetMixin:
    queryset = Order.objects.none()
    filter_backends = (DjangoFilterBackend, TotalOrderingFilter)
    ordering = ('datetime',)
-    ordering_fields = ('datetime', 'code', 'status', 'last_modified')
+    ordering_fields = ('datetime', 'code', 'status', 'last_modified', 'cancellation_date')
    filterset_class = OrderFilter
    lookup_field = 'code'

@@ -249,7 +259,8 @@ class OrderViewSetMixin:
            return Prefetch(
                'positions',
                opq.all().prefetch_related(
-                    Prefetch('checkins', queryset=Checkin.objects.all()),
+                    Prefetch('checkins', queryset=Checkin.objects.select_related('device')),
+                    Prefetch('print_logs', queryset=PrintLog.objects.select_related('device')),
                    Prefetch('item', queryset=self.request.event.items.prefetch_related(
                        Prefetch('meta_values', ItemMetaValue.objects.select_related('property'), to_attr='meta_values_cached')
                    )),
@@ -270,7 +281,8 @@ class OrderViewSetMixin:
            return Prefetch(
                'positions',
                opq.all().prefetch_related(
-                    Prefetch('checkins', queryset=Checkin.objects.all()),
+                    Prefetch('checkins', queryset=Checkin.objects.select_related('device')),
+                    Prefetch('print_logs', queryset=PrintLog.objects.select_related('device')),
                    'item', 'variation',
                    Prefetch('answers', queryset=QuestionAnswer.objects.prefetch_related('options', 'question').order_by('question__position')),
                    'seat',
@@ -1083,7 +1095,8 @@ class OrderPositionViewSet(viewsets.ModelViewSet):
                'item_meta_properties',
            )
            qs = qs.prefetch_related(
-                Prefetch('checkins', queryset=Checkin.objects.all()),
+                Prefetch('checkins', queryset=Checkin.objects.select_related("device")),
+                Prefetch('print_logs', queryset=PrintLog.objects.select_related('device')),
                Prefetch('item', queryset=self.request.event.items.prefetch_related(
                    Prefetch('meta_values', ItemMetaValue.objects.select_related('property'),
                             to_attr='meta_values_cached')
@@ -1102,7 +1115,7 @@ class OrderPositionViewSet(viewsets.ModelViewSet):
                    Prefetch(
                        'positions',
                        qs.prefetch_related(
-                            Prefetch('checkins', queryset=Checkin.objects.all()),
+                            Prefetch('checkins', queryset=Checkin.objects.select_related('device')),
                            Prefetch('item', queryset=self.request.event.items.prefetch_related(
                                Prefetch('meta_values', ItemMetaValue.objects.select_related('property'),
                                         to_attr='meta_values_cached')
@@ -1126,7 +1139,8 @@ class OrderPositionViewSet(viewsets.ModelViewSet):
            )
        else:
            qs = qs.prefetch_related(
-                Prefetch('checkins', queryset=Checkin.objects.all()),
+                Prefetch('checkins', queryset=Checkin.objects.select_related("device")),
+                Prefetch('print_logs', queryset=PrintLog.objects.select_related('device')),
                'answers', 'answers__options', 'answers__question',
            ).select_related(
                'item', 'order', 'order__event', 'order__event__organizer', 'seat'
@@ -1245,6 +1259,34 @@ class OrderPositionViewSet(viewsets.ModelViewSet):
        )
        return resp

+    @action(detail=True, url_name="printlog", url_path="printlog", methods=["POST"])
+    def printlog(self, request, **kwargs):
+        pos = self.get_object()
+        serializer = PrintLogSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        with transaction.atomic():
+            serializer.save(
+                position=pos,
+                device=request.auth if isinstance(request.auth, Device) else None,
+                user=request.user if request.user.is_authenticated else None,
+                api_token=request.auth if isinstance(request.auth, TeamAPIToken) else None,
+                oauth_application=request.auth.application if isinstance(request.auth, OAuthAccessToken) else None,
+            )
+
+            pos.order.log_action(
+                "pretix.event.order.print",
+                data={
+                    "position": pos.pk,
+                    "positionid": pos.positionid,
+                    **serializer.validated_data,
+                },
+                auth=request.auth,
+                user=request.user,
+            )
+
+        return Response(serializer.data, status=status.HTTP_201_CREATED)
+
    @action(detail=True, url_name='pdf_image', url_path=r'pdf_image/(?P<key>[^/]+)')
    def pdf_image(self, request, key, **kwargs):
        pos = self.get_object()
@@ -1817,17 +1859,14 @@ class RefundViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
 with scopes_disabled():
    class InvoiceFilter(FilterSet):
        refers = django_filters.CharFilter(method='refers_qs')
-        number = django_filters.CharFilter(method='nr_qs')
-        order = django_filters.CharFilter(field_name='order', lookup_expr='code__iexact')
+        number = MultipleCharFilter(field_name='nr', lookup_expr='iexact')
+        order = MultipleCharFilter(field_name='order', lookup_expr='code__iexact')

        def refers_qs(self, queryset, name, value):
            return queryset.annotate(
                refers_nr=Concat('refers__prefix', 'refers__invoice_no')
            ).filter(refers_nr__iexact=value)

