remove console.log

Fixes PRETIXEU-5Q6

doc/_themes/pretix_theme/static/css/pretix.css

@@ -3155,14 +3155,14 @@ a .fa, a .wy-menu-vertical li span.toctree-expand, .wy-menu-vertical li a span.t
     vertical-align: -15%
 }
 
-.wy-alert, .rst-content .note, .rst-content .attention, .rst-content .caution, .rst-content .danger, .rst-content .error, .rst-content .hint, .rst-content .important, .rst-content .tip, .rst-content .warning, .rst-content .seealso, .rst-content .admonition-todo {
+.wy-alert, .rst-content .note, .rst-content .attention, .rst-content .caution, .rst-content .danger, .rst-content .error, .rst-content .hint, .rst-content .important, .rst-content .tip, .rst-content .warning, .rst-content .seealso, .rst-content .admonition-todo, .rst-content div.deprecated {
     padding: 12px;
     line-height: 24px;
     margin-bottom: 24px;
     background: #e7f2fa
 }
 
-.wy-alert-title, .rst-content .admonition-title {
+.wy-alert-title, .rst-content .admonition-title, .rst-content .deprecated .versionmodified {
     color: #fff;
     font-weight: bold;
     display: block;

doc/admin/installation/docker_smallscale.rst

@@ -240,6 +240,9 @@ The following snippet is an example on how to configure a nginx proxy for pretix
         listen 80 default_server;
         listen [::]:80 ipv6only=on default_server;
         server_name pretix.mydomain.com;
+        location / {
+            return 301 https://$host$request_uri;
+        }
     }
     server {
         listen 443 default_server;

doc/admin/installation/manual_smallscale.rst

@@ -225,6 +225,9 @@ The following snippet is an example on how to configure a nginx proxy for pretix
         listen 80 default_server;
         listen [::]:80 ipv6only=on default_server;
         server_name pretix.mydomain.com;
+        location / {
+            return 301 https://$host$request_uri;
+        }
     }
     server {
         listen 443 default_server;

doc/api/resources/checkin.rst

@@ -0,0 +1,346 @@
+.. spelling:: checkin
+
+.. _rest-checkin:
+
+Check-in
+========
+
+This page describes special APIs built for ticket scanning apps. For managing check-in configuration or other operations,
+please also see :ref:`rest-checkinlists`. The check-in list API also contains endpoints to obtain statistics or log
+failed scans.
+
+.. versionchanged:: 4.12
+
+    The endpoints listed on this page have been added.
+
+.. _`rest-checkin-redeem`:
+
+Checking a ticket in
+--------------------
+
+.. http:post:: /api/v1/organizers/(organizer)/checkinrpc/redeem/
+
+   Tries to redeem an order position, i.e. checks the attendee in (or out). This is the recommended endpoint to use
+   if you build any kind of scanning app that performs check-ins for scanned barcodes. It is safe to use with untrusted
+   inputs in the ``secret`` field.
+
+   This endpoint supports passing multiple check-in lists to perform a multi-event scan. However, each check-in list
+   passed needs to be from a distinct event.
+
+   :<json string secret: Scanned QR code corresponding to the ``secret`` attribute of a ticket.
+   :<json array lists: List of check-in list IDs to search on. No two check-in lists may be from the same event.
+   :<json string type: Send ``"exit"`` for an exit and ``"entry"`` (default) for an entry.
+   :<json datetime datetime: Specifies the datetime of the check-in. If not supplied, the current time will be used.
+   :<json boolean force: Specifies that the check-in should succeed regardless of revoked barcode, previous check-ins or required
+                         questions that have not been filled. This is usually used to upload offline scans that already happened,
+                         because there's no point in validating them since they happened whether they are valid or not. Defaults to ``false``.
+   :<json boolean questions_supported: When this parameter is set to ``true``, handling of questions is supported. If
+                                       you do not implement question handling in your user interface, you **must**
+                                       set this to ``false``. In that case, questions will just be ignored. Defaults
+                                       to ``true``.
+   :<json boolean ignore_unpaid: Specifies that the check-in should succeed even if the order is in pending state.
+                                 Defaults to ``false`` and only works when ``include_pending`` is set on the check-in
+                                 list.
+   :<json object answers: If questions are supported/required, you may/must supply a mapping of question IDs to their
+                          respective answers. The answers should always be strings. In case of (multiple-)choice-type
+                          answers, the string should contain the (comma-separated) IDs of the selected options.
+   :<json string nonce: You can set this parameter to a unique random value to identify this check-in. If you're sending
+                        this request twice with the same nonce, the second request will also succeed but will always
+                        create only one check-in object even when the previous request was successful as well. This
+                        allows for a certain level of idempotency and enables you to re-try after a connection failure.
+   :>json string status: ``"ok"``, ``"incomplete"``, or ``"error"``
+   :>json string reason: Reason code, only set on status ``"error"``, see below for possible values.
+   :>json string reason_explanation: Human-readable explanation, only set on status ``"error"`` and reason ``"rules"``, can be null.
+   :>json object position: Copy of the matching order position (if any was found). The contents are the same as the
+                           :ref:`order-position-resource`, with the following differences: (1) The ``checkins`` value
+                           will only include check-ins for the selected list. (2) An additional boolean property
+                           ``require_attention`` will inform you whether either the order or the item have the
+                           ``checkin_attention`` flag set. (3) If ``attendee_name`` is empty, it may automatically fall
+                           back to values from a parent product or from invoice addresses.
+   :>json boolean require_attention: Whether or not the ``require_attention`` flag is set on the item or order.
+   :>json object list: Excerpt of information about the matching :ref:`check-in list <rest-checkinlists>` (if any was found),
+                       including the attributes ``id``, ``name``, ``event``, ``subevent``, and ``include_pending``.
+   :>json object questions: List of questions to be answered for check-in, only set on status ``"incomplete"``.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/checkinrpc/redeem/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+      {
+        "secret": "M5BO19XmFwAjLd4nDYUAL9ISjhti0e9q",
+        "lists": [1],
+        "force": false,
+        "ignore_unpaid": false,
+        "nonce": "Pvrk50vUzQd0DhdpNRL4I4OcXsvg70uA",
+        "datetime": null,
+        "questions_supported": true,
+        "answers": {
+          "4": "XS"
+        }
+      }
+
+   **Example successful response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "status": "ok",
+        "position": {
+          …
+        },
+        "require_attention": false,
+        "list": {
+          "id": 1,
+          "name": "Default check-in list",
+          "event": "sampleconf",
+          "subevent": null,
+          "include_pending": false
+        }
+      }
+
+   **Example response with required questions**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 400 Bad Request
+      Content-Type: text/json
+
+      {
+        "status": "incomplete",
+        "position": {
+          …
+        },
+        "require_attention": false,
+        "list": {
+          "id": 1,
+          "name": "Default check-in list",
+          "event": "sampleconf",
+          "subevent": null,
+          "include_pending": false
+        },
+        "questions": [
+          {
+            "id": 1,
+            "question": {"en": "T-Shirt size"},
+            "type": "C",
+            "required": false,
+            "items": [1, 2],
+            "position": 1,
+            "identifier": "WY3TP9SL",
+            "ask_during_checkin": true,
+            "options": [
+              {
+                "id": 1,
+                "identifier": "LVETRWVU",
+                "position": 0,
+                "answer": {"en": "S"}
+              },
+              {
+                "id": 2,
+                "identifier": "DFEMJWMJ",
+                "position": 1,
+                "answer": {"en": "M"}
+              },
+              {
+                "id": 3,
+                "identifier": "W9AH7RDE",
+                "position": 2,
+                "answer": {"en": "L"}
+              }
+            ]
+          }
+        ]
+      }
+
+   **Example error response (invalid ticket)**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 404 Not Found
+      Content-Type: text/json
+
+      {
+        "detail": "Not found.",
+        "status": "error",
+        "reason": "invalid",
+        "reason_explanation": null,
+        "require_attention": false
+      }
+
+   **Example error response (known, but invalid ticket)**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Content-Type: text/json
+
+      {
+        "status": "error",
+        "reason": "unpaid",
+        "reason_explanation": null,
+        "require_attention": false,
+        "list": {
+          "id": 1,
+          "name": "Default check-in list",
+          "event": "sampleconf",
+          "subevent": null,
+          "include_pending": false
+        },
+        "position": {
+          …
+        }
+      }
+
+   Possible error reasons:
+
+   * ``invalid`` - Ticket is not known.
+   * ``unpaid`` - Ticket is not paid for.
+   * ``canceled`` – Ticket is canceled or expired.
+   * ``already_redeemed`` - Ticket already has been redeemed.
+   * ``product`` - Tickets with this product may not be scanned at this device.
+   * ``rules`` - Check-in prevented by a user-defined rule.
+   * ``ambiguous`` - Multiple tickets match scan, rejected.
+   * ``revoked`` - Ticket code has been revoked.
+   * ``error`` - Internal error.
+
+   In case of reason ``rules``, there might be an additional response field ``reason_explanation`` with a human-readable
+   description of the violated rules. However, that field can also be missing or be ``null``.
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :statuscode 201: no error
+   :statuscode 400: Invalid or incomplete request, see above
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested order position does not exist.
+
+Performing a ticket search
+--------------------------
+
+.. http:get:: /api/v1/organizers/(organizer)/checkinrpc/search/
+
+   Returns a list of all order positions matching a given search request. The result is the same as
+   the :ref:`order-position-resource`, with the following differences:
+
+   * The ``checkins`` value will only include check-ins for the selected list.
+
+   * An additional boolean property ``require_attention`` will inform you whether either the order or the item
+     have the ``checkin_attention`` flag set.
+
+   * If ``attendee_name`` is empty, it will automatically fall back to values from a parent product or from invoice
+     addresses.
+
+   This endpoint supports passing multiple check-in lists to perform a multi-event search. However, each check-in list
+   passed needs to be from a distinct event.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/checkinrpc/search/?list=1&search=Peter HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 23442,
+            "order": "ABC12",
+            "positionid": 1,
+            "item": 1345,
+            "variation": null,
+            "price": "23.00",
+            "attendee_name": "Peter",
+            "attendee_name_parts": {
+              "full_name": "Peter",
+            },
+            "attendee_email": null,
+            "voucher": null,
+            "tax_rate": "0.00",
+            "tax_rule": null,
+            "tax_value": "0.00",
+            "secret": "z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
+            "addon_to": null,
+            "subevent": null,
+            "pseudonymization_id": "MQLJvANO3B",
+            "seat": null,
+            "checkins": [
+              {
+                "list": 1,
+                "type": "entry",
+                "gate": null,
+                "device": 2,
+                "datetime": "2017-12-25T12:45:23Z",
+                "auto_checked_in": true
+              }
+            ],
+            "answers": [
+              {
+                "question": 12,
+                "answer": "Foo",
+                "options": []
+              }
+            ],
+            "downloads": [
+              {
+                "output": "pdf",
+                "url": "https://pretix.eu/api/v1/organizers/bigevents/events/sampleconf/orderpositions/23442/download/pdf/"
+              }
+            ]
+          }
+        ]
+      }
+
+   :query string search: Fuzzy search matching the attendee name, order code, invoice address name as well as to the beginning of the secret.
+   :query integer list: The check-in list to search on, can be passed multiple times.
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :query string ignore_status: If set to ``true``, results will be returned regardless of the state of
+                                 the order they belong to and you will need to do your own filtering by order status.
+   :query string ordering: Manually set the ordering of results. Valid fields to be used are ``order__code``,
+                           ``order__datetime``, ``positionid``, ``attendee_name``, ``last_checked_in`` and ``order__email``. Default:
+                           ``attendee_name,positionid``
+   :query string order: Only return positions of the order with the given order code
+   :query string search: Fuzzy search matching the attendee name, order code, invoice address name as well as to the beginning of the secret.
+   :query string expand: Expand a field into a full object. Currently only ``subevent``, ``item``, and ``variation`` are supported. Can be passed multiple times.
+   :query integer item: Only return positions with the purchased item matching the given ID.
+   :query integer item__in: Only return positions with the purchased item matching one of the given comma-separated IDs.
+   :query integer variation: Only return positions with the purchased item variation matching the given ID.
+   :query integer variation__in: Only return positions with one of the purchased item variation matching the given
+                                 comma-separated IDs.
+   :query string attendee_name: Only return positions with the given value in the attendee_name field. Also, add-on
+                                products positions are shown if they refer to an attendee with the given name.
+   :query string secret: Only return positions with the given ticket secret.
+   :query string order__status: Only return positions with the given order status.
+   :query string order__status__in: Only return positions with one the given comma-separated order status.
+   :query boolean has_checkin: If set to ``true`` or ``false``, only return positions that have or have not been
+                               checked in already.
+   :query integer subevent: Only return positions of the sub-event with the given ID
+   :query integer subevent__in: Only return positions of one of the sub-events with the given comma-separated IDs
+   :query integer addon_to: Only return positions that are add-ons to the position with the given ID.
+   :query integer addon_to__in: Only return positions that are add-ons to one of the positions with the given
+                                      comma-separated IDs.
+   :query string voucher: Only return positions with a specific voucher.
+   :query string voucher__code: Only return positions with a specific voucher code.
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer or check-in list does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested check-in list does not exist.

doc/api/resources/checkinlists.rst

@@ -1,5 +1,7 @@
 .. spelling:: checkin
 
+.. _rest-checkinlists:
+
 Check-in lists
 ==============
 
@@ -34,6 +36,7 @@ allow_multiple_entries                boolean                    If ``true``, su
 allow_entry_after_exit                boolean                    If ``true``, subsequent scans of a ticket on this list are valid if the last scan of the ticket was an exit scan.
 rules                                 object                     Custom check-in logic. The contents of this field are currently not considered a stable API and modifications through the API are highly discouraged.
 exit_all_at                           datetime                   Automatically check out (i.e. perform an exit scan) at this point in time. After this happened, this property will automatically be set exactly one day into the future. Note that this field is considered "internal configuration" and if you pull the list with ``If-Modified-Since``, the daily change in this field will not trigger a response.
+addon_match                           boolean                    If ``true``, tickets on this list can be redeemed by scanning their parent ticket if this still leads to an unambiguous match.
 ===================================== ========================== =======================================================
 
 .. versionchanged:: 3.9
@@ -53,6 +56,10 @@ exit_all_at                           datetime                   Automatically c
 
     The ``ends_after`` and ``expand`` query parameters have been added.
 
+.. versionchanged:: 4.12
+
+    The ``addon_match`` attribute has been added.
+
 Endpoints
 ---------
 
@@ -94,6 +101,7 @@ Endpoints
             "allow_entry_after_exit": true,
             "exit_all_at": null,
             "rules": {},
+            "addon_match": false,
             "auto_checkin_sales_channels": [
               "pretixpos"
             ]
@@ -146,6 +154,7 @@ Endpoints
         "allow_entry_after_exit": true,
         "exit_all_at": null,
         "rules": {},
+        "addon_match": false,
         "auto_checkin_sales_channels": [
           "pretixpos"
         ]
@@ -245,6 +254,7 @@ Endpoints
         "subevent": null,
         "allow_multiple_entries": false,
         "allow_entry_after_exit": true,
+        "addon_match": false,
         "auto_checkin_sales_channels": [
           "pretixpos"
         ]
@@ -269,6 +279,7 @@ Endpoints
         "subevent": null,
         "allow_multiple_entries": false,
         "allow_entry_after_exit": true,
+        "addon_match": false,
         "auto_checkin_sales_channels": [
           "pretixpos"
         ]
@@ -323,6 +334,7 @@ Endpoints
         "subevent": null,
         "allow_multiple_entries": false,
         "allow_entry_after_exit": true,
+        "addon_match": false,
         "auto_checkin_sales_channels": [
           "pretixpos"
         ]
@@ -415,6 +427,9 @@ Order position endpoints
    * If ``attendee_name`` is empty, it will automatically fall back to values from a parent product or from invoice
      addresses.
 
+   You can use this endpoint to implement a ticket search. We also provide a dedicated search input as part of our
+   :ref:`check-in API <rest-checkin>` that supports search across multiple events.
+
    **Example request**:
 
    .. sourcecode:: http
@@ -604,15 +619,23 @@ Order position endpoints
    :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
    :statuscode 404: The requested order position or check-in list does not exist.
 
-.. _`rest-checkin-redeem`:
-
 .. http:post:: /api/v1/organizers/(organizer)/events/(event)/checkinlists/(list)/positions/(id)/redeem/
 
    Tries to redeem an order position, identified by its internal ID, i.e. checks the attendee in. This endpoint
    accepts a number of optional requests in the body.
 
-   **Tip:** Instead of an ID, you can also use the ``secret`` field as the lookup parameter.
+   **Tip:** Instead of an ID, you can also use the ``secret`` field as the lookup parameter. In this case, you should
+   always set ``untrusted_input=true`` as a query parameter to avoid security issues.
 
+   .. note::
+
+      We no longer recommend using this API if you're building a ticket scanning application, as it has a few design
+      flaws that can lead to `security issues`_ or compatibility issues due to barcode content characters that are not
+      URL-safe. We recommend to use our new :ref:`check-in API <rest-checkin>` instead.
+
+   :query boolean untrusted_input: If set to true, the lookup parameter is **always** interpreted as a ``secret``, never
+                                   as an ``id``. This should be always set if you are passing through untrusted, scanned
+                                   data to avoid guessing of ticket IDs.
    :<json boolean questions_supported: When this parameter is set to ``true``, handling of questions is supported. If
                                        you do not implement question handling in your user interface, you **must**
                                        set this to ``false``. In that case, questions will just be ignored. Defaults
@@ -733,12 +756,15 @@ Order position endpoints
 
    Possible error reasons:
 
-   * ``unpaid`` - Ticket is not paid for
-   * ``canceled`` – Ticket is canceled or expired. This reason is only sent when your request sets
+   * ``invalid`` - Ticket code not known.
+   * ``unpaid`` - Ticket is not paid for.
+   * ``canceled`` – Ticket is canceled or expired. This reason is only sent when your request sets.
      ``canceled_supported`` to ``true``, otherwise these orders return ``unpaid``.
-   * ``already_redeemed`` - Ticket already has been redeemed
-   * ``product`` - Tickets with this product may not be scanned at this device
-   * ``rules`` - Check-in prevented by a user-defined rule
+   * ``already_redeemed`` - Ticket already has been redeemed.
+   * ``product`` - Tickets with this product may not be scanned at this device.
+   * ``rules`` - Check-in prevented by a user-defined rule.
+   * ``ambiguous`` - Multiple tickets match scan, rejected.
+   * ``revoked`` - Ticket code has been revoked.
 