-        def nr_qs(self, queryset, name, value):
-            return queryset.filter(nr__iexact=value)
-
        class Meta:
            model = Invoice
            fields = ['order', 'number', 'is_cancellation', 'refers', 'locale']
@@ -24,10 +24,11 @@ from decimal import Decimal
 import django_filters
 from django.contrib.auth.hashers import make_password
 from django.db import transaction
-from django.db.models import OuterRef, Subquery, Sum
+from django.db.models import OuterRef, Q, Subquery, Sum
 from django.db.models.functions import Coalesce
 from django.shortcuts import get_object_or_404
 from django.utils.functional import cached_property
+from django.utils.timezone import now
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
 from rest_framework import mixins, serializers, status, views, viewsets
@@ -136,11 +137,19 @@ class SeatingPlanViewSet(viewsets.ModelViewSet):
 with scopes_disabled():
    class GiftCardFilter(FilterSet):
        secret = django_filters.CharFilter(field_name='secret', lookup_expr='iexact')
+        expired = django_filters.BooleanFilter(method='expired_qs')
+        value = django_filters.NumberFilter(field_name='cached_value')

        class Meta:
            model = GiftCard
            fields = ['secret', 'testmode']

+        def expired_qs(self, qs, name, value):
+            if value:
+                return qs.filter(expires__isnull=False, expires__lt=now())
+            else:
+                return qs.filter(Q(expires__isnull=True) | Q(expires__gte=now()))
+

 class GiftCardViewSet(viewsets.ModelViewSet):
    serializer_class = GiftCardSerializer
@@ -19,6 +19,8 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
+import django_filters
+from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from rest_framework import viewsets

 from pretix.api.models import WebHook
@@ -26,11 +28,17 @@ from pretix.api.serializers.webhooks import WebHookSerializer
 from pretix.helpers.dicts import merge_dicts


+class WebhookFilter(FilterSet):
+    enabled = django_filters.rest_framework.BooleanFilter()
+
+
 class WebHookViewSet(viewsets.ModelViewSet):
    serializer_class = WebHookSerializer
    queryset = WebHook.objects.none()
    permission = 'can_change_organizer_settings'
    write_permission = 'can_change_organizer_settings'
+    filter_backends = (DjangoFilterBackend,)
+    filterset_class = WebhookFilter

    def get_queryset(self):
        return self.request.organizer.webhooks.prefetch_related('listeners')
@@ -126,6 +126,17 @@ class ParametrizedOrderWebhookEvent(ParametrizedWebhookEvent):
        }


+class DeletedOrderWebhookEvent(ParametrizedWebhookEvent):
+    def build_payload(self, logentry: LogEntry):
+        return {
+            'notification_id': logentry.pk,
+            'organizer': logentry.organizer.slug,
+            'event': logentry.event.slug,
+            'code': logentry.parsed_data.get("code"),
+            'action': logentry.action_type,
+        }
+
+
 class ParametrizedEventWebhookEvent(ParametrizedWebhookEvent):

    def build_payload(self, logentry: LogEntry):
@@ -297,6 +308,10 @@ def register_default_webhook_events(sender, **kwargs):
            'pretix.event.order.denied',
            _('Order denied'),
        ),
+        DeletedOrderWebhookEvent(
+            'pretix.event.order.deleted',
+            _('Order deleted'),
+        ),
        ParametrizedOrderPositionCheckinWebhookEvent(
            'pretix.event.checkin',
            _('Ticket checked in'),
@@ -32,13 +32,16 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.

+import string
 from collections import OrderedDict
 from importlib import import_module

 from django import forms
 from django.conf import settings
 from django.contrib.auth import authenticate
-from django.utils.translation import gettext_lazy as _
+from django.contrib.auth.hashers import check_password, make_password
+from django.core.exceptions import ValidationError
+from django.utils.translation import gettext_lazy as _, ngettext


 def get_auth_backends():
@@ -149,7 +152,7 @@ class NativeAuthBackend(BaseAuthBackend):
        to log in.
        """
        d = OrderedDict([
-            ('email', forms.EmailField(label=_("E-mail"), max_length=254,
+            ('email', forms.EmailField(label=_("Email"), max_length=254,
                                       widget=forms.EmailInput(attrs={'autofocus': 'autofocus'}))),
            ('password', forms.CharField(label=_("Password"), widget=forms.PasswordInput,
                                         max_length=4096)),
@@ -160,3 +163,62 @@ class NativeAuthBackend(BaseAuthBackend):
        u = authenticate(request=request, email=form_data['email'].lower(), password=form_data['password'])
        if u and u.auth_backend == self.identifier:
            return u
+
+
+class NumericAndAlphabeticPasswordValidator:
+
+    def validate(self, password, user=None):
+        has_numeric = any(c in string.digits for c in password)
+        has_alpha = any(c in string.ascii_letters for c in password)
+        if not has_numeric or not has_alpha:
+            raise ValidationError(
+                _(
+                    "Your password must contain both numeric and alphabetic characters.",
+                ),
+                code="password_numeric_and_alphabetic",
+            )
+
+    def get_help_text(self):
+        return _(
+            "Your password must contain both numeric and alphabetic characters.",
+        )
+
+
+class HistoryPasswordValidator:
+
+    def __init__(self, history_length=4):
+        self.history_length = history_length
+
+    def validate(self, password, user=None):
+        from pretix.base.models import User
+
+        if not user or not user.pk or not isinstance(user, User):
+            return
+
+        for hp in user.historic_passwords.order_by("-created")[:self.history_length]:
+            if check_password(password, hp.password):
+                raise ValidationError(
+                    ngettext(
+                        "Your password may not be the same as your previous password.",
+                        "Your password may not be the same as one of your %(history_length)s previous passwords.",
+                        self.history_length,
+                    ),
+                    code="password_history",
+                    params={"history_length": self.history_length},
+                )
+
+    def get_help_text(self):
+        return ngettext(
+            "Your password may not be the same as your previous password.",
+            "Your password may not be the same as one of your %(history_length)s previous passwords.",
+            self.history_length,
+        ) % {"history_length": self.history_length}
+
+    def password_changed(self, password, user=None):
+        if not user:
+            pass
+
+        user.historic_passwords.create(password=make_password(password))
+        user.historic_passwords.filter(
+            pk__in=user.historic_passwords.order_by("-created")[self.history_length:].values_list("pk", flat=True),
+        ).delete()
@@ -46,6 +46,8 @@ This module contains utilities for implementing OpenID Connect for customer auth
 as well as an OpenID Provider (OP).
 """

+pretix_token_endpoint_auth_methods = ['client_secret_basic', 'client_secret_post']
+

 def _urljoin(base, path):
    if not base.endswith("/"):
@@ -127,6 +129,16 @@ def oidc_validate_and_complete_config(config):
                        fields=", ".join(provider_config.get("claims_supported", []))
                    ))

+    if "token_endpoint_auth_methods_supported" in provider_config:
+        token_endpoint_auth_methods_supported = provider_config.get("token_endpoint_auth_methods_supported",
+                                                                    ["client_secret_basic"])
+        if not any(x in pretix_token_endpoint_auth_methods for x in token_endpoint_auth_methods_supported):
+            raise ValidationError(
+                _(f'No supported Token Endpoint Auth Methods supported: {token_endpoint_auth_methods_supported}').format(
+                    token_endpoint_auth_methods_supported=", ".join(token_endpoint_auth_methods_supported)
+                )
+            )
+
    config['provider_config'] = provider_config
    return config

@@ -147,6 +159,18 @@ def oidc_authorize_url(provider, state, redirect_uri):

 def oidc_validate_authorization(provider, code, redirect_uri):
    endpoint = provider.configuration['provider_config']['token_endpoint']
+
+    # Wall of shame and RFC ignorant IDPs
+    if endpoint == 'https://www.linkedin.com/oauth/v2/accessToken':
+        token_endpoint_auth_method = 'client_secret_post'
+    else:
+        token_endpoint_auth_methods = provider.configuration['provider_config'].get(
+            'token_endpoint_auth_methods_supported', ['client_secret_basic']
+        )
+        token_endpoint_auth_method = [
+            x for x in pretix_token_endpoint_auth_methods if x in token_endpoint_auth_methods
+        ][0]
+
    params = {
        # https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
        # https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
@@ -154,6 +178,11 @@ def oidc_validate_authorization(provider, code, redirect_uri):
        'code': code,
        'redirect_uri': redirect_uri,
    }
+
+    if token_endpoint_auth_method == 'client_secret_post':
+        params['client_id'] = provider.configuration['client_id']
+        params['client_secret'] = provider.configuration['client_secret']
+
    try:
        resp = requests.post(
            endpoint,
@@ -161,7 +190,10 @@ def oidc_validate_authorization(provider, code, redirect_uri):
            headers={
                'Accept': 'application/json',
            },
-            auth=(provider.configuration['client_id'], provider.configuration['client_secret']),
+            auth=(
+                provider.configuration['client_id'],
+                provider.configuration['client_secret']
+            ) if token_endpoint_auth_method == 'client_secret_basic' else None,
        )
        resp.raise_for_status()
        data = resp.json()
@@ -68,7 +68,7 @@ def test_custom_smtp_backend(backend: T, from_addr: str) -> None:

 class BaseHTMLMailRenderer:
    """
-    This is the base class for all HTML e-mail renderers.
+    This is the base class for all HTML email renderers.
    """

    def __init__(self, event: Event, organizer=None):
@@ -207,10 +207,13 @@ class ListExporter(BaseExporter):
    def get_filename(self):
        return 'export'