    In case of reason ``rules``, there might be an additional response field ``reason_explanation`` with a human-readable
    description of the violated rules. However, that field can also be missing or be ``null``.
@@ -752,3 +778,6 @@ Order position endpoints
    :statuscode 401: Authentication failure
    :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
    :statuscode 404: The requested order position or check-in list does not exist.
+
+
+.. _security issues: https://pretix.eu/about/de/blog/20220705-release-4111/

doc/api/resources/customers.rst

@@ -131,7 +131,9 @@ Endpoints
 
 .. http:post:: /api/v1/organizers/(organizer)/customers/
 
-   Creates a new customer
+   Creates a new customer. In addition to the fields defined on the resource, you can pass the field ``send_email``
+   to control whether the system should send an account activation email with a password reset link (defaults to
+   ``false``).
 
    **Example request**:
 
@@ -143,7 +145,8 @@ Endpoints
       Content-Type: application/json
 
       {
-        "email": "test@example.org"
+        "email": "test@example.org",
+        "send_email": true
       }
 
    **Example response**:
@@ -173,8 +176,8 @@ Endpoints
    the resource, other fields will be reset to default. With ``PATCH``, you only need to provide the fields that you
    want to change.
 
-   You can change all fields of the resource except the ``identifier``, ``last_login``, ``date_joined``, ``name``,
-   and ``last_modified`` fields.
+   You can change all fields of the resource except the ``identifier``, ``last_login``, ``date_joined``,
+   ``name`` (which is auto-generated from ``name_parts``), and ``last_modified`` fields.
 
    **Example request**:
 

doc/api/resources/exporters.rst

@@ -182,7 +182,7 @@ endpoints:
       Content-Type: application/json
 
       {
-        "download": "https://pretix.eu/api/v1/organizers/bigevents/events/sampleconf/orderlist/download/29891ede-196f-4942-9e26-d055a36e98b8/3f279f13-c198-4137-b49b-9b360ce9fcce/"
+        "download": "https://pretix.eu/api/v1/organizers/bigevents/events/sampleconf/exporters/orderlist/download/29891ede-196f-4942-9e26-d055a36e98b8/3f279f13-c198-4137-b49b-9b360ce9fcce/"
       }
 
    :param organizer: The ``slug`` field of the organizer to fetch

doc/api/resources/index.rst

@@ -25,6 +25,7 @@ at :ref:`plugin-docs`.
    invoices
    vouchers
    discounts
+   checkin
    checkinlists
    waitinglist
    customers
@@ -37,6 +38,7 @@ at :ref:`plugin-docs`.
    webhooks
    seatingplans
    exporters
+   shredders
    sendmail_rules
    billing_invoices
    billing_var

doc/api/resources/orders.rst

@@ -60,6 +60,7 @@ invoice_address                       object                     Invoice address
 ├ state                               string                     Customer state (ISO 3166-2 code). Only supported in
                                                                  AU, BR, CA, CN, MY, MX, and US.
 ├ internal_reference                  string                     Customer's internal reference to be printed on the invoice
+├ custom_field                        string                     Custom invoice address field
 ├ vat_id                              string                     Customer VAT ID
 └ vat_id_validated                    string                     ``true``, if the VAT ID has been validated against the
                                                                  EU VAT service and validation was successful. This only
@@ -427,7 +428,7 @@ List of all orders
                            ``last_modified``, and ``status``. Default: ``datetime``
    :query string code: Only return orders that match the given order code
    :query string status: Only return orders in the given order status (see above)
-   :query string search: Only return orders matching a given search query
+   :query string search: Only return orders matching a given search query (matching for names, email addresses, and company names)
    :query integer item: Only return orders with a position that contains this item ID. *Warning:* Result will also include orders if they contain mixed items, and it will even return orders where the item is only contained in a canceled position.
    :query integer variation: Only return orders with a position that contains this variation ID. *Warning:* Result will also include orders if they contain mixed items and variations, and it will even return orders where the variation is only contained in a canceled position.
    :query boolean testmode: Only return orders with ``testmode`` set to ``true`` or ``false``
@@ -852,7 +853,7 @@ Creating orders
 
    You can supply the following fields of the resource:
 
-   * ``code`` (optional)
+   * ``code`` (optional) – Only ``A-Z`` and ``0-9``, but without ``O`` and ``1``.
    * ``status`` (optional) – Defaults to pending for non-free orders and paid for free orders. You can only set this to
      ``"n"`` for pending or ``"p"`` for paid. We will create a payment object for this order either in state ``created``
      or in state ``confirmed``, depending on this value. If you create a paid order, the ``order_paid`` signal will

doc/api/resources/quotas.rst

@@ -89,7 +89,8 @@ Endpoints
    :query integer page: The page number in case of a multi-page result set, default is 1
    :query string ordering: Manually set the ordering of results. Valid fields to be used are ``id`` and ``position``.
                            Default: ``position``
-   :query integer subevent: Only return quotas of the sub-event with the given ID
+   :query integer subevent: Only return quotas of the sub-event with the given ID.
+   :query integer subevent__in: Only return quotas of sub-events with one the given IDs (comma-separated).
    :query string with_availability: Set to ``true`` to get availability information. Can lead to increased answer times.
    :param organizer: The ``slug`` field of the organizer to fetch
    :param event: The ``slug`` field of the event to fetch

doc/api/resources/shredders.rst

@@ -0,0 +1,177 @@
+.. spelling:: checkin
+
+Data shredders
+==============
+
+pretix and it's plugins include a number of data shredders that allow you to clear personal information from the system.
+This page shows you how to use these shredders through the API.
+
+.. versionchanged:: 4.12
+
+   This feature has been added to the API.
+
+.. warning::
+
+   Unlike the user interface, the API will not force you to download tax-relevant data before you delete it.
+
+Listing available shredders
+---------------------------
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/shredders/
+
+   Returns a list of all exporters shredders for a given event.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/shredders/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "identifier": "question_answers",
+            "verbose_name": "Answers to questions"
+          }
+        ]
+      }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+
+Running an export
+-----------------
+
+Before you can delete data, you need to start a data export.
+Since exports often include large data sets, they might take longer than the duration of an HTTP request. Therefore,
+creating an export is a two-step process. First you need to start an export task with one of the following to API
+endpoints:
+
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/shredders/export/
+
+   Starts an export task. If your input parameters validate correctly, a ``202 Accepted`` status code is returned.
+   The body points you to the download URL of the result as well as the URL for the next step.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/shredders/export/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+      {
+        "shredders": ["question_answers"]
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 202 Accepted
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "download": "https://pretix.eu/api/v1/organizers/bigevents/events/sampleconf/shredders/download/29891ede-196f-4942-9e26-d055a36e98b8/3f279f13-c198-4137-b49b-9b360ce9fcce/",
+        "shred": "https://pretix.eu/api/v1/organizers/bigevents/events/sampleconf/shredders/shred/29891ede-196f-4942-9e26-d055a36e98b8/3f279f13-c198-4137-b49b-9b360ce9fcce/"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param identifier: The ``identifier`` field of the exporter to run
+   :statuscode 202: no error
+   :statuscode 400: Invalid input options or event data is not ready to be deleted
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+
+
+Downloading the result
+----------------------
+
+When starting an export, you receive a ``download`` URL for downloading the result. Running a ``GET`` request on that result will
+yield one of the following status codes:
+
+* ``200 OK`` – The export succeeded. The body will be your resulting file. Might be large!
+* ``409 Conflict`` – Your export is still running. The body will be JSON with the structure ``{"status": "running"}``. ``status`` can be ``waiting`` before the task is actually being processed. Please retry, but wait at least one second before you do.
+* ``410 Gone`` – Running the export has failed permanently. The body will be JSON with the structure ``{"status": "failed", "message": "Error message"}``
+* ``404 Not Found`` – The export does not exist / is expired / belongs to a different API key.
+
+
+Shredding the data
+------------------
+
+When starting an export, you receive a ``shred`` URL for actually shredding the data.
+You can only start the actual shredding process after the export file was generated, however you are not forced to download
+the file (we'd recommend it in most cases, though).
+The download will no longer be possible after the shredding.
+Since shredding often requires deleting large data sets, it might take longer than the duration of an HTTP request.
+Therefore, shredding again is a two-step process. First you need to start a shredder task with one of the following to API
+endpoints:
+
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/shredders/shred/(id1)/(id2)/
+
+   Starts an export task. If your input parameters validate correctly, a ``202 Accepted`` status code is returned.
+   The body points you to an URL you can use to check the status.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/shredders/shred/29891ede-196f-4942-9e26-d055a36e98b8/3f279f13-c198-4137-b49b-9b360ce9fcce/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 202 Accepted
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "status": "https://pretix.eu/api/v1/organizers/bigevents/events/sampleconf/shredders/status/29891ede-196f-4942-9e26-d055a36e98b8/3f279f13-c198-4137-b49b-9b360ce9fcce/"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param id1: Opaque value given to you in the previous response
+   :param id2: Opaque value given to you in the previous response
+   :statuscode 202: no error
+   :statuscode 400: Invalid input options
+   :statuscode 401: Authentication failure
+   :statuscode 404: The export does not exist / is expired / belongs to a different API key.
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+   :statuscode 409: Your export is still running. The body will be JSON with the structure ``{"status": "running"}``. ``status`` can be ``waiting`` before the task is actually being processed. Please retry, but wait at least one second before you do.
+   :statuscode 410: Either the job has timed out or running the export has failed permanently. The body will be JSON with the structure ``{"status": "failed", "message": "Error message"}``
+
+
+Checking the result
+-------------------
+
+When starting to shred, you receive a ``status`` URL for checking for success.
+Running a ``GET`` request on that result will yield one of the following status codes:
+
+* ``200 OK`` – The shredding succeeded.
+* ``409 Conflict`` – Shredding is still running. The body will be JSON with the structure ``{"status": "running"}``. ``status`` can be ``waiting`` before the task is actually being processed. Please retry, but wait at least one second before you do.
+* ``410 Gone`` – We no longer know about this process, probably the process was started more than an hour ago. Might also occur after successful operations on small pretix installations without asynchronous task handling.
+* ``417 Expectation Failed`` – Running the export has failed permanently. The body will be JSON with the structure ``{"status": "failed", "message": "Error message"}``

doc/images/checkin_offline.puml

@@ -2,8 +2,25 @@
 
 
 partition "data-based check" {
-    "Check based on local database" --> "Is the order in status PAID or PENDING\nand is the position not canceled?"
+    "Check based on local database" -down-> "Is addon_match set to true?"
     --> if "" then
+        -down->[no] "Is the order in status PAID or PENDING\nand is the position not canceled?"
+    else
+        -right->[yes] "Build a list that includes the position\nas well as all its add-ons"
+        -down-> "Filter list for products that are part of the check-in list"
+        --> if "" then
+            -down->[one found] Proceed with the matching position
+            --> "Is the order in status PAID or PENDING\nand is the position not canceled?"
+        else
+            --> if "" then
+                -right->[none found] "Return error PRODUCT  "
+            else
+                -down->[multiple found] Return error AMBIGUOUS
+            endif
+        endif
+    endif
+
+    "Is the order in status PAID or PENDING\nand is the position not canceled?" --> if "" then
         -right->[no] "Return error CANCELED"
     else
         -down->[yes] "Is the product part of the check-in list?"

doc/images/checkin_online.puml

@@ -19,8 +19,25 @@ else
 endif
 
 
-===CHECK=== -down-> "Is the order in status PAID or PENDING\nand is the position not canceled?"
+===CHECK=== -down-> "Is addon_match set to true?"
 --> if "" then
+    -down->[no] "Is the order in status PAID or PENDING\nand is the position not canceled?"
+else
+    -right->[yes] "Build a list that includes the position\nas well as all its add-ons"
+    -down-> "Filter list for products that are part of the check-in list"
+    --> if "" then
+        -down->[one found] Proceed with the matching position
+        --> "Is the order in status PAID or PENDING\nand is the position not canceled?"
+    else
+        --> if "" then
+            -right->[none found] "Return error PRODUCT  "
+        else
+            -down->[multiple found] Return error AMBIGUOUS
+        endif
+    endif
+endif
+
+"Is the order in status PAID or PENDING\nand is the position not canceled?" --> if "" then
     -right->[no] "Return error CANCELED"
 else
     -down->[yes] "Is the product part of the check-in list?"

doc/plugins/exhibitors.rst

@@ -532,6 +532,7 @@ event                                 object                     Object describi
 ├ imprint_url                         string                     URL to legal notice page. If not ``null``, a button in the app should link to this page.
 ├ privacy_url                         string                     URL to privacy notice page. If not ``null``, a button in the app should link to this page.
 ├ help_url                            string                     URL to help page. If not ``null``, a button in the app should link to this page.
+├ terms_url                           string                     URL to terms of service. If not ``null``, a button in the app should link to this page.
 ├ logo_url                            string                     URL to event logo. If not ``null``, this logo may be shown in the app.
 ├ slug                                string                     Event short form
 └ organizer                           string                     Organizer short form
@@ -567,6 +568,7 @@ scan_types                            list of objects            Only used for a
         "imprint_url": null,
         "privacy_url": null,
         "help_url": null,
+        "terms_url": null,
         "logo_url": null,
         "organizer": "sampleconf"
       },

doc/user/events/ticket_secrets.rst

@@ -90,6 +90,7 @@ Name and seat visible on scanner                yes
 Order-specific check-in attention flag          yes                                 yes                                 yes (except directly after sale)    n/a                               no
 Ticket search by order code or name             yes                                 yes                                 yes (except directly after sale)    no                                no
 Check-in statistics on scanner                  yes                                 yes                                 mostly accurate                     no                                no
+Support for add-on check-in with main ticket    yes                                 yes                                 yes (except directly after sale)    no                                no
 =============================================== =================================== =================================== =================================== ================================= =====================================
 
 .. _EdDSA: https://en.wikipedia.org/wiki/EdDSA#Ed25519

doc/user/events/widget.rst

@@ -135,6 +135,10 @@ Alternatively, you can select one or more categories to be shown::
 
    <pretix-widget event="https://pretix.eu/demo/democon/" categories="12,25"></pretix-widget>
 
+Or variation IDs::
+
+   <pretix-widget event="https://pretix.eu/demo/democon/" variations="15,2,68"></pretix-widget>
+
 Multi-event selection
 ---------------------
 

src/pretix/__init__.py

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "4.12.0.dev0"
+__version__ = "4.13.0.dev0"

src/pretix/api/auth/devicesecurity.py

@@ -68,6 +68,8 @@ class PretixScanSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:orderposition-pdf_image'),
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
+        ('POST', 'api-v1:checkinrpc.redeem'),
+        ('GET', 'api-v1:checkinrpc.search'),
     )
 
 
@@ -98,6 +100,8 @@ class PretixScanNoSyncNoSearchSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:orderposition-pdf_image'),
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
+        ('POST', 'api-v1:checkinrpc.redeem'),
+        ('GET', 'api-v1:checkinrpc.search'),
     )
 
 
@@ -129,6 +133,8 @@ class PretixScanNoSyncSecurityProfile(AllowListSecurityProfile):
         ('GET', 'api-v1:orderposition-pdf_image'),
         ('GET', 'api-v1:event.settings'),
         ('POST', 'api-v1:upload'),
+        ('POST', 'api-v1:checkinrpc.redeem'),
+        ('GET', 'api-v1:checkinrpc.search'),
     )
 
 
@@ -194,6 +200,8 @@ class PretixPosSecurityProfile(AllowListSecurityProfile):
         ('GET', 'plugins:pretix_seating:event.plan'),
         ('GET', 'plugins:pretix_seating:selection.simple'),
         ('POST', 'api-v1:upload'),
+        ('POST', 'api-v1:checkinrpc.redeem'),
+        ('GET', 'api-v1:checkinrpc.search'),
     )
 