+    def get_csv_encoding(self):
+        return 'utf-8'
+
    def _render_csv(self, form_data, output_file=None, **kwargs):
        if output_file:
            if 'b' in output_file.mode:
-                output_file = io.TextIOWrapper(output_file, encoding='utf-8', newline='')
+                output_file = io.TextIOWrapper(output_file, encoding=self.get_csv_encoding(), errors='replace', newline='')
            writer = csv.writer(output_file, **kwargs)
            total = 0
            counter = 0
@@ -246,7 +249,7 @@ class ListExporter(BaseExporter):
                    if counter % max(10, total // 100) == 0:
                        self.progress_callback(counter / total * 100)
                writer.writerow(line)
-            return self.get_filename() + '.csv', 'text/csv', output.getvalue().encode("utf-8")
+            return self.get_filename() + '.csv', 'text/csv', output.getvalue().encode(self.get_csv_encoding(), errors='replace')

    def prepare_xlsx_sheet(self, ws):
        pass
@@ -256,7 +259,7 @@ class ListExporter(BaseExporter):
        ws = wb.create_sheet()
        self.prepare_xlsx_sheet(ws)
        try:
-            ws.title = str(self.verbose_name)
+            ws.title = str(self.verbose_name)[:30]
        except:
            pass
        total = 0
@@ -374,7 +377,7 @@ class MultiSheetListExporter(ListExporter):
        wb = SafeWorkbook(write_only=True)
        n_sheets = len(self.sheets)
        for i_sheet, (s, l) in enumerate(self.sheets):
-            ws = wb.create_sheet(str(l))
+            ws = wb.create_sheet(str(l)[:30])
            if hasattr(self, 'prepare_xlsx_sheet_' + s):
                getattr(self, 'prepare_xlsx_sheet_' + s)(ws)

@@ -64,7 +64,7 @@ class CustomerListExporter(OrganizerLevelExportMixin, ListExporter):
            _('Customer ID'),
            _('SSO provider'),
            _('External identifier'),
-            _('E-mail'),
+            _('Email'),
            _('Phone number'),
            _('Full name'),
        ]
@@ -199,7 +199,7 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
                _('Invoice number'),
                _('Date'),
                _('Order code'),
-                _('E-mail address'),
+                _('Email address'),
                _('Invoice type'),
                _('Cancellation of'),
                _('Language'),
@@ -326,7 +326,7 @@ class InvoiceDataExporter(InvoiceExporterMixin, MultiSheetListExporter):
                _('Event start date'),
                _('Date'),
                _('Order code'),
-                _('E-mail address'),
+                _('Email address'),
                _('Invoice type'),
                _('Cancellation of'),
                _('Invoice sender:') + ' ' + _('Name'),
@@ -284,7 +284,7 @@ class OrderListExporter(MultiSheetListExporter):
        headers.append(_('Comment'))
        headers.append(_('Follow-up date'))
        headers.append(_('Positions'))
-        headers.append(_('E-mail address verified'))
+        headers.append(_('Email address verified'))
        headers.append(_('External customer ID'))
        headers.append(_('Payment providers'))
        if form_data.get('include_payment_amounts'):
@@ -560,7 +560,7 @@ class OrderListExporter(MultiSheetListExporter):
            ),
        ).select_related(
            'order', 'order__invoice_address', 'order__customer', 'item', 'variation',
-            'voucher', 'tax_rule'
+            'voucher', 'tax_rule', 'addon_to',
        ).prefetch_related(
            'subevent', 'subevent__meta_values',
            'answers', 'answers__question', 'answers__options'
@@ -619,6 +619,7 @@ class OrderListExporter(MultiSheetListExporter):
            _('Valid until'),
            _('Order comment'),
            _('Follow-up date'),
+            _('Add-on to position ID'),
        ]

        questions = list(Question.objects.filter(event__in=self.events))
@@ -652,8 +653,9 @@ class OrderListExporter(MultiSheetListExporter):
            _('VAT ID'),
        ]
        headers += [
-            _('Sales channel'), _('Order locale'),
-            _('E-mail address verified'),
+            _('Sales channel'),
+            _('Order locale'),
+            _('Email address verified'),
            _('External customer ID'),
            _('Check-in lists'),
            _('Payment providers'),
@@ -743,6 +745,7 @@ class OrderListExporter(MultiSheetListExporter):
                ]
                row.append(order.comment)
                row.append(order.custom_followup_at.strftime("%Y-%m-%d") if order.custom_followup_at else "")
+                row.append(op.addon_to.positionid if op.addon_to_id else "")
                acache = {}
                for a in op.answers.all():
                    # We do not want to localize Date, Time and Datetime question answers, as those can lead
@@ -254,7 +254,7 @@ class PasswordRecoverForm(forms.Form):

 class PasswordForgotForm(forms.Form):
    email = forms.EmailField(
-        label=_('E-mail'),
+        label=_('Email'),
    )

    def __init__(self, *args, **kwargs):
@@ -1122,6 +1122,7 @@ class BaseInvoiceAddressForm(forms.ModelForm):

        if event.settings.invoice_address_custom_field:
            self.fields['custom_field'].label = event.settings.invoice_address_custom_field
+            self.fields['custom_field'].help_text = event.settings.invoice_address_custom_field_helptext
        else:
            del self.fields['custom_field']

@@ -48,10 +48,10 @@ from pretix.control.forms import SingleLanguageWidget

 class UserSettingsForm(forms.ModelForm):
    error_messages = {
-        'duplicate_identifier': _("There already is an account associated with this e-mail address. "
+        'duplicate_identifier': _("There already is an account associated with this email address. "
                                  "Please choose a different one."),
-        'pw_current': _("Please enter your current password if you want to change your e-mail "
-                        "address or password."),
+        'pw_current': _("Please enter your current password if you want to change your email address "
+                        "or password."),
        'pw_current_wrong': _("The current password you entered was not correct."),
        'pw_mismatch': _("Please enter the same password twice"),
        'rate_limit': _("For security reasons, please wait 5 minutes before you try again."),
@@ -38,6 +38,7 @@ from datetime import datetime
 from django import forms
 from django.utils.formats import get_format
 from django.utils.functional import lazy
+from django.utils.html import escape
 from django.utils.timezone import get_current_timezone, now
 from django.utils.translation import gettext_lazy as _

@@ -64,7 +65,7 @@ def format_placeholders_help_text(placeholders, event=None):
    placeholders = [(k, v.render_sample(event) if event else v) for k, v in placeholders.items()]
    placeholders.sort(key=lambda x: x[0])
    phs = [
-        '<button type="button" class="content-placeholder" title="%s">{%s}</button>' % (_("Sample: %s") % v if v else "", k)
+        '<button type="button" class="content-placeholder" title="%s">{%s}</button>' % (escape(_("Sample: %s") % v) if v else "", escape(k))
        for k, v in placeholders
    ]
    return _('Available placeholders: {list}').format(
@@ -30,7 +30,7 @@ from typing import Tuple

 import bleach
 import vat_moss.exchange_rates
-from bidi.algorithm import get_display
+from bidi import get_display
 from django.contrib.staticfiles import finders
 from django.db.models import Sum
 from django.dispatch import receiver
@@ -289,7 +289,7 @@ class BaseReportlabInvoiceRenderer(BaseInvoiceRenderer):
    def _clean_text(self, text, tags=None):
        return self._normalize(bleach.clean(
            text,
-            tags=tags or []
+            tags=set(tags) if tags else set()
        ).strip().replace('<br>', '<br />').replace('\n', '<br />\n'))


@@ -461,7 +461,7 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
    def _draw_event(self, canvas):
        def shorten(txt):
            txt = str(txt)
-            txt = bleach.clean(txt, tags=[]).strip()
+            txt = bleach.clean(txt, tags=set()).strip()
            p = Paragraph(self._normalize(txt.strip().replace('\n', '<br />\n')), style=self.stylesheet['Normal'])
            p_size = p.wrap(self.event_width, self.event_height)

@@ -36,6 +36,7 @@ import time
 import traceback

 from django.conf import settings
+from django.core.cache import cache
 from django.core.management.base import BaseCommand
 from django.dispatch.dispatcher import NO_RECEIVERS

@@ -50,17 +51,23 @@ class Command(BaseCommand):
    def add_arguments(self, parser):
        parser.add_argument('--tasks', action='store', type=str, help='Only execute the tasks with this name '
                                                                      '(dotted path, comma separation)')
+        parser.add_argument('--list-tasks', action='store_true', help='Only list all tasks')
        parser.add_argument('--exclude', action='store', type=str, help='Exclude the tasks with this name '
                                                                        '(dotted path, comma separation)')

    def handle(self, *args, **options):
        verbosity = int(options['verbosity'])

+        cache.set("pretix_runperiodic_executed", True, 3600 * 12)
+
        if not periodic_task.receivers or periodic_task.sender_receivers_cache.get(self) is NO_RECEIVERS:
            return

        for receiver in periodic_task._live_receivers(self):
            name = f'{receiver.__module__}.{receiver.__name__}'
+            if options['list_tasks']:
+                print(name)
+                continue
            if options.get('tasks'):
                if name not in options.get('tasks').split(','):
                    continue
@@ -37,6 +37,16 @@ class BaseMediaType:
    def verbose_name(self):
        raise NotImplementedError()