 

src/pretix/api/serializers/checkin.py

@@ -26,7 +26,7 @@ from rest_framework.exceptions import ValidationError
 from pretix.api.serializers.event import SubEventSerializer
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
 from pretix.base.channels import get_all_sales_channels
-from pretix.base.models import CheckinList
+from pretix.base.models import Checkin, CheckinList
 
 
 class CheckinListSerializer(I18nAwareModelSerializer):
@@ -37,7 +37,7 @@ class CheckinListSerializer(I18nAwareModelSerializer):
         model = CheckinList
         fields = ('id', 'name', 'all_products', 'limit_products', 'subevent', 'checkin_count', 'position_count',
                   'include_pending', 'auto_checkin_sales_channels', 'allow_multiple_entries', 'allow_entry_after_exit',
-                  'rules', 'exit_all_at')
+                  'rules', 'exit_all_at', 'addon_match')
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -78,3 +78,31 @@ class CheckinListSerializer(I18nAwareModelSerializer):
         CheckinList.validate_rules(data.get('rules'))
 
         return data
+
+
+class CheckinRPCRedeemInputSerializer(serializers.Serializer):
+    lists = serializers.PrimaryKeyRelatedField(required=True, many=True, queryset=CheckinList.objects.none())
+    secret = serializers.CharField(required=True, allow_null=False)
+    force = serializers.BooleanField(default=False, required=False)
+    type = serializers.ChoiceField(choices=Checkin.CHECKIN_TYPES, default=Checkin.TYPE_ENTRY)
+    ignore_unpaid = serializers.BooleanField(default=False, required=False)
+    questions_supported = serializers.BooleanField(default=True, required=False)
+    nonce = serializers.CharField(required=False, allow_null=True)
+    datetime = serializers.DateTimeField(required=False, allow_null=True)
+    answers = serializers.JSONField(required=False, allow_null=True)
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['lists'].child_relation.queryset = CheckinList.objects.filter(event__in=self.context['events']).select_related('event')
+
+
+class MiniCheckinListSerializer(I18nAwareModelSerializer):
+    event = serializers.SlugRelatedField(slug_field='slug', read_only=True)
+    subevent = serializers.PrimaryKeyRelatedField(read_only=True)
+
+    class Meta:
+        model = CheckinList
+        fields = ('id', 'name', 'event', 'subevent', 'include_pending')
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)

src/pretix/api/serializers/event.py

@@ -54,7 +54,10 @@ from pretix.base.models.items import SubEventItem, SubEventItemVariation
 from pretix.base.services.seating import (
     SeatProtected, generate_seats, validate_plan_change,
 )
-from pretix.base.settings import LazyI18nStringList, validate_event_settings
+from pretix.base.settings import (
+    PERSON_NAME_SALUTATIONS, PERSON_NAME_SCHEMES, PERSON_NAME_TITLE_GROUPS,
+    LazyI18nStringList, validate_event_settings,
+)
 from pretix.base.signals import api_event_settings_fields
 
 logger = logging.getLogger(__name__)
@@ -762,6 +765,7 @@ class EventSettingsSerializer(SettingsSerializer):
         'cancel_allow_user_paid_adjust_fees_step',
         'cancel_allow_user_paid_refund_as_giftcard',
         'cancel_allow_user_paid_require_approval',
+        'cancel_allow_user_paid_require_approval_fee_unknown',
         'change_allow_user_variation',
         'change_allow_user_addons',
         'change_allow_user_until',
@@ -776,6 +780,7 @@ class EventSettingsSerializer(SettingsSerializer):
         'logo_image_large',
         'logo_show_title',
         'og_image',
+        'name_scheme',
     ]
 
     def __init__(self, *args, **kwargs):
@@ -841,4 +846,25 @@ class DeviceEventSettingsSerializer(EventSettingsSerializer):
         'invoice_address_from_country',
         'invoice_address_from_tax_id',
         'invoice_address_from_vat_id',
+        'name_scheme',
     ]
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['_name_scheme_fields'] = serializers.JSONField(
+            read_only=True,
+            default=[{"key": k, "label": str(v), "weight": w} for k, v, w, *__ in PERSON_NAME_SCHEMES.get(self.event.settings.name_scheme)['fields']]
+        )
+        self.fields['_name_scheme_salutations'] = serializers.JSONField(
+            read_only=True,
+            default=[{"key": k, "label": str(v)} for k, v in PERSON_NAME_SALUTATIONS]
+        )
+        self.fields['_name_scheme_titles'] = serializers.JSONField(
+            read_only=True,
+            default=(
+                [{"key": k, "label": k}
+                 for k in PERSON_NAME_TITLE_GROUPS.get(self.event.settings.name_scheme_titles)[1]]
+                if self.event.settings.name_scheme_titles
+                else []
+            )
+        )

src/pretix/api/serializers/item.py

@@ -184,8 +184,9 @@ class ItemSerializer(I18nAwareModelSerializer):
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        self.fields['require_membership_types'].queryset = self.context['event'].organizer.membership_types.all()
-        self.fields['grant_membership_type'].queryset = self.context['event'].organizer.membership_types.all()
+        if not self.read_only:
+            self.fields['require_membership_types'].queryset = self.context['event'].organizer.membership_types.all()
+            self.fields['grant_membership_type'].queryset = self.context['event'].organizer.membership_types.all()
 
     def validate(self, data):
         data = super().validate(data)

src/pretix/api/serializers/order.py

@@ -92,7 +92,7 @@ class InvoiceAddressSerializer(I18nAwareModelSerializer):
     class Meta:
         model = InvoiceAddress
         fields = ('last_modified', 'is_business', 'company', 'name', 'name_parts', 'street', 'zipcode', 'city', 'country',
-                  'state', 'vat_id', 'vat_id_validated', 'internal_reference')
+                  'state', 'vat_id', 'vat_id_validated', 'custom_field', 'internal_reference')
         read_only_fields = ('last_modified',)
 
     def __init__(self, *args, **kwargs):
@@ -341,10 +341,10 @@ class PdfDataSerializer(serializers.Field):
             # we serialize a list.
 
             if 'vars' not in self.context:
-                self.context['vars'] = get_variables(self.context['request'].event)
+                self.context['vars'] = get_variables(self.context['event'])
 
             if 'vars_images' not in self.context:
-                self.context['vars_images'] = get_images(self.context['request'].event)
+                self.context['vars_images'] = get_images(self.context['event'])
 
             for k, f in self.context['vars'].items():
                 try:
@@ -422,7 +422,14 @@ class OrderPositionSerializer(I18nAwareModelSerializer):
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         request = self.context.get('request')
-        if request and (not request.query_params.get('pdf_data', 'false') == 'true' or 'can_view_orders' not in request.eventpermset):
+        pdf_data_forbidden = (
+            # We check this based on permission if we are on /events/…/orders/ or /events/…/orderpositions/ or
+            # /events/…/checkinlists/…/positions/
+            # We're unable to check this on this level if we're on /checkinrpc/, in which case we rely on the view
+            # layer to not set pdf_data=true in the first place.
+            request and hasattr(request, 'event') and 'can_view_orders' not in request.eventpermset
+        )
+        if ('pdf_data' in self.context and not self.context['pdf_data']) or pdf_data_forbidden:
             self.fields.pop('pdf_data', None)
 
     def validate(self, data):
@@ -481,13 +488,13 @@ class CheckinListOrderPositionSerializer(OrderPositionSerializer):
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
 
-        if 'subevent' in self.context['request'].query_params.getlist('expand'):
+        if 'subevent' in self.context['expand']:
             self.fields['subevent'] = SubEventSerializer(read_only=True)
 
-        if 'item' in self.context['request'].query_params.getlist('expand'):
+        if 'item' in self.context['expand']:
             self.fields['item'] = ItemSerializer(read_only=True, context=self.context)
 
-        if 'variation' in self.context['request'].query_params.getlist('expand'):
+        if 'variation' in self.context['expand']:
             self.fields['variation'] = InlineItemVariationSerializer(read_only=True)
 
 
@@ -590,10 +597,10 @@ class OrderSerializer(I18nAwareModelSerializer):
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        if not self.context['request'].query_params.get('pdf_data', 'false') == 'true':
+        if not self.context['pdf_data']:
             self.fields['positions'].child.fields.pop('pdf_data', None)
 
-        for exclude_field in self.context['request'].query_params.getlist('exclude'):
+        for exclude_field in self.context['exclude']:
             p = exclude_field.split('.')
             if p[0] in self.fields:
                 if len(p) == 1:

src/pretix/api/serializers/orderchange.py

@@ -396,7 +396,6 @@ class OrderChangeOperationSerializer(serializers.Serializer):
     def validate(self, data):
         seen_positions = set()
         for d in data.get('patch_positions', []):
-            print(d, seen_positions)
             if d['position'] in seen_positions:
                 raise ValidationError({'patch_positions': ['You have specified the same object twice.']})
             seen_positions.add(d['position'])

src/pretix/api/serializers/organizer.py

@@ -75,6 +75,14 @@ class CustomerSerializer(I18nAwareModelSerializer):
                   'locale', 'last_modified', 'notes')
 
 
+class CustomerCreateSerializer(CustomerSerializer):
+    send_email = serializers.BooleanField(default=False, required=False, allow_null=True)
+
+    class Meta:
+        model = Customer
+        fields = CustomerSerializer.Meta.fields + ('send_email',)
+
+
 class MembershipTypeSerializer(I18nAwareModelSerializer):
 
     class Meta:

src/pretix/api/serializers/shredders.py

@@ -0,0 +1,36 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-2021 rami.io GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+from rest_framework import serializers
+
+
+class ShredderSerializer(serializers.Serializer):
+    identifier = serializers.CharField()
+    verbose_name = serializers.CharField()
+
+
+class JobRunSerializer(serializers.Serializer):
+    shredders = serializers.MultipleChoiceField(choices=[])
+
+    def __init__(self, *args, **kwargs):
+        shredders = kwargs.pop('shredders')
+        super().__init__(*args, **kwargs)
+        self.fields['shredders'].choices = ((k.identifier, k.identifier) for k in shredders)

src/pretix/api/urls.py

@@ -42,7 +42,8 @@ from pretix.api.views import cart
 
 from .views import (
     checkin, device, discount, event, exporters, idempotency, item, oauth,
-    order, organizer, upload, user, version, voucher, waitinglist, webhooks,
+    order, organizer, shredders, upload, user, version, voucher, waitinglist,
+    webhooks,
 )
 
 router = routers.DefaultRouter()
@@ -84,6 +85,7 @@ event_router.register(r'waitinglistentries', waitinglist.WaitingListViewSet)
 event_router.register(r'checkinlists', checkin.CheckinListViewSet)
 event_router.register(r'cartpositions', cart.CartPositionViewSet)
 event_router.register(r'exporters', exporters.EventExportersViewSet, basename='exporters')
+event_router.register(r'shredders', shredders.EventShreddersViewSet, basename='shredders')
 
 checkinlist_router = routers.DefaultRouter()
 checkinlist_router.register(r'positions', checkin.CheckinListPositionViewSet, basename='checkinlistpos')
@@ -112,6 +114,10 @@ for app in apps.get_app_configs():
 urlpatterns = [
     re_path(r'^', include(router.urls)),
     re_path(r'^organizers/(?P<organizer>[^/]+)/', include(orga_router.urls)),
+    re_path(r'^organizers/(?P<organizer>[^/]+)/checkinrpc/redeem/$', checkin.CheckinRPCRedeemView.as_view(),
+            name="checkinrpc.redeem"),
+    re_path(r'^organizers/(?P<organizer>[^/]+)/checkinrpc/search/$', checkin.CheckinRPCSearchView.as_view(),
+            name="checkinrpc.search"),
     re_path(r'^organizers/(?P<organizer>[^/]+)/settings/$', organizer.OrganizerSettingsView.as_view(),
             name="organizer.settings"),
     re_path(r'^organizers/(?P<organizer>[^/]+)/giftcards/(?P<giftcard>[^/]+)/', include(giftcard_router.urls)),

src/pretix/api/views/checkin.py

@@ -19,12 +19,16 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
+import operator
+from functools import reduce
+
 import django_filters
 from django.conf import settings
-from django.core.exceptions import ValidationError
+from django.core.exceptions import ValidationError as BaseValidationError
 from django.db import transaction
 from django.db.models import (
     Count, Exists, F, Max, OrderBy, OuterRef, Prefetch, Q, Subquery,
+    prefetch_related_objects,
 )
 from django.db.models.functions import Coalesce
 from django.http import Http404
@@ -34,13 +38,18 @@ from django.utils.timezone import now
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
 from packaging.version import parse
-from rest_framework import viewsets
+from rest_framework import views, viewsets
 from rest_framework.decorators import action
+from rest_framework.exceptions import PermissionDenied, ValidationError
 from rest_framework.fields import DateTimeField
+from rest_framework.generics import ListAPIView
 from rest_framework.permissions import SAFE_METHODS
 from rest_framework.response import Response
 
-from pretix.api.serializers.checkin import CheckinListSerializer
+from pretix.api.serializers.checkin import (
+    CheckinListSerializer, CheckinRPCRedeemInputSerializer,
+    MiniCheckinListSerializer,
+)
 from pretix.api.serializers.item import QuestionSerializer
 from pretix.api.serializers.order import (
     CheckinListOrderPositionSerializer, FailedCheckinSerializer,
@@ -50,7 +59,7 @@ from pretix.api.views.order import OrderPositionFilter
 from pretix.base.i18n import language
 from pretix.base.models import (
     CachedFile, Checkin, CheckinList, Device, Event, Order, OrderPosition,
-    Question,
+    Question, RevokedTicketSecret, TeamAPIToken,
 )
 from pretix.base.services.checkin import (
     CheckInError, RequiredQuestionsError, SQLLogic, perform_checkin,
@@ -265,6 +274,399 @@ with scopes_disabled():
             return queryset.filter(SQLLogic(self.checkinlist).apply(self.checkinlist.rules))
 