+    @property
+    def icon(self):
+        """
+        This can be:
+
+        - The name of a Font Awesome icon to represent this channel type.
+        - The name of a SVG icon file that is resolvable through the static file system. We recommend to design for a size of 18x14 pixels.
+        """
+        return "circle"
+
    def generate_identifier(self, organizer):
        if self.medium_created_by_server:
            raise NotImplementedError()
@@ -59,6 +69,7 @@ class BaseMediaType:
 class BarcodePlainMediaType(BaseMediaType):
    identifier = 'barcode'
    verbose_name = _('Barcode / QR-Code')
+    icon = 'qrcode'
    medium_created_by_server = True
    supports_giftcard = False
    supports_orderposition = True
@@ -75,6 +86,7 @@ class BarcodePlainMediaType(BaseMediaType):
 class NfcUidMediaType(BaseMediaType):
    identifier = 'nfc_uid'
    verbose_name = _('NFC UID-based')
+    icon = 'pretixbase/img/media/nfc_uid.svg'
    medium_created_by_server = False
    supports_giftcard = True
    supports_orderposition = False
@@ -114,6 +126,7 @@ class NfcUidMediaType(BaseMediaType):
 class NfcMf0aesMediaType(BaseMediaType):
    identifier = 'nfc_mf0aes'
    verbose_name = 'NFC Mifare Ultralight AES'
+    icon = 'pretixbase/img/media/nfc_secure.svg'
    medium_created_by_server = False
    supports_giftcard = True
    supports_orderposition = False
@@ -29,7 +29,7 @@ class Migration(migrations.Migration):
                ('password', models.CharField(verbose_name='password', max_length=128)),
                ('last_login', models.DateTimeField(verbose_name='last login', blank=True, null=True)),
                ('is_superuser', models.BooleanField(verbose_name='superuser status', default=False, help_text='Designates that this user has all permissions without explicitly assigning them.')),
-                ('email', models.EmailField(max_length=191, blank=True, unique=True, verbose_name='E-mail', null=True,
+                ('email', models.EmailField(max_length=191, blank=True, unique=True, verbose_name='Email', null=True,
                                            db_index=True)),
                ('givenname', models.CharField(verbose_name='Given name', max_length=255, blank=True, null=True)),
                ('familyname', models.CharField(verbose_name='Family name', max_length=255, blank=True, null=True)),
@@ -48,7 +48,7 @@ class Migration(migrations.Migration):
                ('password', models.CharField(max_length=128, verbose_name='password')),
                ('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
                ('is_superuser', models.BooleanField(default=False, help_text='Designates that this user has all permissions without explicitly assigning them.', verbose_name='superuser status')),
-                ('email', models.EmailField(blank=True, db_index=True, max_length=254, null=True, unique=True, verbose_name='E-mail')),
+                ('email', models.EmailField(blank=True, db_index=True, max_length=254, null=True, unique=True, verbose_name='Email')),
                ('givenname', models.CharField(blank=True, max_length=255, null=True, verbose_name='Given name')),
                ('familyname', models.CharField(blank=True, max_length=255, null=True, verbose_name='Family name')),
                ('is_active', models.BooleanField(default=True, verbose_name='Is active')),
@@ -232,7 +232,7 @@ class Migration(migrations.Migration):
                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
                ('code', models.CharField(max_length=16, verbose_name='Order code')),
                ('status', models.CharField(choices=[('n', 'pending'), ('p', 'paid'), ('e', 'expired'), ('c', 'cancelled'), ('r', 'refunded')], max_length=3, verbose_name='Status')),
-                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='E-mail')),
+                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='Email')),
                ('locale', models.CharField(blank=True, max_length=32, null=True, verbose_name='Locale')),
                ('secret', models.CharField(default=pretix.base.models.orders.generate_secret, max_length=32)),
                ('datetime', models.DateTimeField(verbose_name='Date')),
@@ -187,7 +187,7 @@ class Migration(migrations.Migration):
                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
                ('code', models.CharField(max_length=16, verbose_name='Order code')),
                ('status', models.CharField(choices=[('n', 'pending'), ('p', 'paid'), ('e', 'expired'), ('c', 'cancelled'), ('r', 'refunded')], max_length=3, verbose_name='Status')),
-                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='E-mail')),
+                ('email', models.EmailField(blank=True, max_length=254, null=True, verbose_name='Email')),
                ('locale', models.CharField(blank=True, max_length=32, null=True, verbose_name='Locale')),
                ('secret', models.CharField(default=pretix.base.models.orders.generate_secret, max_length=32)),
                ('datetime', models.DateTimeField(verbose_name='Date')),
@@ -20,7 +20,7 @@ class Migration(migrations.Migration):
            fields=[
                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
                ('created', models.DateTimeField(auto_now_add=True, verbose_name='On waiting list since')),
-                ('email', models.EmailField(max_length=254, verbose_name='E-mail address')),
+                ('email', models.EmailField(max_length=254, verbose_name='Email address')),
                ('locale', models.CharField(default='en', max_length=190)),
                ('event', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='waitinglistentries', to='pretixbase.Event', verbose_name='Event')),
                ('item', models.ForeignKey(help_text='The product the user waits for.', on_delete=django.db.models.deletion.CASCADE, related_name='waitinglistentries', to='pretixbase.Item', verbose_name='Product')),
@@ -35,7 +35,7 @@ class Migration(migrations.Migration):
            fields=[
                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
                ('created', models.DateTimeField(auto_now_add=True, verbose_name='On waiting list since')),
-                ('email', models.EmailField(max_length=254, verbose_name='E-mail address')),
+                ('email', models.EmailField(max_length=254, verbose_name='Email address')),
                ('locale', models.CharField(default='en', max_length=190)),
                ('event', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='waitinglistentries', to='pretixbase.Event', verbose_name='Event')),
                ('item', models.ForeignKey(help_text='The product the user waits for.', on_delete=django.db.models.deletion.CASCADE, related_name='waitinglistentries', to='pretixbase.Item', verbose_name='Product')),
@@ -163,7 +163,7 @@ class Migration(migrations.Migration):
            fields=[
                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
                ('action_type', models.CharField(max_length=255)),
-                ('method', models.CharField(choices=[('mail', 'E-mail')], max_length=255)),
+                ('method', models.CharField(choices=[('mail', 'Email')], max_length=255)),
                ('event', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE,
                                            to='pretixbase.Event')),
                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
@@ -21,7 +21,7 @@ class Migration(migrations.Migration):
            fields=[
                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
                ('action_type', models.CharField(max_length=255)),
-                ('method', models.CharField(choices=[('mail', 'E-mail')], max_length=255)),
+                ('method', models.CharField(choices=[('mail', 'Email')], max_length=255)),
                ('event', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, to='pretixbase.Event')),
                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
                ('enabled', models.BooleanField(default=True)),
@@ -1,6 +1,7 @@
 # Generated by Django 4.2.8 on 2024-07-01 09:26