 
+def _handle_file_upload(data, user, auth):
+    try:
+        cf = CachedFile.objects.get(
+            session_key=f'api-upload-{str(type(user or auth))}-{(user or auth).pk}',
+            file__isnull=False,
+            pk=data[len("file:"):],
+        )
+    except (ValidationError, BaseValidationError, IndexError):  # invalid uuid
+        raise ValidationError('The submitted file ID "{fid}" was not found.'.format(fid=data))
+    except CachedFile.DoesNotExist:
+        raise ValidationError('The submitted file ID "{fid}" was not found.'.format(fid=data))
+
+    allowed_types = (
+        'image/png', 'image/jpeg', 'image/gif', 'application/pdf'
+    )
+    if cf.type not in allowed_types:
+        raise ValidationError('The submitted file "{fid}" has a file type that is not allowed in this field.'.format(fid=data))
+    if cf.file.size > settings.FILE_UPLOAD_MAX_SIZE_OTHER:
+        raise ValidationError('The submitted file "{fid}" is too large to be used in this field.'.format(fid=data))
+
+    return cf.file
+
+
+def _checkin_list_position_queryset(checkinlists, ignore_status=False, ignore_products=False, pdf_data=False, expand=None):
+    list_by_event = {cl.event_id: cl for cl in checkinlists}
+    if not checkinlists:
+        raise ValidationError('No check-in list passed.')
+    if len(list_by_event) != len(checkinlists):
+        raise ValidationError('Selecting two check-in lists from the same event is unsupported.')
+
+    cqs = Checkin.objects.filter(
+        position_id=OuterRef('pk'),
+        list_id__in=[cl.pk for cl in checkinlists]
+    ).order_by().values('position_id').annotate(
+        m=Max('datetime')
+    ).values('m')
+
+    qs = OrderPosition.objects.filter(
+        order__event__in=list_by_event.keys(),
+    ).annotate(
+        last_checked_in=Subquery(cqs)
+    ).prefetch_related('order__event', 'order__event__organizer')
+
+    lists_qs = []
+    for checkinlist in checkinlists:
+        list_q = Q(order__event_id=checkinlist.event_id)
+        if checkinlist.subevent:
+            list_q &= Q(subevent=checkinlist.subevent)
+        if not ignore_status:
+            list_q &= Q(order__status__in=[Order.STATUS_PAID, Order.STATUS_PENDING] if checkinlist.include_pending else [Order.STATUS_PAID])
+        if not checkinlist.all_products and not ignore_products:
+            list_q &= Q(item__in=checkinlist.limit_products.values_list('id', flat=True))
+        lists_qs.append(list_q)
+
+    qs = qs.filter(reduce(operator.or_, lists_qs))
+
+    if pdf_data:
+        qs = qs.prefetch_related(
+            Prefetch(
+                lookup='checkins',
+                queryset=Checkin.objects.filter(list_id__in=[cl.pk for cl in checkinlists])
+            ),
+            'answers', 'answers__options', 'answers__question',
+            Prefetch('addons', OrderPosition.objects.select_related('item', 'variation')),
+            Prefetch('order', Order.objects.select_related('invoice_address').prefetch_related(
+                Prefetch(
+                    'event',
+                    Event.objects.select_related('organizer')
+                ),
+                Prefetch(
+                    'positions',
+                    OrderPosition.objects.prefetch_related(
+                        Prefetch('checkins', queryset=Checkin.objects.all()),
+                        'item', 'variation', 'answers', 'answers__options', 'answers__question',
+                    )
+                )
+            ))
+        ).select_related(
+            'item', 'variation', 'item__category', 'addon_to', 'order', 'order__invoice_address', 'seat'
+        )
+    else:
+        qs = qs.prefetch_related(
+            Prefetch(
+                lookup='checkins',
+                queryset=Checkin.objects.filter(list_id__in=[cl.pk for cl in checkinlists])
+            ),
+            'answers', 'answers__options', 'answers__question',
+            Prefetch('addons', OrderPosition.objects.select_related('item', 'variation'))
+        ).select_related('item', 'variation', 'order', 'addon_to', 'order__invoice_address', 'order', 'seat')
+
+    if expand and 'subevent' in expand:
+        qs = qs.prefetch_related(
+            'subevent', 'subevent__event', 'subevent__subeventitem_set', 'subevent__subeventitemvariation_set',
+            'subevent__seat_category_mappings', 'subevent__meta_values'
+        )
+
+    if expand and 'item' in expand:
+        qs = qs.prefetch_related('item', 'item__addons', 'item__bundles', 'item__meta_values',
+                                 'item__variations').select_related('item__tax_rule')
+
+    if expand and 'variation' in expand:
+        qs = qs.prefetch_related('variation')
+
+    return qs
+
+
+def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force, checkin_type, ignore_unpaid, nonce,
+                    untrusted_input, user, auth, expand, pdf_data, request, questions_supported, canceled_supported,
+                    legacy_url_support=False):
+    if not checkinlists:
+        raise ValidationError('No check-in list passed.')
+
+    list_by_event = {cl.event_id: cl for cl in checkinlists}
+    prefetch_related_objects([cl for cl in checkinlists if not cl.all_products], 'limit_products')
+
+    device = auth if isinstance(auth, Device) else None
+    gate = auth.gate if isinstance(auth, Device) else None
+
+    context = {
+        'request': request,
+        'expand': expand,
+    }
+
+    def _make_context(context, event):
+        return {
+            **context,
+            'event': op.order.event,
+            'pdf_data': pdf_data and (
+                user if user and user.is_authenticated else auth
+            ).has_event_permission(request.organizer, event, 'can_view_orders', request),
+        }
+
+    common_checkin_args = dict(
+        raw_barcode=raw_barcode,
+        type=checkin_type,
+        list=checkinlists[0],
+        datetime=datetime,
+        device=device,
+        gate=gate,
+        nonce=nonce,
+        forced=force,
+    )
+    raw_barcode_for_checkin = None
+    from_revoked_secret = False
+
+    # 1. Gather a list of positions that could be the one we looking fore, either from their ID, secret or
+    #    parent secret
+    queryset = _checkin_list_position_queryset(checkinlists, pdf_data=pdf_data, ignore_status=True, ignore_products=True).order_by(
+        F('addon_to').asc(nulls_first=True)
+    )
+
+    q = Q(secret=raw_barcode)
+    if any(cl.addon_match for cl in checkinlists):
+        q |= Q(addon_to__secret=raw_barcode)
+    if raw_barcode.isnumeric() and not untrusted_input and legacy_url_support:
+        q |= Q(pk=raw_barcode)
+
+    op_candidates = list(queryset.filter(q))
+    if not op_candidates and '+' in raw_barcode and legacy_url_support:
+        # In application/x-www-form-urlencoded, you can encodes space ' ' with '+' instead of '%20'.
+        # `id`, however, is part of a path where this technically is not allowed. Old versions of our
+        # scan apps still do it, so we try work around it!
+        q = Q(secret=raw_barcode.replace('+', ' '))
+        if any(cl.addon_match for cl in checkinlists):
+            q |= Q(addon_to__secret=raw_barcode.replace('+', ' '))
+        op_candidates = list(queryset.filter(q))
+
+    # 2. Handle the "nothing found" case: Either it's really a bogus secret that we don't know (-> error), or it
+    #    might be a revoked one that we actually know (-> error, but with better error message and logging and
+    #    with respecting the force option).
+    if not op_candidates:
+        revoked_matches = list(RevokedTicketSecret.objects.filter(event_id__in=list_by_event.keys(), secret=raw_barcode))
+        if len(revoked_matches) == 0:
+            checkinlists[0].event.log_action('pretix.event.checkin.unknown', data={
+                'datetime': datetime,
+                'type': checkin_type,
+                'list': checkinlists[0].pk,
+                'barcode': raw_barcode,
+                'searched_lists': [cl.pk for cl in checkinlists]
+            }, user=user, auth=auth)
+
+            for cl in checkinlists:
+                for k, s in cl.event.ticket_secret_generators.items():
+                    try:
+                        parsed = s.parse_secret(raw_barcode)
+                        common_checkin_args.update({
+                            'raw_item': parsed.item,
+                            'raw_variation': parsed.variation,
+                            'raw_subevent': parsed.subevent,
+                        })
+                    except:
+                        pass
+
+            Checkin.objects.create(
+                position=None,
+                successful=False,
+                error_reason=Checkin.REASON_INVALID,
+                **common_checkin_args,
+            )
+
+            if force and legacy_url_support and isinstance(auth, Device):
+                # There was a bug in libpretixsync: If you scanned a ticket in offline mode that was
+                # valid at the time but no longer exists at time of upload, the device would retry to
+                # upload the same scan over and over again. Since we can't update all devices quickly,
+                # here's a dirty workaround to make it stop.
+                try:
+                    brand = auth.software_brand
+                    ver = parse(auth.software_version)
+                    legacy_mode = (
+                        (brand == 'pretixSCANPROXY' and ver < parse('0.0.3')) or
+                        (brand == 'pretixSCAN Android' and ver < parse('1.11.2')) or
+                        (brand == 'pretixSCAN' and ver < parse('1.11.2'))
+                    )
+                    if legacy_mode:
+                        return Response({
+                            'status': 'error',
+                            'reason': Checkin.REASON_ALREADY_REDEEMED,
+                            'reason_explanation': None,
+                            'require_attention': False,
+                            '__warning': 'Compatibility hack active due to detected old pretixSCAN version',
+                        }, status=400)
+                except:  # we don't care e.g. about invalid version numbers
+                    pass
+
+            return Response({
+                'detail': 'Not found.',  # for backwards compatibility
+                'status': 'error',
+                'reason': Checkin.REASON_INVALID,
+                'reason_explanation': None,
+                'require_attention': False,
+                'list': MiniCheckinListSerializer(checkinlists[0]).data,
+            }, status=404)
+        elif revoked_matches and force:
+            op_candidates = [revoked_matches[0].position]
+            if list_by_event[revoked_matches[0].event_id].addon_match:
+                op_candidates += list(revoked_matches[0].position.addons.all())
+            raw_barcode_for_checkin = raw_barcode
+            from_revoked_secret = True
+        else:
+            op = revoked_matches[0].position
+            op.order.log_action('pretix.event.checkin.revoked', data={
+                'datetime': datetime,
+                'type': checkin_type,
+                'list': list_by_event[revoked_matches[0].event_id].pk,
+                'barcode': raw_barcode
+            }, user=user, auth=auth)
+            common_checkin_args['list'] = list_by_event[revoked_matches[0].event_id]
+            Checkin.objects.create(
+                position=op,
+                successful=False,
+                error_reason=Checkin.REASON_REVOKED,
+                **common_checkin_args
+            )
+            return Response({
+                'status': 'error',
+                'reason': Checkin.REASON_REVOKED,
+                'reason_explanation': None,
+                'require_attention': False,
+                'position': CheckinListOrderPositionSerializer(op, context=_make_context(context, revoked_matches[0].event)).data,
+                'list': MiniCheckinListSerializer(list_by_event[revoked_matches[0].event_id]).data,
+            }, status=400)
+
+    # 3. Handle the "multiple options found" case: Except for the unlikely case of a secret being also a valid primary
+    #    key on the same list, we're probably dealing with the ``addon_match`` case here and need to figure out
+    #    which add-on has the right product.
+    if len(op_candidates) > 1:
+        op_candidates_matching_product = [
+            op for op in op_candidates
+            if (
+                (list_by_event[op.order.event_id].addon_match or op.secret == raw_barcode or legacy_url_support) and
+                (list_by_event[op.order.event_id].all_products or op.item_id in {i.pk for i in list_by_event[op.order.event_id].limit_products.all()})
+            )
+        ]
+
+        if len(op_candidates_matching_product) == 0:
+            # None of the found add-ons has the correct product, too bad! We could just error out here, but
+            # instead we just continue with *any* product and have it rejected by the check in perform_checkin.
+            # This has the advantage of a better error message.
+            op_candidates = [op_candidates[0]]
+        elif len(op_candidates_matching_product) > 1:
+            # It's still ambiguous, we'll error out.
+            # We choose the first match (regardless of product) for the logging since it's most likely to be the
+            # base product according to our order_by above.
+            op = op_candidates[0]
+            op.order.log_action('pretix.event.checkin.denied', data={
+                'position': op.id,
+                'positionid': op.positionid,
+                'errorcode': Checkin.REASON_AMBIGUOUS,
+                'reason_explanation': None,
+                'force': force,
+                'datetime': datetime,
+                'type': checkin_type,
+                'list': list_by_event[op.order.event_id].pk,
+            }, user=user, auth=auth)
+            common_checkin_args['list'] = list_by_event[op.order.event_id]
+            Checkin.objects.create(
+                position=op,
+                successful=False,
+                error_reason=Checkin.REASON_AMBIGUOUS,
+                error_explanation=None,
+                **common_checkin_args,
+            )
+            return Response({
+                'status': 'error',
+                'reason': Checkin.REASON_AMBIGUOUS,
+                'reason_explanation': None,
+                'require_attention': op.item.checkin_attention or op.order.checkin_attention,
+                'position': CheckinListOrderPositionSerializer(op, context=_make_context(context, op.order.event)).data,
+                'list': MiniCheckinListSerializer(list_by_event[op.order.event_id]).data,
+            }, status=400)
+        else:
+            op_candidates = op_candidates_matching_product
+
+    op = op_candidates[0]
+    common_checkin_args['list'] = list_by_event[op.order.event_id]
+
+    # 5. Pre-validate all incoming answers, handle file upload
+    given_answers = {}
+    if answers_data:
+        for q in op.item.questions.filter(ask_during_checkin=True):
+            if str(q.pk) in answers_data:
+                try:
+                    if q.type == Question.TYPE_FILE:
+                        given_answers[q] = _handle_file_upload(answers_data[str(q.pk)], user, auth)
+                    else:
+                        given_answers[q] = q.clean_answer(answers_data[str(q.pk)])
+                except (ValidationError, BaseValidationError):
+                    pass
+
+    # 6. Pass to our actual check-in logic
+    with language(op.order.event.settings.locale):
+        try:
+            perform_checkin(
+                op=op,
+                clist=list_by_event[op.order.event_id],
+                given_answers=given_answers,
+                force=force,
+                ignore_unpaid=ignore_unpaid,
+                nonce=nonce,
+                datetime=datetime,
+                questions_supported=questions_supported,
+                canceled_supported=canceled_supported,
+                user=user,
+                auth=auth,
+                type=checkin_type,
+                raw_barcode=raw_barcode_for_checkin,
+                from_revoked_secret=from_revoked_secret,
+            )
+        except RequiredQuestionsError as e:
+            return Response({
+                'status': 'incomplete',
+                'require_attention': op.item.checkin_attention or op.order.checkin_attention,
+                'position': CheckinListOrderPositionSerializer(op, context=_make_context(context, op.order.event)).data,
+                'questions': [
+                    QuestionSerializer(q).data for q in e.questions
+                ],
+                'list': MiniCheckinListSerializer(list_by_event[op.order.event_id]).data,
+            }, status=400)
+        except CheckInError as e:
+            op.order.log_action('pretix.event.checkin.denied', data={
+                'position': op.id,
+                'positionid': op.positionid,
+                'errorcode': e.code,
+                'reason_explanation': e.reason,
+                'force': force,
+                'datetime': datetime,
+                'type': checkin_type,
+                'list': list_by_event[op.order.event_id].pk,
+            }, user=user, auth=auth)
+            Checkin.objects.create(
+                position=op,
+                successful=False,
+                error_reason=e.code,
+                error_explanation=e.reason,
+                **common_checkin_args,
+            )
+            return Response({
+                'status': 'error',
+                'reason': e.code,
+                'reason_explanation': e.reason,
+                'require_attention': op.item.checkin_attention or op.order.checkin_attention,
+                'position': CheckinListOrderPositionSerializer(op, context=_make_context(context, op.order.event)).data,
+                'list': MiniCheckinListSerializer(list_by_event[op.order.event_id]).data,
+            }, status=400)
+        else:
+            return Response({
+                'status': 'ok',
+                'require_attention': op.item.checkin_attention or op.order.checkin_attention,
+                'position': CheckinListOrderPositionSerializer(op, context=_make_context(context, op.order.event)).data,
+                'list': MiniCheckinListSerializer(list_by_event[op.order.event_id]).data,
+            }, status=201)
+
+
 class ExtendedBackend(DjangoFilterBackend):
     def get_filterset_kwargs(self, request, queryset, view):
         kwargs = super().get_filterset_kwargs(request, queryset, view)
@@ -280,7 +682,7 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
     serializer_class = CheckinListOrderPositionSerializer
     queryset = OrderPosition.all.none()
     filter_backends = (ExtendedBackend, RichOrderingFilter)
-    ordering = ('attendee_name_cached', 'positionid')
+    ordering = (F('attendee_name_cached').asc(nulls_last=True), 'positionid')
     ordering_fields = (
         'order__code', 'order__datetime', 'positionid', 'attendee_name',
         'last_checked_in', 'order__email',
@@ -309,6 +711,8 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
     def get_serializer_context(self):
         ctx = super().get_serializer_context()
         ctx['event'] = self.request.event
+        ctx['expand'] = self.request.query_params.getlist('expand')
+        ctx['pdf_data'] = self.request.query_params.get('pdf_data', 'false') == 'true'
         return ctx
 
     def get_filterset_kwargs(self):
@@ -319,80 +723,18 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
     @cached_property
     def checkinlist(self):
         try:
-            return get_object_or_404(CheckinList, event=self.request.event, pk=self.kwargs.get("list"))
+            return get_object_or_404(self.request.event.checkin_lists, pk=self.kwargs.get("list"))
         except ValueError:
             raise Http404()
 
     def get_queryset(self, ignore_status=False, ignore_products=False):
-        cqs = Checkin.objects.filter(
-            position_id=OuterRef('pk'),
-            list_id=self.checkinlist.pk
-        ).order_by().values('position_id').annotate(
-            m=Max('datetime')
-        ).values('m')
-
-        qs = OrderPosition.objects.filter(
-            order__event=self.request.event,
-        ).annotate(
-            last_checked_in=Subquery(cqs)
-        ).prefetch_related('order__event', 'order__event__organizer')
-        if self.checkinlist.subevent:
-            qs = qs.filter(
-                subevent=self.checkinlist.subevent
-            )
-
-        if self.request.query_params.get('ignore_status', 'false') != 'true' and not ignore_status:
-            qs = qs.filter(
-                order__status__in=[Order.STATUS_PAID, Order.STATUS_PENDING] if self.checkinlist.include_pending else [Order.STATUS_PAID]
-            )
-        if self.request.query_params.get('pdf_data', 'false') == 'true':
-            qs = qs.prefetch_related(
-                Prefetch(
-                    lookup='checkins',
-                    queryset=Checkin.objects.filter(list_id=self.checkinlist.pk)
-                ),
-                'answers', 'answers__options', 'answers__question',
-                Prefetch('addons', OrderPosition.objects.select_related('item', 'variation')),
-                Prefetch('order', Order.objects.select_related('invoice_address').prefetch_related(
-                    Prefetch(
-                        'event',
-                        Event.objects.select_related('organizer')
-                    ),
-                    Prefetch(
-                        'positions',
-                        OrderPosition.objects.prefetch_related(
-                            Prefetch('checkins', queryset=Checkin.objects.all()),
-                            'item', 'variation', 'answers', 'answers__options', 'answers__question',
-                        )
-                    )
-                ))
-            ).select_related(
-                'item', 'variation', 'item__category', 'addon_to', 'order', 'order__invoice_address', 'seat'
-            )
-        else:
-            qs = qs.prefetch_related(
-                Prefetch(
-                    lookup='checkins',
-                    queryset=Checkin.objects.filter(list_id=self.checkinlist.pk)
-                ),
-                'answers', 'answers__options', 'answers__question',
-                Prefetch('addons', OrderPosition.objects.select_related('item', 'variation'))
-            ).select_related('item', 'variation', 'order', 'addon_to', 'order__invoice_address', 'order', 'seat')
-
-        if not self.checkinlist.all_products and not ignore_products:
-            qs = qs.filter(item__in=self.checkinlist.limit_products.values_list('id', flat=True))
-
-        if 'subevent' in self.request.query_params.getlist('expand'):
-            qs = qs.prefetch_related(
-                'subevent', 'subevent__event', 'subevent__subeventitem_set', 'subevent__subeventitemvariation_set',
-                'subevent__seat_category_mappings', 'subevent__meta_values'
-            )
-
-        if 'item' in self.request.query_params.getlist('expand'):
-            qs = qs.prefetch_related('item', 'item__addons', 'item__bundles', 'item__meta_values', 'item__variations').select_related('item__tax_rule')
-
-        if 'variation' in self.request.query_params.getlist('expand'):
-            qs = qs.prefetch_related('variation')
+        qs = _checkin_list_position_queryset(
+            [self.checkinlist],
+            ignore_status=self.request.query_params.get('ignore_status', 'false') == 'true' or ignore_status,
+            ignore_products=ignore_products,
+            pdf_data=self.request.query_params.get('pdf_data', 'false') == 'true',
+            expand=self.request.query_params.getlist('expand'),
+        )
 
         if 'pk' not in self.request.resolver_match.kwargs and 'can_view_orders' not in self.request.eventpermset \
                 and len(self.request.query_params.get('search', '')) < 3:
@@ -403,217 +745,153 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
     @action(detail=False, methods=['POST'], url_name='redeem', url_path='(?P<pk>.*)/redeem')
     def redeem(self, *args, **kwargs):
         force = bool(self.request.data.get('force', False))
-        type = self.request.data.get('type', None) or Checkin.TYPE_ENTRY
-        if type not in dict(Checkin.CHECKIN_TYPES):
+        checkin_type = self.request.data.get('type', None) or Checkin.TYPE_ENTRY
+        if checkin_type not in dict(Checkin.CHECKIN_TYPES):
             raise ValidationError("Invalid check-in type.")
         ignore_unpaid = bool(self.request.data.get('ignore_unpaid', False))
         nonce = self.request.data.get('nonce')
+        untrusted_input = (
+            self.request.GET.get('untrusted_input', '') not in ('0', 'false', 'False', '')
+            or (isinstance(self.request.auth, Device) and 'pretixscan' in (self.request.auth.software_brand or '').lower())
+        )
 
         if 'datetime' in self.request.data:
             dt = DateTimeField().to_internal_value(self.request.data.get('datetime'))
         else:
             dt = now()
 