 from django.db import migrations, models
+
 import pretix.base.models.orders


@@ -0,0 +1,18 @@
+# Generated by Django 4.2.13 on 2024-07-17 14:03
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0268_remove_subevent_items_remove_subevent_variations_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='order',
+            name='api_meta',
+            field=models.JSONField(default=dict),
+        ),
+    ]
@@ -0,0 +1,36 @@
+# Generated by Django 4.2.15 on 2024-09-16 15:10
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("pretixbase", "0269_order_api_meta"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="HistoricPassword",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True, primary_key=True, serialize=False
+                    ),
+                ),
+                ("created", models.DateTimeField(auto_now_add=True)),
+                ("password", models.CharField(max_length=128)),
+                (
+                    "user",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="historic_passwords",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+        ),
+    ]
@@ -0,0 +1,32 @@
+# Generated by Django 4.2.11 on 2024-05-27 13:19
+
+from django.db import migrations, models
+
+import pretix.base.models.orders
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("pretixbase", "0270_historicpassword"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="itemcategory",
+            name="cross_selling_condition",
+            field=models.CharField(null=True, max_length=10),
+        ),
+        migrations.AddField(
+            model_name="itemcategory",
+            name="cross_selling_mode",
+            field=models.CharField(null=True, max_length=5),
+        ),
+        migrations.AddField(
+            model_name="itemcategory",
+            name="cross_selling_match_products",
+            field=models.ManyToManyField(
+                related_name="matched_by_cross_selling_categories", to="pretixbase.item"
+            ),
+        ),
+    ]
@@ -0,0 +1,79 @@
+# Generated by Django 4.2.16 on 2024-09-19 10:41
+
+import django.db.models.deletion
+import django.utils.timezone
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.OAUTH2_PROVIDER_APPLICATION_MODEL),
+        ("pretixbase", "0271_itemcategory_cross_selling"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="PrintLog",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True, primary_key=True, serialize=False
+                    ),
+                ),
+                ("datetime", models.DateTimeField(default=django.utils.timezone.now)),
+                ("created", models.DateTimeField(auto_now_add=True, null=True)),
+                ("successful", models.BooleanField(default=True)),
+                ("source", models.CharField(max_length=255)),
+                ("type", models.CharField(max_length=255)),
+                ("info", models.JSONField(default=dict)),
+                (
+                    "api_token",
+                    models.ForeignKey(
+                        null=True,
+                        on_delete=django.db.models.deletion.PROTECT,
+                        to="pretixbase.teamapitoken",
+                    ),
+                ),
+                (
+                    "device",
+                    models.ForeignKey(
+                        null=True,
+                        on_delete=django.db.models.deletion.PROTECT,
+                        related_name="print_logs",
+                        to="pretixbase.device",
+                    ),
+                ),
+                (
+                    "oauth_application",
+                    models.ForeignKey(
+                        null=True,
+                        on_delete=django.db.models.deletion.PROTECT,
+                        to=settings.OAUTH2_PROVIDER_APPLICATION_MODEL,
+                    ),
+                ),
+                (
+                    "position",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="print_logs",
+                        to="pretixbase.orderposition",
+                    ),
+                ),
+                (
+                    "user",
+                    models.ForeignKey(
+                        null=True,
+                        on_delete=django.db.models.deletion.PROTECT,
+                        related_name="print_logs",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "ordering": ("-datetime",),
+            },
+        ),
+    ]
@@ -0,0 +1,48 @@
+# Generated by Django 4.2.16 on 2024-10-29 15:03
+
+from django.db import migrations
+
+
+def migrate_autocheckin(apps, schema_editor):
+    CheckinList = apps.get_model("pretixbase", "CheckinList")
+    AutoCheckinRule = apps.get_model("autocheckin", "AutoCheckinRule")
+
+    for cl in CheckinList.objects.filter(auto_checkin_sales_channels__isnull=False).select_related("event", "event__organizer"):
+        sales_channels = cl.auto_checkin_sales_channels.all()
+        all_sales_channels = cl.event.organizer.sales_channels.all()
+
+        if "pretix.plugins.autocheckin" not in cl.event.plugins:
+            cl.event.plugins = cl.event.plugins + ",pretix.plugins.autocheckin"
+            cl.event.save()
+
+        r = AutoCheckinRule.objects.get_or_create(
+            list=cl,
+            event=cl.event,
+            all_products=True,
+            all_payment_methods=True,
+            defaults=dict(
+                mode="placed",
+                all_sales_channels=len(sales_channels) == len(all_sales_channels),
+            )
+        )[0]
+        if len(sales_channels) != len(all_sales_channels):
+            r.limit_sales_channels.set(sales_channels)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("pretixbase", "0272_printlog"),
+        ("autocheckin", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.RunPython(
+            migrate_autocheckin,
+            migrations.RunPython.noop,
+        ),
+        migrations.RemoveField(
+            model_name="checkinlist",
+            name="auto_checkin_sales_channels",
+        ),
+    ]
@@ -213,7 +213,13 @@ class DatetimeColumnMixin:
            except (ValueError, TypeError):
                pass
        else:
-            raise ValidationError(_("Could not parse {value} as a date and time.").format(value=value))
+            try:
+                d = datetime.datetime.fromisoformat(value)
+                if not d.tzinfo:
+                    d = d.replace(tzinfo=self.timezone)
+                return d
+            except (ValueError, TypeError):
+                raise ValidationError(_("Could not parse {value} as a date and time.").format(value=value))