-        common_checkin_args = dict(
-            raw_barcode=self.kwargs['pk'],
-            type=type,
-            list=self.checkinlist,
+        answers_data = self.request.data.get('answers')
+        return _redeem_process(
+            checkinlists=[self.checkinlist],
+            raw_barcode=kwargs['pk'],
+            answers_data=answers_data,
             datetime=dt,
-            device=self.request.auth if isinstance(self.request.auth, Device) else None,
-            gate=self.request.auth.gate if isinstance(self.request.auth, Device) else None,
+            force=force,
+            checkin_type=checkin_type,
+            ignore_unpaid=ignore_unpaid,
             nonce=nonce,
-            forced=force,
+            untrusted_input=untrusted_input,
+            user=self.request.user,
+            auth=self.request.auth,
+            expand=self.request.query_params.getlist('expand'),
+            pdf_data=self.request.query_params.get('pdf_data', 'false') == 'true',
+            questions_supported=self.request.data.get('questions_supported', True),
+            canceled_supported=self.request.data.get('canceled_supported', False),
+            request=self.request,  # this is not clean, but we need it in the serializers for URL generation
+            legacy_url_support=True,
         )
-        raw_barcode_for_checkin = None
-        from_revoked_secret = False
 
-        try:
-            queryset = self.get_queryset(ignore_status=True, ignore_products=True)
-            if self.kwargs['pk'].isnumeric():
-                op = queryset.get(Q(pk=self.kwargs['pk']) | Q(secret=self.kwargs['pk']))
-            else:
-                # In application/x-www-form-urlencoded, you can encodes space ' ' with '+' instead of '%20'.
-                # `id`, however, is part of a path where this technically is not allowed. Old versions of our
-                # scan apps still do it, so we try work around it!
-                try:
-                    op = queryset.get(secret=self.kwargs['pk'])
-                except OrderPosition.DoesNotExist:
-                    op = queryset.get(secret=self.kwargs['pk'].replace('+', ' '))
-        except OrderPosition.DoesNotExist:
-            revoked_matches = list(self.request.event.revoked_secrets.filter(secret=self.kwargs['pk']))
-            if len(revoked_matches) == 0:
-                self.request.event.log_action('pretix.event.checkin.unknown', data={
-                    'datetime': dt,
-                    'type': type,
-                    'list': self.checkinlist.pk,
-                    'barcode': self.kwargs['pk']
-                }, user=self.request.user, auth=self.request.auth)
 
-                for k, s in self.request.event.ticket_secret_generators.items():
-                    try:
-                        parsed = s.parse_secret(self.kwargs['pk'])
-                        common_checkin_args.update({
-                            'raw_item': parsed.item,
-                            'raw_variation': parsed.variation,
-                            'raw_subevent': parsed.subevent,
-                        })
-                    except:
-                        pass
-
-                Checkin.objects.create(
-                    position=None,
-                    successful=False,
-                    error_reason=Checkin.REASON_INVALID,
-                    **common_checkin_args,
-                )
-
-                if force and isinstance(self.request.auth, Device):
-                    # There was a bug in libpretixsync: If you scanned a ticket in offline mode that was
-                    # valid at the time but no longer exists at time of upload, the device would retry to
-                    # upload the same scan over and over again. Since we can't update all devices quickly,
-                    # here's a dirty workaround to make it stop.
-                    try:
-                        brand = self.request.auth.software_brand
-                        ver = parse(self.request.auth.software_version)
-                        legacy_mode = (
-                            (brand == 'pretixSCANPROXY' and ver < parse('0.0.3')) or
-                            (brand == 'pretixSCAN Android' and ver < parse('1.11.2')) or
-                            (brand == 'pretixSCAN' and ver < parse('1.11.2'))
-                        )
-                        if legacy_mode:
-                            return Response({
-                                'status': 'error',
-                                'reason': Checkin.REASON_ALREADY_REDEEMED,
-                                'reason_explanation': None,
-                                'require_attention': False,
-                                '__warning': 'Compatibility hack active due to detected old pretixSCAN version',
-                            }, status=400)
-                    except:  # we don't care e.g. about invalid version numbers
-                        pass
-
-                return Response({
-                    'detail': 'Not found.',  # for backwards compatibility
-                    'status': 'error',
-                    'reason': Checkin.REASON_INVALID,
-                    'reason_explanation': None,
-                    'require_attention': False,
-                }, status=404)
-            elif revoked_matches and force:
-                op = revoked_matches[0].position
-                raw_barcode_for_checkin = self.kwargs['pk']
-                from_revoked_secret = True
-            else:
-                op = revoked_matches[0].position
-                op.order.log_action('pretix.event.checkin.revoked', data={
-                    'datetime': dt,
-                    'type': type,
-                    'list': self.checkinlist.pk,
-                    'barcode': self.kwargs['pk']
-                }, user=self.request.user, auth=self.request.auth)
-                Checkin.objects.create(
-                    position=op,
-                    successful=False,
-                    error_reason=Checkin.REASON_REVOKED,
-                    **common_checkin_args
-                )
-                return Response({
-                    'status': 'error',
-                    'reason': Checkin.REASON_REVOKED,
-                    'reason_explanation': None,
-                    'require_attention': False,
-                    'position': CheckinListOrderPositionSerializer(op, context=self.get_serializer_context()).data
-                }, status=400)
-
-        given_answers = {}
-        if 'answers' in self.request.data:
-            aws = self.request.data.get('answers')
-            for q in op.item.questions.filter(ask_during_checkin=True):
-                if str(q.pk) in aws:
-                    try:
-                        if q.type == Question.TYPE_FILE:
-                            given_answers[q] = self._handle_file_upload(aws[str(q.pk)])
-                        else:
-                            given_answers[q] = q.clean_answer(aws[str(q.pk)])
-                    except ValidationError:
-                        pass
-
-        with language(self.request.event.settings.locale):
-            try:
-                perform_checkin(
-                    op=op,
-                    clist=self.checkinlist,
-                    given_answers=given_answers,
-                    force=force,
-                    ignore_unpaid=ignore_unpaid,
-                    nonce=nonce,
-                    datetime=dt,
-                    questions_supported=self.request.data.get('questions_supported', True),
-                    canceled_supported=self.request.data.get('canceled_supported', False),
-                    user=self.request.user,
-                    auth=self.request.auth,
-                    type=type,
-                    raw_barcode=raw_barcode_for_checkin,
-                    from_revoked_secret=from_revoked_secret,
-                )
-            except RequiredQuestionsError as e:
-                return Response({
-                    'status': 'incomplete',
-                    'require_attention': op.item.checkin_attention or op.order.checkin_attention,
-                    'position': CheckinListOrderPositionSerializer(op, context=self.get_serializer_context()).data,
-                    'questions': [
-                        QuestionSerializer(q).data for q in e.questions
-                    ]
-                }, status=400)
-            except CheckInError as e:
-                op.order.log_action('pretix.event.checkin.denied', data={
-                    'position': op.id,
-                    'positionid': op.positionid,
-                    'errorcode': e.code,
-                    'reason_explanation': e.reason,
-                    'force': force,
-                    'datetime': dt,
-                    'type': type,
-                    'list': self.checkinlist.pk
-                }, user=self.request.user, auth=self.request.auth)
-                Checkin.objects.create(
-                    position=op,
-                    successful=False,
-                    error_reason=e.code,
-                    error_explanation=e.reason,
-                    **common_checkin_args,
-                )
-                return Response({
-                    'status': 'error',
-                    'reason': e.code,
-                    'reason_explanation': e.reason,
-                    'require_attention': op.item.checkin_attention or op.order.checkin_attention,
-                    'position': CheckinListOrderPositionSerializer(op, context=self.get_serializer_context()).data
-                }, status=400)
-            else:
-                return Response({
-                    'status': 'ok',
-                    'require_attention': op.item.checkin_attention or op.order.checkin_attention,
-                    'position': CheckinListOrderPositionSerializer(op, context=self.get_serializer_context()).data
-                }, status=201)
-
-    def _handle_file_upload(self, data):
-        try:
-            cf = CachedFile.objects.get(
-                session_key=f'api-upload-{str(type(self.request.user or self.request.auth))}-{(self.request.user or self.request.auth).pk}',
-                file__isnull=False,
-                pk=data[len("file:"):],
+class CheckinRPCRedeemView(views.APIView):
+    def post(self, request, *args, **kwargs):
+        if isinstance(self.request.auth, (TeamAPIToken, Device)):
+            events = self.request.auth.get_events_with_permission(('can_change_orders', 'can_checkin_orders'))
+        elif self.request.user.is_authenticated:
+            events = self.request.user.get_events_with_permission(('can_change_orders', 'can_checkin_orders'), self.request).filter(
+                organizer=self.request.organizer
             )
-        except (ValidationError, IndexError):  # invalid uuid
-            raise ValidationError('The submitted file ID "{fid}" was not found.'.format(fid=data))
-        except CachedFile.DoesNotExist:
-            raise ValidationError('The submitted file ID "{fid}" was not found.'.format(fid=data))
+        else:
+            raise ValueError("unknown authentication method")
 
-        allowed_types = (
-            'image/png', 'image/jpeg', 'image/gif', 'application/pdf'
+        s = CheckinRPCRedeemInputSerializer(data=request.data, context={'events': events})
+        s.is_valid(raise_exception=True)
+        return _redeem_process(
+            checkinlists=s.validated_data['lists'],
+            raw_barcode=s.validated_data['secret'],
+            answers_data=s.validated_data.get('answers'),
+            datetime=s.validated_data.get('datetime') or now(),
+            force=s.validated_data['force'],
+            checkin_type=s.validated_data['type'],
+            ignore_unpaid=s.validated_data['ignore_unpaid'],
+            nonce=s.validated_data.get('nonce'),
+            untrusted_input=True,
+            user=self.request.user,
+            auth=self.request.auth,
+            expand=self.request.query_params.getlist('expand'),
+            pdf_data=self.request.query_params.get('pdf_data', 'false') == 'true',
+            questions_supported=s.validated_data['questions_supported'],
+            canceled_supported=True,
+            request=self.request,  # this is not clean, but we need it in the serializers for URL generation
+            legacy_url_support=False,
         )
-        if cf.type not in allowed_types:
-            raise ValidationError('The submitted file "{fid}" has a file type that is not allowed in this field.'.format(fid=data))
-        if cf.file.size > settings.FILE_UPLOAD_MAX_SIZE_OTHER:
-            raise ValidationError('The submitted file "{fid}" is too large to be used in this field.'.format(fid=data))
 
-        return cf.file
+
+class CheckinRPCSearchView(ListAPIView):
+    serializer_class = CheckinListOrderPositionSerializer
+    queryset = OrderPosition.all.none()
+    filter_backends = (ExtendedBackend, RichOrderingFilter)
+    ordering = (F('attendee_name_cached').asc(nulls_last=True), 'positionid')
+    ordering_fields = (
+        'order__code', 'order__datetime', 'positionid', 'attendee_name',
+        'last_checked_in', 'order__email',
+    )
+    ordering_custom = {
+        'attendee_name': {
+            '_order': F('display_name').asc(nulls_first=True),
+            'display_name': Coalesce('attendee_name_cached', 'addon_to__attendee_name_cached')
+        },
+        '-attendee_name': {
+            '_order': F('display_name').desc(nulls_last=True),
+            'display_name': Coalesce('attendee_name_cached', 'addon_to__attendee_name_cached')
+        },
+        'last_checked_in': {
+            '_order': OrderBy(F('last_checked_in'), nulls_first=True),
+        },
+        '-last_checked_in': {
+            '_order': OrderBy(F('last_checked_in'), nulls_last=True, descending=True),
+        },
+    }
+    filterset_class = OrderPositionFilter
+
+    def get_serializer_context(self):
+        ctx = super().get_serializer_context()
+        ctx['expand'] = self.request.query_params.getlist('expand')
+        ctx['pdf_data'] = False
+        return ctx
+
+    @cached_property
+    def lists(self):
+        if isinstance(self.request.auth, (TeamAPIToken, Device)):
+            events = self.request.auth.get_events_with_permission(('can_view_orders', 'can_checkin_orders'))
+        elif self.request.user.is_authenticated:
+            events = self.request.user.get_events_with_permission(('can_view_orders', 'can_checkin_orders'), self.request).filter(
+                organizer=self.request.organizer
+            )
+        else:
+            raise ValueError("unknown authentication method")
+        requested_lists = [int(l) for l in self.request.query_params.getlist('list') if l.isdigit()]
+        lists = list(
+            CheckinList.objects.filter(event__in=events).select_related('event').filter(id__in=requested_lists)
+        )
+        if len(lists) != len(requested_lists):
+            missing_lists = set(requested_lists) - {l.pk for l in lists}
+            raise PermissionDenied("You requested lists that do not exist or that you do not have access to: " + ", ".join(str(l) for l in missing_lists))
+        return lists
+
+    @cached_property
+    def has_full_access_permission(self):
+        if isinstance(self.request.auth, (TeamAPIToken, Device)):
+            events = self.request.auth.get_events_with_permission('can_view_orders')
+        elif self.request.user.is_authenticated:
+            events = self.request.user.get_events_with_permission('can_view_orders', self.request).filter(
+                organizer=self.request.organizer
+            )
+        else:
+            raise ValueError("unknown authentication method")
+
+        full_access_lists = CheckinList.objects.filter(event__in=events).filter(id__in=[c.pk for c in self.lists]).count()
+        return len(self.lists) == full_access_lists
+
+    def get_queryset(self, ignore_status=False, ignore_products=False):
+        qs = _checkin_list_position_queryset(
+            self.lists,
+            ignore_status=self.request.query_params.get('ignore_status', 'false') == 'true' or ignore_status,
+            ignore_products=ignore_products,
+            pdf_data=self.request.query_params.get('pdf_data', 'false') == 'true',
+            expand=self.request.query_params.getlist('expand'),
+        )
+
+        if len(self.request.query_params.get('search', '')) < 3 and not self.has_full_access_permission:
+            qs = qs.none()
+
+        return qs

src/pretix/api/views/item.py

@@ -461,7 +461,9 @@ with scopes_disabled():
     class QuotaFilter(FilterSet):
         class Meta:
             model = Quota
-            fields = ['subevent']
+            fields = {
+                'subevent': ['exact', 'in'],
+            }
 
 
 class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):

src/pretix/api/views/order.py

@@ -63,9 +63,10 @@ from pretix.api.serializers.orderchange import (
 )
 from pretix.base.i18n import language
 from pretix.base.models import (
-    CachedCombinedTicket, CachedTicket, Checkin, Device, Event, Invoice,
-    InvoiceAddress, Order, OrderFee, OrderPayment, OrderPosition, OrderRefund,
-    Quota, SubEvent, TaxRule, TeamAPIToken, generate_secret,
+    CachedCombinedTicket, CachedTicket, Checkin, Device, EventMetaValue,
+    Invoice, InvoiceAddress, ItemMetaValue, Order, OrderFee, OrderPayment,
+    OrderPosition, OrderRefund, Quota, SubEvent, SubEventMetaValue, TaxRule,
+    TeamAPIToken, generate_secret,
 )
 from pretix.base.models.orders import QuestionAnswer, RevokedTicketSecret
 from pretix.base.payment import PaymentException
@@ -187,6 +188,8 @@ class OrderViewSet(viewsets.ModelViewSet):
     def get_serializer_context(self):
         ctx = super().get_serializer_context()
         ctx['event'] = self.request.event
+        ctx['pdf_data'] = self.request.query_params.get('pdf_data', 'false') == 'true'
+        ctx['exclude'] = self.request.query_params.getlist('exclude')
         return ctx
 
     def get_queryset(self):
@@ -213,14 +216,29 @@ class OrderViewSet(viewsets.ModelViewSet):
         else:
             opq = OrderPosition.objects
         if request.query_params.get('pdf_data', 'false') == 'true':
+            prefetch_related_objects([request.organizer], 'meta_properties')
+            prefetch_related_objects(
+                [request.event],
+                Prefetch('meta_values', queryset=EventMetaValue.objects.select_related('property'), to_attr='meta_values_cached'),
+                'questions',
+                'item_meta_properties',
+            )
             return Prefetch(
                 'positions',
                 opq.all().prefetch_related(
                     Prefetch('checkins', queryset=Checkin.objects.all()),
-                    'item', 'variation', 'answers', 'answers__options', 'answers__question',
-                    'item__category', 'addon_to', 'seat',
+                    Prefetch('item', queryset=self.request.event.items.prefetch_related(
+                        Prefetch('meta_values', ItemMetaValue.objects.select_related('property'), to_attr='meta_values_cached')
+                    )),
+                    'variation',
+                    'answers', 'answers__options', 'answers__question',
+                    'item__category',
+                    'addon_to__answers', 'addon_to__answers__options', 'addon_to__answers__question',
+                    Prefetch('subevent', queryset=self.request.event.subevents.prefetch_related(
+                        Prefetch('meta_values', to_attr='meta_values_cached', queryset=SubEventMetaValue.objects.select_related('property'))
+                    )),
                     Prefetch('addons', opq.select_related('item', 'variation', 'seat'))
-                )
+                ).select_related('seat', 'addon_to', 'addon_to__seat')
             )
         else:
             return Prefetch(
@@ -932,6 +950,7 @@ class OrderPositionViewSet(viewsets.ModelViewSet):
     def get_serializer_context(self):
         ctx = super().get_serializer_context()
         ctx['event'] = self.request.event
+        ctx['pdf_data'] = self.request.query_params.get('pdf_data', 'false') == 'true'
         return ctx
 
     def get_queryset(self):
@@ -942,25 +961,49 @@ class OrderPositionViewSet(viewsets.ModelViewSet):
 
         qs = qs.filter(order__event=self.request.event)
         if self.request.query_params.get('pdf_data', 'false') == 'true':
+            prefetch_related_objects([self.request.organizer], 'meta_properties')
+            prefetch_related_objects(
+                [self.request.event],
+                Prefetch('meta_values', queryset=EventMetaValue.objects.select_related('property'), to_attr='meta_values_cached'),
+                'questions',
+                'item_meta_properties',
+            )
             qs = qs.prefetch_related(
                 Prefetch('checkins', queryset=Checkin.objects.all()),
+                Prefetch('item', queryset=self.request.event.items.prefetch_related(
+                    Prefetch('meta_values', ItemMetaValue.objects.select_related('property'),
+                             to_attr='meta_values_cached')
+                )),
+                'variation',
                 'answers', 'answers__options', 'answers__question',
+                'item__category',
+                'addon_to__answers', 'addon_to__answers__options', 'addon_to__answers__question',
                 Prefetch('addons', qs.select_related('item', 'variation')),
-                Prefetch('order', Order.objects.select_related('invoice_address').prefetch_related(
-                    Prefetch(
-                        'event',
-                        Event.objects.select_related('organizer')
-                    ),
+                Prefetch('subevent', queryset=self.request.event.subevents.prefetch_related(
+                    Prefetch('meta_values', to_attr='meta_values_cached',
+                             queryset=SubEventMetaValue.objects.select_related('property'))
+                )),
+                Prefetch('order', self.request.event.orders.select_related('invoice_address').prefetch_related(
                     Prefetch(
                         'positions',
                         qs.prefetch_related(
-                            'item', 'variation', 'answers', 'answers__options', 'answers__question',
                             Prefetch('checkins', queryset=Checkin.objects.all()),
-                        )
+                            Prefetch('item', queryset=self.request.event.items.prefetch_related(
+                                Prefetch('meta_values', ItemMetaValue.objects.select_related('property'),
+                                         to_attr='meta_values_cached')
+                            )),
+                            'variation', 'answers', 'answers__options', 'answers__question',
+                            'item__category',
+                            Prefetch('subevent', queryset=self.request.event.subevents.prefetch_related(
+                                Prefetch('meta_values', to_attr='meta_values_cached',
+                                         queryset=SubEventMetaValue.objects.select_related('property'))
+                            )),
+                            Prefetch('addons', qs.select_related('item', 'variation', 'seat'))
+                        ).select_related('addon_to', 'seat', 'addon_to__seat')
                     )
                 ))
             ).select_related(
-                'item', 'variation', 'item__category', 'addon_to', 'seat'
+                'addon_to', 'seat', 'addon_to__seat'
             )
         else:
             qs = qs.prefetch_related(

src/pretix/api/views/organizer.py

@@ -22,6 +22,7 @@
 from decimal import Decimal
 
 import django_filters
+from django.contrib.auth.hashers import make_password
 from django.db import transaction
 from django.shortcuts import get_object_or_404
 from django.utils.functional import cached_property
@@ -38,8 +39,8 @@ from rest_framework.viewsets import GenericViewSet
 
 from pretix.api.models import OAuthAccessToken
 from pretix.api.serializers.organizer import (
-    CustomerSerializer, DeviceSerializer, GiftCardSerializer,
-    GiftCardTransactionSerializer, MembershipSerializer,
+    CustomerCreateSerializer, CustomerSerializer, DeviceSerializer,
+    GiftCardSerializer, GiftCardTransactionSerializer, MembershipSerializer,
     MembershipTypeSerializer, OrganizerSerializer, OrganizerSettingsSerializer,
     SeatingPlanSerializer, TeamAPITokenSerializer, TeamInviteSerializer,
     TeamMemberSerializer, TeamSerializer,
@@ -514,15 +515,24 @@ class CustomerViewSet(viewsets.ModelViewSet):
         raise MethodNotAllowed("Customers cannot be deleted.")
 
     @transaction.atomic()
-    def perform_create(self, serializer):
-        inst = serializer.save(organizer=self.request.organizer)
+    def perform_create(self, serializer, send_email=False):
+        customer = serializer.save(organizer=self.request.organizer, password=make_password(None))
         serializer.instance.log_action(
             'pretix.customer.created',
             user=self.request.user,
             auth=self.request.auth,
             data=self.request.data,
         )
-        return inst
+        if send_email:
+            customer.send_activation_mail()
+        return customer
+
+    def create(self, request, *args, **kwargs):
+        serializer = CustomerCreateSerializer(data=request.data, context=self.get_serializer_context())
+        serializer.is_valid(raise_exception=True)
+        self.perform_create(serializer, send_email=serializer.validated_data.pop('send_email', False))
+        headers = self.get_success_headers(serializer.data)
+        return Response(serializer.data, status=status.HTTP_201_CREATED, headers=headers)
 
     @transaction.atomic()
     def perform_update(self, serializer):

src/pretix/api/views/shredders.py

@@ -0,0 +1,240 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-2021 rami.io GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see <https://pretix.eu/about/en/license>.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
+# <https://www.gnu.org/licenses/>.
+#
+from datetime import timedelta
+
+from celery.result import AsyncResult
+from django.conf import settings
+from django.http import Http404
+from django.shortcuts import get_object_or_404
+from django.utils.functional import cached_property
+from django.utils.timezone import now
+from rest_framework import status, viewsets
+from rest_framework.decorators import action
+from rest_framework.exceptions import ValidationError
+from rest_framework.response import Response
+from rest_framework.reverse import reverse
+
+from pretix.api.serializers.shredders import (
+    JobRunSerializer, ShredderSerializer,
+)
+from pretix.base.models import CachedFile
+from pretix.base.services.shredder import export, shred
+from pretix.base.shredder import shred_constraints
+from pretix.helpers.http import ChunkBasedFileResponse
+
+
+class ShreddersMixin:
+    def list(self, request, *args, **kwargs):
+        res = ShredderSerializer(self.shredders, many=True)
+        return Response({
+            "count": len(self.shredders),
+            "next": None,
+            "previous": None,
+            "results": res.data
+        })
+
+    def get_object(self):
+        instances = [e for e in self.shredders if e.identifier == self.kwargs.get('pk')]
+        if not instances:
+            raise Http404()
+        return instances[0]
+
+    def retrieve(self, request, *args, **kwargs):
+        instance = self.get_object()
+        serializer = ShredderSerializer(instance)
+        return Response(serializer.data)
+
+    @action(detail=False, methods=['GET'], url_name='download', url_path='download/(?P<asyncid>[^/]+)/(?P<cfid>[^/]+)')
+    def download(self, *args, **kwargs):
+        cf = get_object_or_404(
+            CachedFile,
+            id=kwargs['cfid'],
+            session_key=f'api-shredder-{str(type(self.request.user or self.request.auth))}-{(self.request.user or self.request.auth).pk}'
+        )
+        if cf.file:
+            resp = ChunkBasedFileResponse(cf.file.file, content_type=cf.type)
+            resp['Content-Disposition'] = 'attachment; filename="{}"'.format(cf.filename).encode("ascii", "ignore")
+            return resp
+        elif not settings.HAS_CELERY:
+            return Response(
+                {'status': 'failed', 'message': 'Unknown file ID or export failed'},
+                status=status.HTTP_410_GONE
+            )
+
+        res = AsyncResult(kwargs['asyncid'])
+        if res.failed():
+            if isinstance(res.info, dict) and res.info['exc_type'] in ('ShredError', 'ExportError'):
+                msg = res.info['exc_message']
+            else:
+                msg = 'Internal error'
+            return Response(
+                {'status': 'failed', 'message': msg},
+                status=status.HTTP_410_GONE
+            )
+
+        return Response(
+            {
+                'status': 'running' if res.state in ('PROGRESS', 'STARTED', 'SUCCESS') else 'waiting',
+            },
+            status=status.HTTP_409_CONFLICT
+        )
+
+    @action(detail=False, methods=['GET'], url_name='status', url_path='status/(?P<asyncid>[^/]+)/(?P<cfid>[^/]+)')
+    def status(self, *args, **kwargs):
+        if settings.HAS_CELERY:
+            res = AsyncResult(kwargs['asyncid'])
+            if res.failed():
+                if isinstance(res.info, dict) and res.info['exc_type'] in ('ShredError', 'ExportError'):
+                    msg = res.info['exc_message']
+                else:
+                    msg = 'Internal error'
+                return Response(
+                    {'status': 'failed', 'message': msg},
+                    status=status.HTTP_417_EXPECTATION_FAILED
+                )
+            elif res.successful():
+                return Response(
+                    {'status': 'ok', 'message': 'OK'},
+                    status=status.HTTP_200_OK
+                )
+
+        try:
+            CachedFile.objects.get(
+                id=kwargs['cfid'],
+                session_key=f'api-shredder-{str(type(self.request.user or self.request.auth))}-{(self.request.user or self.request.auth).pk}'
+            )
+        except CachedFile.DoesNotExist:
+            return Response(
+                {'status': 'gone', 'message': 'May have succeeded or timed out'},
+                status=status.HTTP_410_GONE
+            )
+
+        return Response(
+            {
+                'status': 'running' if res.state in ('PROGRESS', 'STARTED', 'SUCCESS') else 'waiting',
+            },
+            status=status.HTTP_409_CONFLICT
+        )
+
+    @action(detail=False, methods=['POST'], url_name='shred', url_path='shred/(?P<asyncid>[^/]+)/(?P<cfid>[^/]+)')
+    def shred(self, *args, **kwargs):
+        cf = get_object_or_404(
+            CachedFile,
+            id=kwargs['cfid'],
+            session_key=f'api-shredder-{str(type(self.request.user or self.request.auth))}-{(self.request.user or self.request.auth).pk}'
+        )
+        if cf.file:
+            async_result = self.do_shred(cf)
+            url_kwargs = {
+                'asyncid': str(async_result.id),
+                'cfid': str(cf.id),
+            }
+            url_kwargs.update(self.kwargs)
+            return Response({
+                'status': reverse('api-v1:shredders-status', kwargs=url_kwargs, request=self.request),
+            }, status=status.HTTP_202_ACCEPTED)
+        elif not settings.HAS_CELERY:
+            return Response(
+                {'status': 'failed', 'message': 'Unknown file ID or export failed'},
+                status=status.HTTP_410_GONE
+            )
+
+        res = AsyncResult(kwargs['asyncid'])
+        if res.failed():
+            if isinstance(res.info, dict) and res.info['exc_type'] in ('ShredError', 'ExportError'):
+                msg = res.info['exc_message']
+            else:
+                msg = 'Internal error'
+            return Response(
+                {'status': 'failed', 'message': msg},
+                status=status.HTTP_410_GONE
+            )
+
+        return Response(
+            {
+                'status': 'running' if res.state in ('PROGRESS', 'STARTED', 'SUCCESS') else 'waiting',
+            },
+            status=status.HTTP_409_CONFLICT
+        )
+
+    @action(detail=False, methods=['POST'])
+    def export(self, *args, **kwargs):
+        serializer = JobRunSerializer(shredders=self.shredders, data=self.request.data, **self.get_serializer_kwargs())
+        serializer.is_valid(raise_exception=True)
+
+        cf = CachedFile(web_download=False)
+        cf.date = now()
+        cf.expires = now() + timedelta(hours=2)
+        cf.session_key = f'api-shredder-{str(type(self.request.user or self.request.auth))}-{(self.request.user or self.request.auth).pk}'
+        cf.save()
+        d = serializer.data
+        for k, v in d.items():
+            if isinstance(v, set):
+                d[k] = list(v)
+        async_result = self.do_export(cf, serializer.validated_data['shredders'])
+
+        url_kwargs = {
+            'asyncid': str(async_result.id),
+            'cfid': str(cf.id),
+        }
+        url_kwargs.update(self.kwargs)
+        return Response({
+            'download': reverse('api-v1:shredders-download', kwargs=url_kwargs, request=self.request),
+            'shred': reverse('api-v1:shredders-shred', kwargs=url_kwargs, request=self.request),
+        }, status=status.HTTP_202_ACCEPTED)
+
+
+class EventShreddersViewSet(ShreddersMixin, viewsets.ViewSet):
+    permission = 'can_change_orders'
+
+    def get_serializer_kwargs(self):
+        return {}
+
+    @cached_property
+    def shredders(self):
+        shredders = []
+        for k, v in sorted(self.request.event.get_data_shredders().items(), key=lambda s: s[1].verbose_name):
+            shredders.append(v)
+        return shredders
+
+    def do_export(self, cf, shredders):
+        constr = shred_constraints(self.request.event)
+        if constr:
+            raise ValidationError(constr)
+
+        return export.apply_async(args=(
+            self.request.event.id,
+            list(shredders),
+            f'api-shredder-{str(type(self.request.user or self.request.auth))}-{(self.request.user or self.request.auth).pk}',
+            str(cf.pk)
+        ))
+
+    def do_shred(self, cf):
+        constr = shred_constraints(self.request.event)
+        if constr:
+            raise ValidationError(constr)
+
+        return shred.apply_async(args=(
+            self.request.event.id,
+            str(cf.pk),
+            True,
+        ))

src/pretix/base/exporters/items.py

@@ -26,11 +26,11 @@ from django.utils.translation import gettext_lazy as _
 from openpyxl.styles import Alignment
 from openpyxl.utils import get_column_letter
 
+from ...helpers.safe_openpyxl import SafeCell
 from ..channels import get_all_sales_channels
 from ..exporter import ListExporter
 from ..models import ItemMetaValue
 from ..signals import register_data_exporters
-from ...helpers.safe_openpyxl import SafeCell
 
 
 def _max(a1, a2):
@@ -135,7 +135,7 @@ class ItemDataExporter(ListExporter):
                         _("Yes") if i.free_price else "",
                         str(i.tax_rule) if i.tax_rule else "",
                         _("Yes") if i.admission else "",
-                        _("Yes") if i.generate_tickets else "",
+                        _("Yes") if i.generate_tickets else (_("Default") if i.generate_tickets is None else ""),
                         _("Yes") if i.allow_waitinglist else "",
                         date_format(_max(i.available_from, v.available_from).astimezone(self.timezone),
                                     "SHORT_DATETIME_FORMAT") if i.available_from or v.available_from else "",
@@ -154,6 +154,10 @@ class ItemDataExporter(ListExporter):
                         _("Yes") if i.require_membership or v.require_membership else "",
                         _("Yes") if i.require_membership_hidden or v.require_membership_hidden else "",
                     ]
+                    row += [
+                        m.get(p.name, '') for p in props
+                    ]
+                    yield row
 
             else:
                 row = [
@@ -173,7 +177,7 @@ class ItemDataExporter(ListExporter):
                     _("Yes") if i.free_price else "",
                     str(i.tax_rule) if i.tax_rule else "",
                     _("Yes") if i.admission else "",
-                    _("Yes") if i.generate_tickets else "",
+                    _("Yes") if i.generate_tickets else (_("Default") if i.generate_tickets is None else ""),
                     _("Yes") if i.allow_waitinglist else "",
                     date_format(i.available_from.astimezone(self.timezone),
                                 "SHORT_DATETIME_FORMAT") if i.available_from else "",
@@ -193,10 +197,10 @@ class ItemDataExporter(ListExporter):
                     _("Yes") if i.require_membership_hidden else "",
                 ]
 
-            row += [
-                m.get(p.name, '') for p in props
-            ]
-            yield row
+                row += [
+                    m.get(p.name, '') for p in props
+                ]
+                yield row
 
     def get_filename(self):
         return '{}_products'.format(self.events.first().organizer.slug)

src/pretix/base/invoice.py

@@ -28,6 +28,7 @@ from typing import Tuple
 import bleach
 import vat_moss.exchange_rates
 from django.contrib.staticfiles import finders
+from django.db.models import Sum
 from django.dispatch import receiver
 from django.utils.formats import date_format, localize
 from django.utils.translation import (
@@ -47,7 +48,7 @@ from reportlab.platypus import (
 )
 
 from pretix.base.decimal import round_decimal
-from pretix.base.models import Event, Invoice, Order
+from pretix.base.models import Event, Invoice, Order, OrderPayment
 from pretix.base.signals import register_invoice_renderers
 from pretix.base.templatetags.money import money_filter
 from pretix.helpers.reportlab import ThumbnailingImageReader
@@ -589,15 +590,33 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
             ])
             colwidths = [a * doc.width for a in (.65, .05, .30)]
 
-        if self.invoice.event.settings.invoice_show_payments and not self.invoice.is_cancellation and \
-                self.invoice.order.status == Order.STATUS_PENDING:
-            pending_sum = self.invoice.order.pending_sum
-            if pending_sum != total:
-                tdata.append([pgettext('invoice', 'Received payments')] + (['', '', ''] if has_taxes else ['']) + [
-                    money_filter(pending_sum - total, self.invoice.event.currency)
+        if self.invoice.event.settings.invoice_show_payments and not self.invoice.is_cancellation:
+            if self.invoice.order.status == Order.STATUS_PENDING:
+                pending_sum = self.invoice.order.pending_sum
+                if pending_sum != total:
+                    tdata.append([pgettext('invoice', 'Received payments')] + (['', '', ''] if has_taxes else ['']) + [
+                        money_filter(pending_sum - total, self.invoice.event.currency)
+                    ])
+                    tdata.append([pgettext('invoice', 'Outstanding payments')] + (['', '', ''] if has_taxes else ['']) + [
+                        money_filter(pending_sum, self.invoice.event.currency)
+                    ])
+                    tstyledata += [
+                        ('FONTNAME', (0, len(tdata) - 3), (-1, len(tdata) - 3), self.font_bold),
+                    ]
+            elif self.invoice.order.payments.filter(
+                state__in=(OrderPayment.PAYMENT_STATE_CONFIRMED, OrderPayment.PAYMENT_STATE_REFUNDED), provider='giftcard'
+            ).exists():
+                giftcard_sum = self.invoice.order.payments.filter(
+                    state__in=(OrderPayment.PAYMENT_STATE_CONFIRMED, OrderPayment.PAYMENT_STATE_REFUNDED),
+                    provider='giftcard'
+                ).aggregate(
+                    s=Sum('amount')
+                )['s'] or Decimal('0.00')
+                tdata.append([pgettext('invoice', 'Paid by gift card')] + (['', '', ''] if has_taxes else ['']) + [
+                    money_filter(giftcard_sum, self.invoice.event.currency)
                 ])
-                tdata.append([pgettext('invoice', 'Outstanding payments')] + (['', '', ''] if has_taxes else ['']) + [
-                    money_filter(pending_sum, self.invoice.event.currency)
+                tdata.append([pgettext('invoice', 'Remaining amount')] + (['', '', ''] if has_taxes else ['']) + [
+                    money_filter(total - giftcard_sum, self.invoice.event.currency)
                 ])
                 tstyledata += [
                     ('FONTNAME', (0, len(tdata) - 3), (-1, len(tdata) - 3), self.font_bold),

src/pretix/base/migrations/0218_checkinlist_addon_match.py

@@ -0,0 +1,18 @@
+# Generated by Django 3.2.2 on 2022-06-29 17:37
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0217_eventfooterlink_organizerfooterlink'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='checkinlist',
+            name='addon_match',
+            field=models.BooleanField(default=False),
+        ),
+    ]

src/pretix/base/models/auth.py

@@ -34,7 +34,9 @@
 
 import binascii
 import json
+import operator
 from datetime import timedelta
+from functools import reduce
 from urllib.parse import urlparse
 
 import webauthn
@@ -491,11 +493,14 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
         if request and self.has_active_staff_session(request.session.session_key):
             return Event.objects.all()
 