 class DecimalColumnMixin:
@@ -250,6 +256,9 @@ class SubeventColumnMixin:
        ]

    def clean(self, value, previous_values):
+        if not value:
+            return None
+
        if value in self._subevent_cache:
            return self._subevent_cache[value]

@@ -40,8 +40,8 @@ from phonenumbers import SUPPORTED_REGIONS

 from pretix.base.forms.questions import guess_country
 from pretix.base.modelimport import (
-    DatetimeColumnMixin, DecimalColumnMixin, ImportColumn, SubeventColumnMixin,
-    i18n_flat,
+    BooleanColumnMixin, DatetimeColumnMixin, DecimalColumnMixin, ImportColumn,
+    SubeventColumnMixin, i18n_flat,
 )
 from pretix.base.models import (
    Customer, ItemVariation, OrderPosition, Question, QuestionAnswer,
@@ -56,7 +56,7 @@ from pretix.base.signals import order_import_columns

 class EmailColumn(ImportColumn):
    identifier = 'email'
-    verbose_name = gettext_lazy('E-mail address')
+    verbose_name = gettext_lazy('Email address')

    def clean(self, value, previous_values):
        if value:
@@ -322,7 +322,7 @@ class AttendeeNamePart(ImportColumn):

 class AttendeeEmail(ImportColumn):
    identifier = 'attendee_email'
-    verbose_name = gettext_lazy('Attendee e-mail address')
+    verbose_name = gettext_lazy('Attendee email address')

    def clean(self, value, previous_values):
        if value:
@@ -604,6 +604,22 @@ class Comment(ImportColumn):
        order.comment = value or ''


+class CheckinAttentionColumn(BooleanColumnMixin, ImportColumn):
+    identifier = 'checkin_attention'
+    verbose_name = gettext_lazy('Requires special attention')
+
+    def assign(self, value, order, position, invoice_address, **kwargs):
+        order.checkin_attention = value
+
+
+class CheckinTextColumn(ImportColumn):
+    identifier = 'checkin_text'
+    verbose_name = gettext_lazy('Check-in text')
+
+    def assign(self, value, order, position, invoice_address, **kwargs):
+        order.checkin_text = value
+
+
 class QuestionColumn(ImportColumn):
    def __init__(self, event, q):
        self.q = q
@@ -742,6 +758,8 @@ def get_order_import_columns(event):
        ValidUntil(event),
        Locale(event),
        Saleschannel(event),
+        CheckinAttentionColumn(event),
+        CheckinTextColumn(event),
        Expires(event),
        Comment(event),
    ]
@@ -28,9 +28,9 @@ from django.utils.translation import gettext as _, gettext_lazy, pgettext_lazy

 from pretix.base.modelimport import (
    BooleanColumnMixin, DatetimeColumnMixin, DecimalColumnMixin, ImportColumn,
-    IntegerColumnMixin, i18n_flat,
+    IntegerColumnMixin, SubeventColumnMixin, i18n_flat,
 )
-from pretix.base.models import ItemVariation, Quota, Seat, Voucher
+from pretix.base.models import ItemVariation, Quota, Seat, SubEvent, Voucher
 from pretix.base.signals import voucher_import_columns


@@ -55,11 +55,11 @@ class CodeColumn(ImportColumn):
        obj.code = value


-class SubeventColumn(ImportColumn):
+class SubeventColumn(SubeventColumnMixin, ImportColumn):
    identifier = 'subevent'
    verbose_name = pgettext_lazy('subevents', 'Date')

-    def assign(self, value, obj: Voucher, **kwargs):
+    def assign(self, value, obj: SubEvent, **kwargs):
        obj.subevent = value


--- a/Show More
+++ b/Show More