-        kwargs = {permission: True}
+        if isinstance(permission, (tuple, list)):
+            q = reduce(operator.or_, [Q(**{p: True}) for p in permission])
+        else:
+            q = Q(**{permission: True})
 
         return Event.objects.filter(
-            Q(organizer_id__in=self.teams.filter(all_events=True, **kwargs).values_list('organizer', flat=True))
-            | Q(id__in=self.teams.filter(**kwargs).values_list('limit_events__id', flat=True))
+            Q(organizer_id__in=self.teams.filter(q, all_events=True).values_list('organizer', flat=True))
+            | Q(id__in=self.teams.filter(q).values_list('limit_events__id', flat=True))
         )
 
     @scopes_disabled()

src/pretix/base/models/checkin.py

@@ -56,6 +56,12 @@ class CheckinList(LoggedModel):
                                           default=False,
                                           help_text=_('With this option, people will be able to check in even if the '
                                                       'order has not been paid.'))
+    addon_match = models.BooleanField(
+        verbose_name=_('Allow checking in add-on tickets by scanning the main ticket'),
+        default=False,
+        help_text=_('A scan will only be possible if the check-in list is configured such that there is always exactly '
+                    'one matching add-on ticket. Ambiguous scans will be rejected..')
+    )
     gates = models.ManyToManyField(
         'Gate', verbose_name=_("Gates"), blank=True,
         help_text=_("Does not have any effect for the validation of tickets, only for the automatic configuration of "
@@ -258,6 +264,7 @@ class Checkin(models.Model):
     REASON_REVOKED = 'revoked'
     REASON_INCOMPLETE = 'incomplete'
     REASON_ALREADY_REDEEMED = 'already_redeemed'
+    REASON_AMBIGUOUS = 'ambiguous'
     REASON_ERROR = 'error'
     REASONS = (
         (REASON_CANCELED, _('Order canceled')),
@@ -268,6 +275,7 @@ class Checkin(models.Model):
         (REASON_INCOMPLETE, _('Information required')),
         (REASON_ALREADY_REDEEMED, _('Ticket already used')),
         (REASON_PRODUCT, _('Ticket type not allowed here')),
+        (REASON_AMBIGUOUS, _('Ticket code is ambiguous on list')),
         (REASON_ERROR, _('Server error')),
     )
 

src/pretix/base/models/customers.py

@@ -216,6 +216,27 @@ class Customer(LoggedModel):
             testmode=testmode,
         )
 
+    def send_activation_mail(self):
+        from pretix.base.services.mail import mail
+        from pretix.multidomain.urlreverse import build_absolute_uri
+        from pretix.presale.forms.customer import TokenGenerator
+
+        ctx = self.get_email_context()
+        token = TokenGenerator().make_token(self)
+        ctx['url'] = build_absolute_uri(
+            self.organizer,
+            'presale:organizer.customer.activate'
+        ) + '?id=' + self.identifier + '&token=' + token
+        mail(
+            self.email,
+            _('Activate your account at {organizer}').format(organizer=self.organizer.name),
+            self.organizer.settings.mail_text_customer_registration,
+            ctx,
+            locale=self.locale,
+            customer=self,
+            organizer=self.organizer,
+        )
+
 
 class AttendeeProfile(models.Model):
     customer = models.ForeignKey(

src/pretix/base/models/devices.py

@@ -255,7 +255,9 @@ class Device(LoggedModel):
         :param request: Ignored, for compatibility with User model
         :return: Iterable of Events
         """
-        if permission in self.permission_set():
+        if (
+                isinstance(permission, (list, tuple)) and any(p in self.permission_set() for p in permission)
+        ) or (isinstance(permission, str) and permission in self.permission_set()):
             return self.get_events_with_any_permission()
         else:
             return self.organizer.events.none()

src/pretix/base/models/event.py

@@ -1448,7 +1448,10 @@ class SubEvent(EventMixin, LoggedModel):
     @property
     def meta_data(self):
         data = self.event.meta_data
-        data.update({v.property.name: v.value for v in self.meta_values.select_related('property').all()})
+        if hasattr(self, 'meta_values_cached'):
+            data.update({v.property.name: v.value for v in self.meta_values_cached})
+        else:
+            data.update({v.property.name: v.value for v in self.meta_values.select_related('property').all()})
         return data
 
     @property

src/pretix/base/models/organizer.py

@@ -461,7 +461,9 @@ class TeamAPIToken(models.Model):
         :param request: Ignored, for compatibility with User model
         :return: Iterable of Events
         """
-        if getattr(self.team, permission, False):
+        if (
+                isinstance(permission, (list, tuple)) and any(getattr(self.team, p, False) for p in permission)
+        ) or (isinstance(permission, str) and getattr(self.team, permission, False)):
             return self.get_events_with_any_permission()
         else:
             return self.team.organizer.events.none()

src/pretix/base/services/cart.py

@@ -947,11 +947,11 @@ class CartManager:
 
                 if voucher_available_count < 1:
                     if op.voucher in self._voucher_depend_on_cart:
-                        err = err or error_messages['voucher_redeemed_cart'] % self.event.settings.reservation_time
+                        err = err or _(error_messages['voucher_redeemed_cart']) % self.event.settings.reservation_time
                     else:
                         err = err or error_messages['voucher_redeemed']
                 elif voucher_available_count < requested_count:
-                    err = err or error_messages['voucher_redeemed_partial'] % voucher_available_count
+                    err = err or _(error_messages['voucher_redeemed_partial']) % voucher_available_count
 
                 available_count = min(quota_available_count, voucher_available_count)
 

src/pretix/base/services/shredder.py

@@ -51,7 +51,7 @@ from pretix.celery_app import app
 
 
 @app.task(base=ProfiledEventTask)
-def export(event: Event, shredders: List[str], session_key=None) -> None:
+def export(event: Event, shredders: List[str], session_key=None, cfid=None) -> None:
     known_shredders = event.get_data_shredders()
 
     with NamedTemporaryFile() as rawfile:
@@ -85,13 +85,16 @@ def export(event: Event, shredders: List[str], session_key=None) -> None:
 
         rawfile.seek(0)
 
-        cf = CachedFile()
-        cf.date = now()
+        if cfid:
+            cf = CachedFile.objects.get(pk=cfid)
+        else:
+            cf = CachedFile()
+            cf.date = now()
+            cf.session_key = session_key
+            cf.web_download = True
+            cf.expires = now() + timedelta(hours=1)
         cf.filename = event.slug + '.zip'
         cf.type = 'application/zip'
-        cf.session_key = session_key
-        cf.web_download = True
-        cf.expires = now() + timedelta(hours=1)
         cf.save()
         cf.file.save(cachedfile_name(cf, cf.filename), rawfile)
 
@@ -115,7 +118,7 @@ def shred(event: Event, fileid: str, confirm_code: str) -> None:
         if not shredder:
             continue
         shredders.append(shredder)
-    if any(shredder.require_download_confirmation for shredder in shredders):
+    if confirm_code is not True and any(shredder.require_download_confirmation for shredder in shredders):
         if indexdata['confirm_code'] != confirm_code:
             raise ShredError(_("The confirm code you entered was incorrect."))
     if event.logentry_set.filter(datetime__gte=parse(indexdata['time'])):

src/pretix/base/settings.py

@@ -1514,6 +1514,15 @@ DEFAULTS = {
                     "before the order is canceled and a refund is issued."),
         )
     },
+    'cancel_allow_user_paid_require_approval_fee_unknown': {
+        'default': 'False',
+        'type': bool,
+        'form_class': forms.BooleanField,
+        'serializer_class': serializers.BooleanField,
+        'form_kwargs': dict(
+            label=_("Do not show the cancellation fee to users when they request cancellation."),
+        )
+    },
     'cancel_allow_user_paid_refund_as_giftcard': {
         'default': 'off',
         'type': str,
@@ -2585,7 +2594,9 @@ Your {organizer} team"""))
     },
     'name_scheme': {
         'default': 'full',  # default for new events is 'given_family'
-        'type': str
+        'type': str,
+        'serializer_class': serializers.ChoiceField,
+        'serializer_kwargs': {},
     },
     'giftcard_length': {
         'default': settings.ENTROPY['giftcard_secret'],
@@ -2980,6 +2991,9 @@ PERSON_NAME_SCHEMES = OrderedDict([
         },
     }),
 ])
+
+DEFAULTS['name_scheme']['serializer_kwargs']['choices'] = ((k, k) for k in PERSON_NAME_SCHEMES)
+
 COUNTRIES_WITH_STATE_IN_ADDRESS = {
     # Source: http://www.bitboost.com/ref/international-address-formats.html
     # This is not a list of countries that *have* states, this is a list of countries where states

src/pretix/base/templatetags/rich_text.py

@@ -96,6 +96,7 @@ ALLOWED_ATTRIBUTES = {
     'div': ['class'],
     'p': ['class'],
     'span': ['class', 'title'],
+    'ol': ['start'],
     # Update doc/user/markdown.rst if you change this!
 }
 

src/pretix/control/forms/checkin.py

@@ -22,9 +22,10 @@
 from datetime import datetime, timedelta
 
 from django import forms
+from django.core.exceptions import ValidationError
 from django.urls import reverse
 from django.utils.timezone import get_current_timezone, make_aware, now
-from django.utils.translation import pgettext_lazy
+from django.utils.translation import gettext_lazy as _, pgettext_lazy
 from django_scopes.forms import (
     SafeModelChoiceField, SafeModelMultipleChoiceField,
 )
@@ -109,6 +110,7 @@ class CheckinListForm(forms.ModelForm):
             'rules',
             'gates',
             'exit_all_at',
+            'addon_match',
         ]
         widgets = {
             'limit_products': forms.CheckboxSelectMultiple(attrs={
@@ -130,6 +132,12 @@ class CheckinListForm(forms.ModelForm):
     def clean(self):
         d = super().clean()
         d['rules'] = CheckinList.validate_rules(d.get('rules'))
+
+        if d.get('addon_match') and d.get('all_products'):
+            raise ValidationError(_('If you allow checking in add-on tickets by scanning the main ticket, you must '
+                                    'select a specific set of products for this check-in list, only including the '
+                                    'possible add-on products.'))
+
         return d
 
 

src/pretix/control/forms/event.py

@@ -674,6 +674,7 @@ class CancelSettingsForm(SettingsForm):
         'cancel_allow_user_paid_adjust_fees_step',
         'cancel_allow_user_paid_refund_as_giftcard',
         'cancel_allow_user_paid_require_approval',
+        'cancel_allow_user_paid_require_approval_fee_unknown',
         'change_allow_user_variation',
         'change_allow_user_price',
         'change_allow_user_until',

src/pretix/control/logdisplay.py

@@ -366,7 +366,7 @@ def pretixcontrol_logentry_display(sender: Event, logentry: LogEntry, **kwargs):
         'pretix.event.order.payment.changed': _('A new payment {local_id} has been started instead of the previous one.'),
         'pretix.event.order.email.sent': _('An unidentified type email has been sent.'),
         'pretix.event.order.email.error': _('Sending of an email has failed.'),
-        'pretix.event.order.email.attachments.skipped': _('The email has been sent without attachments since they '
+        'pretix.event.order.email.attachments.skipped': _('The email has been sent without attached tickets since they '
                                                           'would have been too large to be likely to arrive.'),
         'pretix.event.order.email.custom_sent': _('A custom email has been sent.'),
         'pretix.event.order.position.email.custom_sent': _('A custom email has been sent to an attendee.'),

src/pretix/control/templates/pretixcontrol/checkin/list_edit.html

@@ -55,6 +55,7 @@
 
                 {% bootstrap_field form.allow_multiple_entries layout="control" %}
                 {% bootstrap_field form.allow_entry_after_exit layout="control" %}
+                {% bootstrap_field form.addon_match layout="control" %}
                 {% bootstrap_field form.exit_all_at layout="control" %}
                 {% bootstrap_field form.auto_checkin_sales_channels layout="control" %}
                 {% if form.gates %}

src/pretix/control/templates/pretixcontrol/event/cancel.html

@@ -16,6 +16,9 @@
                 <legend>{% trans "Paid orders" %}</legend>
                 {% bootstrap_field form.cancel_allow_user_paid layout="control" %}
                 {% bootstrap_field form.cancel_allow_user_paid_require_approval layout="control" %}
+                <div data-display-dependency="#id_cancel_allow_user_paid_require_approval">
+                    {% bootstrap_field form.cancel_allow_user_paid_require_approval_fee_unknown layout="control" %}
+                </div>
                 {% bootstrap_field form.cancel_allow_user_paid_keep layout="control" %}
                 {% bootstrap_field form.cancel_allow_user_paid_keep_percentage layout="control" %}
                 {% bootstrap_field form.cancel_allow_user_paid_keep_fees layout="control" %}

src/pretix/control/views/item.py

@@ -1344,22 +1344,36 @@ class ItemUpdateGeneral(ItemDetailMixin, EventPermissionRequiredMixin, MetaDataE
     def form_valid(self, form):
         self.save_meta()
         messages.success(self.request, _('Your changes have been saved.'))
-        if form.has_changed() or any(f.has_changed() for f in self.plugin_forms):
-            data = {
-                k: form.cleaned_data.get(k)
-                for k in form.changed_data
-            }
-            for f in self.plugin_forms:
-                data.update({
-                    k: (f.cleaned_data.get(k).name
-                        if isinstance(f.cleaned_data.get(k), File)
-                        else f.cleaned_data.get(k))
-                    for k in f.changed_data
-                })
+
+        change_data = {
+            k: form.cleaned_data.get(k)
+            for k in form.changed_data
+        }
+        for f in self.plugin_forms:
+            change_data.update({
+                k: (f.cleaned_data.get(k).name
+                    if isinstance(f.cleaned_data.get(k), File)
+                    else f.cleaned_data.get(k))
+                for k in f.changed_data
+            })
+
+        meta_changed = {}
+        for f in self.meta_forms:
+            meta_changed.update({
+                k: (f.cleaned_data.get(k).name
+                    if isinstance(f.cleaned_data.get(k), File)
+                    else f.cleaned_data.get(k))
+                for k in f.changed_data
+            })
+        if meta_changed:
+            change_data['meta_data'] = meta_changed
+
+        if change_data:
             self.object.log_action(
-                'pretix.event.item.changed', user=self.request.user, data=data
+                'pretix.event.item.changed', user=self.request.user, data=change_data
             )
             invalidate_cache.apply_async(kwargs={'event': self.request.event.pk, 'item': self.object.pk})
+
         for f in self.plugin_forms:
             f.save()
 

src/pretix/control/views/orders.py

@@ -540,10 +540,8 @@ class OrderComment(OrderView):
                 self.order.log_action('pretix.event.order.checkin_attention', user=self.request.user, data={
                     'new_value': form.cleaned_data.get('checkin_attention')
                 })
-            print(self.order.custom_followup_at)
             self.order.save(update_fields=['checkin_attention', 'comment', 'custom_followup_at'])
             self.order.refresh_from_db()
-            print(self.order.custom_followup_at)
             messages.success(self.request, _('The comment has been updated.'))
         else:
             messages.error(self.request, _('Could not update the comment.'))
@@ -1188,13 +1186,17 @@ class OrderTransition(OrderView):
             if ps == Decimal('0.00') and self.order.pending_sum <= Decimal('0.00'):
                 p = self.order.payments.filter(state=OrderPayment.PAYMENT_STATE_CONFIRMED).last()
                 if p:
-                    p._mark_order_paid(
-                        user=self.request.user,
-                        send_mail=self.mark_paid_form.cleaned_data['send_email'],
-                        force=self.mark_paid_form.cleaned_data.get('force', False),
-                        payment_refund_sum=self.order.payment_refund_sum,
-                    )
-                    messages.success(self.request, _('The order has been marked as paid.'))
+                    try:
+                        p._mark_order_paid(
+                            user=self.request.user,
+                            send_mail=self.mark_paid_form.cleaned_data['send_email'],
+                            force=self.mark_paid_form.cleaned_data.get('force', False),
+                            payment_refund_sum=self.order.payment_refund_sum,
+                        )
+                    except Quota.QuotaExceededException as e:
+                        messages.error(self.request, str(e))
+                    else:
+                        messages.success(self.request, _('The order has been marked as paid.'))
                     return redirect(self.get_order_url())
 
             try:

src/pretix/locale/ar/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2021-09-15 11:22+0000\n"
 "Last-Translator: Mohamed Tawfiq <mtawfiq@wafyapp.com>\n"
 "Language-Team: Arabic <https://translate.pretix.eu/projects/pretix/pretix-js/"
@@ -296,14 +296,18 @@ msgid "Order canceled"
 msgstr "تم إلغاء الطلب"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "تذاكر الدخول"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "تذاكر سارية المفعول"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "حاليا بالداخل"
 
@@ -651,20 +655,20 @@ msgstr "ستسترد %(currency)%(amount)"
 msgid "Please enter the amount the organizer can keep."
 msgstr "الرجاء إدخال المبلغ الذي يمكن للمنظم الاحتفاظ به."
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "الرجاء إدخال عدد لأحد أنواع التذاكر."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "مطلوب"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "المنطقة الزمنية:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "التوقيت المحلي:"
 

src/pretix/locale/ca/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2020-12-19 07:00+0000\n"
 "Last-Translator: albert <albert.serra.monner@gmail.com>\n"
 "Language-Team: Catalan <https://translate.pretix.eu/projects/pretix/pretix-"
@@ -289,14 +289,18 @@ msgid "Order canceled"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
-msgid "Checked-in Tickets"
+msgid "Ticket code is ambiguous on list"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
-msgid "Valid Tickets"
+msgid "Checked-in Tickets"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+msgid "Valid Tickets"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr ""
 
@@ -624,22 +628,22 @@ msgstr ""
 msgid "Please enter the amount the organizer can keep."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 #, fuzzy
 #| msgid "Cart expired"
 msgid "required"
 msgstr "Cistella expirada"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr ""
 

src/pretix/locale/cs/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2021-12-06 23:00+0000\n"
 "Last-Translator: Ondřej Sokol <osokol@treesoft.cz>\n"
 "Language-Team: Czech <https://translate.pretix.eu/projects/pretix/pretix-js/"
@@ -291,14 +291,18 @@ msgid "Order canceled"
 msgstr "Objednávka zrušena"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "Vyřízené vstupenky"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "Platné vstupenky"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "Aktuálně uvnitř"
 
@@ -644,20 +648,20 @@ msgstr "Dostanete %(currency)s %(amount)s zpět"
 msgid "Please enter the amount the organizer can keep."
 msgstr "Zadejte částku, kterou si organizátor může ponechat."
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Zadejte prosím množství pro jeden z typů vstupenek."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "povinný"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Časové pásmo:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "Místní čas:"
 

src/pretix/locale/da/LC_MESSAGES/djangojs.po

@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2022-04-01 13:36+0000\n"
 "Last-Translator: Anna-itk <abc@aarhus.dk>\n"
 "Language-Team: Danish <https://translate.pretix.eu/projects/pretix/pretix-js/"
@@ -301,16 +301,20 @@ msgid "Order canceled"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 #, fuzzy
 #| msgid "Check-in QR"
 msgid "Checked-in Tickets"
 msgstr "Check-in QR"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr ""
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr ""
 
@@ -679,22 +683,22 @@ msgstr "fra %(currency)s %(price)s"
 msgid "Please enter the amount the organizer can keep."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 #, fuzzy
 #| msgid "Cart expired"
 msgid "required"
 msgstr "Kurv udløbet"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Tidszone:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "Din lokaltid:"
 

src/pretix/locale/de/LC_MESSAGES/djangojs.po

@@ -7,8 +7,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
-"PO-Revision-Date: 2022-04-28 18:04+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
+"PO-Revision-Date: 2022-07-26 08:58+0000\n"
 "Last-Translator: Raphael Michel <michel@rami.io>\n"
 "Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix-js/"
 "de/>\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 4.12\n"
+"X-Generator: Weblate 4.13.1\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:56
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:62
@@ -289,14 +289,18 @@ msgid "Order canceled"
 msgstr "Bestellung storniert"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr "Ticket-Code ist nicht eindeutig auf der Liste"
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "Eingecheckte Tickets"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "Gültige Tickets"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "Derzeit anwesend"
 
@@ -646,20 +650,20 @@ msgstr "Sie erhalten %(currency)s %(amount)s zurück"
 msgid "Please enter the amount the organizer can keep."
 msgstr "Bitte geben Sie den Betrag ein, den der Veranstalter einbehalten darf."
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Bitte tragen Sie eine Menge für eines der Produkte ein."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "verpflichtend"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Zeitzone:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "Deine lokale Zeit:"
 

src/pretix/locale/de/wordlist.txt

@@ -41,6 +41,7 @@ Bestätigungs
 Bestellbestätigungs
 Bestellungsänderungen
 Bestellungsstatus
+Bestellungs
 bez
 BezahlCode
 Bezahlmethode
@@ -323,6 +324,7 @@ VIP
 WebAuthn
 Webhook
 Webhooks
+Weiterleitungs
 WeChat
 WhatsApp
 Widget

src/pretix/locale/de_Informal/LC_MESSAGES/djangojs.po

@@ -7,8 +7,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
-"PO-Revision-Date: 2022-04-28 18:04+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
+"PO-Revision-Date: 2022-07-26 08:58+0000\n"
 "Last-Translator: Raphael Michel <michel@rami.io>\n"
 "Language-Team: German (informal) <https://translate.pretix.eu/projects/"
 "pretix/pretix-js/de_Informal/>\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 4.12\n"
+"X-Generator: Weblate 4.13.1\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:56
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js:62
@@ -289,14 +289,18 @@ msgid "Order canceled"
 msgstr "Bestellung storniert"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr "Ticket-Code ist nicht eindeutig auf der Liste"
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "Eingecheckte Tickets"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "Gültige Tickets"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "Derzeit anwesend"
 
@@ -645,20 +649,20 @@ msgstr "Du erhältst %(currency)s %(amount)s zurück"
 msgid "Please enter the amount the organizer can keep."
 msgstr "Bitte gib den Betrag ein, den der Veranstalter einbehalten darf."
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Bitte trage eine Menge für eines der Produkte ein."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "verpflichtend"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Zeitzone:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "Deine lokale Zeit:"
 

src/pretix/locale/de_Informal/wordlist.txt

@@ -41,6 +41,7 @@ Bestätigungs
 Bestellbestätigungs
 Bestellungsänderungen
 Bestellungsstatus
+Bestellungs
 bez
 BezahlCode
 Bezahlmethode
@@ -323,6 +324,7 @@ VIP
 WebAuthn
 Webhook
 Webhooks
+Weiterleitungs
 WeChat
 WhatsApp
 Widget

src/pretix/locale/djangojs.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -288,14 +288,18 @@ msgid "Order canceled"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
-msgid "Checked-in Tickets"
+msgid "Ticket code is ambiguous on list"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
-msgid "Valid Tickets"
+msgid "Checked-in Tickets"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+msgid "Valid Tickets"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr ""
 
@@ -619,20 +623,20 @@ msgstr ""
 msgid "Please enter the amount the organizer can keep."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr ""
 

src/pretix/locale/el/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2019-10-03 19:00+0000\n"
 "Last-Translator: Chris Spy <chrispiropoulou@hotmail.com>\n"
 "Language-Team: Greek <https://translate.pretix.eu/projects/pretix/pretix-js/"
@@ -304,16 +304,20 @@ msgid "Order canceled"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 #, fuzzy
 #| msgid "Check-in QR"
 msgid "Checked-in Tickets"
 msgstr "Έλεγχος QR"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr ""
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr ""
 
@@ -691,22 +695,22 @@ msgstr "απο %(currency)s %(price)s"
 msgid "Please enter the amount the organizer can keep."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Εισαγάγετε μια ποσότητα για έναν από τους τύπους εισιτηρίων."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 #, fuzzy
 #| msgid "Cart expired"
 msgid "required"
 msgstr "Το καλάθι έληξε"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr ""
 

src/pretix/locale/es/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2021-11-25 21:00+0000\n"
 "Last-Translator: Ismael Menéndez Fernández <ismael.menendez@balidea.com>\n"
 "Language-Team: Spanish <https://translate.pretix.eu/projects/pretix/pretix-"
@@ -291,14 +291,18 @@ msgid "Order canceled"
 msgstr "Orden cancelada"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "Registro de código QR"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "Tickets válidos"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "Actualmente adentro"
 
@@ -645,20 +649,20 @@ msgstr "Obtienes %(currency)s %(price)s de vuelta"
 msgid "Please enter the amount the organizer can keep."
 msgstr "Por favor, ingrese el monto que el organizador puede quedarse."
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Por favor, introduzca un valor para cada tipo de entrada."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "campo requerido"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Zona horaria:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "Su hora local:"
 

src/pretix/locale/fi/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2021-11-10 05:00+0000\n"
 "Last-Translator: Jaakko Rinta-Filppula <jaakko@r-f.fi>\n"
 "Language-Team: Finnish <https://translate.pretix.eu/projects/pretix/pretix-"
@@ -300,14 +300,18 @@ msgid "Order canceled"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
-msgid "Checked-in Tickets"
+msgid "Ticket code is ambiguous on list"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
-msgid "Valid Tickets"
+msgid "Checked-in Tickets"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+msgid "Valid Tickets"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr ""
 
@@ -644,22 +648,22 @@ msgstr ""
 msgid "Please enter the amount the organizer can keep."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 #, fuzzy
 #| msgid "Cart expired"
 msgid "required"
 msgstr "Ostoskori on vanhentunut"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Aikavyöhyke:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr ""
 

src/pretix/locale/fr/LC_MESSAGES/djangojs.po

@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: French\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2022-04-07 10:40+0000\n"
 "Last-Translator: Eva-Maria Obermann <obermann@rami.io>\n"
 "Language-Team: French <https://translate.pretix.eu/projects/pretix/pretix-js/"
@@ -301,16 +301,20 @@ msgid "Order canceled"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 #, fuzzy
 #| msgid "Check-in QR"
 msgid "Checked-in Tickets"
 msgstr "Enregistrement QR code"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr ""
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr ""
 
@@ -679,22 +683,22 @@ msgstr "de %(currency)s %(price)s"
 msgid "Please enter the amount the organizer can keep."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "SVP entrez une quantité pour un de vos types de billets."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 #, fuzzy
 #| msgid "Cart expired"
 msgid "required"
 msgstr "Panier expiré"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr ""
 

src/pretix/locale/gl/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2022-02-22 22:00+0000\n"
 "Last-Translator: Ismael Menéndez Fernández <ismael.menendez@balidea.com>\n"
 "Language-Team: Galician <https://translate.pretix.eu/projects/pretix/pretix-"
@@ -291,14 +291,18 @@ msgid "Order canceled"
 msgstr "Pedido cancelado"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "Rexistro de código QR"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "Tíckets válidos"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "Actualmente dentro"
 
@@ -642,20 +646,20 @@ msgstr "Obtés %(currency)s %(price)s de volta"
 msgid "Please enter the amount the organizer can keep."
 msgstr "Por favor, ingrese a cantidade que pode conservar o organizador."
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Por favor, introduza un valor para cada tipo de entrada."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "campo requirido"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Zona horaria:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "A súa hora local:"
 

src/pretix/locale/he/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2021-09-24 13:54+0000\n"
 "Last-Translator: ofirtro <ofir.tro@gmail.com>\n"
 "Language-Team: Hebrew <https://translate.pretix.eu/projects/pretix/pretix-js/"
@@ -290,14 +290,18 @@ msgid "Order canceled"
 msgstr "הזמנה בוטלה"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
-msgid "Checked-in Tickets"
+msgid "Ticket code is ambiguous on list"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+msgid "Checked-in Tickets"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "כרטיסים תקפים"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr ""
 
@@ -627,20 +631,20 @@ msgstr ""
 msgid "Please enter the amount the organizer can keep."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr ""
 

src/pretix/locale/hu/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2020-01-24 08:00+0000\n"
 "Last-Translator: Prokaj Miklós <mixolid0@gmail.com>\n"
 "Language-Team: Hungarian <https://translate.pretix.eu/projects/pretix/pretix-"
@@ -302,16 +302,20 @@ msgid "Order canceled"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 #, fuzzy
 #| msgid "Check-in QR"
 msgid "Checked-in Tickets"
 msgstr "Check in QR"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr ""
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr ""
 
@@ -679,22 +683,22 @@ msgstr "%(currency) %(price)-tól"
 msgid "Please enter the amount the organizer can keep."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Adjon meg egy mennyiséget az egyik jegytípusból."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 #, fuzzy
 #| msgid "Cart expired"
 msgid "required"
 msgstr "A kosár lejárt"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr ""
 

src/pretix/locale/it/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2022-05-08 19:00+0000\n"
 "Last-Translator: Emanuele Signoretta <signorettae@gmail.com>\n"
 "Language-Team: Italian <https://translate.pretix.eu/projects/pretix/pretix-"
@@ -293,14 +293,18 @@ msgid "Order canceled"
 msgstr "Ordine cancellato"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "Biglietti controllati"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "Biglietti validi"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "Attualmente all'interno"
 
@@ -640,20 +644,20 @@ msgstr "Ricevi indietro %(currency)s %(amount)s"
 msgid "Please enter the amount the organizer can keep."
 msgstr "Inserisci l'importo che l'organizzatore può trattenere."
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Inserisci la quantità per una tipologia di biglietto."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "richiesto"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Fuso orario:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "Ora locale:"
 

src/pretix/locale/ja/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2022-03-15 00:00+0000\n"
 "Last-Translator: Yuriko Matsunami <y.matsunami@enobyte.com>\n"
 "Language-Team: Japanese <https://translate.pretix.eu/projects/pretix/pretix-"
@@ -291,14 +291,18 @@ msgid "Order canceled"
 msgstr "注文がキャンセルされました"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "チェックイン済みのチケット"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "有効なチケット"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "現在オンラインです"
 
@@ -635,20 +639,20 @@ msgstr "%(currency)s %(amount)s が払い戻されます"
 msgid "Please enter the amount the organizer can keep."
 msgstr "イベント開催者が受け取る料金を入力してください。"
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "商品の総数を入力してください。"
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "必須"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "タイムゾーン："
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "現地時間："
 

src/pretix/locale/lv/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2022-04-06 03:00+0000\n"
 "Last-Translator: Liga V <lerning_by_dreaming@gmx.de>\n"
 "Language-Team: Latvian <https://translate.pretix.eu/projects/pretix/pretix-"
@@ -292,14 +292,18 @@ msgid "Order canceled"
 msgstr "Pasūtījums ir atcelts"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "Reģistrētās biļetes"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "Derīgās biļetes"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "Šobrīd iekšā"
 
@@ -646,20 +650,20 @@ msgstr "Jūs saņemsiet %(valūta)s %(cena)s atpakaļ"
 msgid "Please enter the amount the organizer can keep."
 msgstr "Lūdzu ievadiet skaitu (summu), ko pasākuma organizators var paturēt."
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Lūdzu, ievadiet nepieciešamo daudzumu izvēlētajam biļešu veidam."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "obligāts"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Laika zona:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "Vietējais laiks:"
 

src/pretix/locale/nb_NO/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2022-06-20 02:00+0000\n"
 "Last-Translator: fyksen <fredrik@fyksen.me>\n"
 "Language-Team: Norwegian Bokmål <https://translate.pretix.eu/projects/pretix/"
@@ -289,14 +289,18 @@ msgid "Order canceled"
 msgstr "Ordre kansellert"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "Innsjekkede billetter"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "Gydlige billetter"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "Inne nå"
 
@@ -632,20 +636,20 @@ msgstr "Du mottar %(currency)s %(amount)s tilbake"
 msgid "Please enter the amount the organizer can keep."
 msgstr "Vennligst skriv inn beløpet arrangøren kan beholde."
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Vennligst skriv inn et antall for en av billetttypene."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "nødvendig"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Tidssone:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "Din lokale tid:"
 

src/pretix/locale/nl/LC_MESSAGES/djangojs.po

@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2021-10-29 02:00+0000\n"
 "Last-Translator: Maarten van den Berg <maartenberg1@gmail.com>\n"
 "Language-Team: Dutch <https://translate.pretix.eu/projects/pretix/pretix-js/"
@@ -290,14 +290,18 @@ msgid "Order canceled"
 msgstr "Bestelling geannuleerd"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "Ingecheckte tickets"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "Geldige tickets"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "Op dit moment binnen"
 
@@ -638,20 +642,20 @@ msgstr "U krijgt %(currency)s %(amount)s terug"
 msgid "Please enter the amount the organizer can keep."
 msgstr "Voer het bedrag in dat de organisator mag houden."
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Voer een hoeveelheid voor een van de producten in."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "verplicht"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Tijdzone:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "Uw lokale tijd:"
 

src/pretix/locale/nl_BE/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: Automatically generated\n"
 "Language-Team: none\n"
@@ -287,14 +287,18 @@ msgid "Order canceled"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
-msgid "Checked-in Tickets"
+msgid "Ticket code is ambiguous on list"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
-msgid "Valid Tickets"
+msgid "Checked-in Tickets"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+msgid "Valid Tickets"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr ""
 
@@ -618,20 +622,20 @@ msgstr ""
 msgid "Please enter the amount the organizer can keep."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr ""
 

src/pretix/locale/nl_Informal/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2021-08-05 04:00+0000\n"
 "Last-Translator: Maarten van den Berg <maartenberg1@gmail.com>\n"
 "Language-Team: Dutch (informal) <https://translate.pretix.eu/projects/pretix/"
@@ -291,14 +291,18 @@ msgid "Order canceled"
 msgstr "Bestelling geannuleerd"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 msgid "Checked-in Tickets"
 msgstr "Ingecheckte kaartjes"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr "Geldige kaartjes"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr "Op dit moment binnen"
 
@@ -648,20 +652,20 @@ msgstr "Jij krijgt %(currency)s %(amount)s terug"
 msgid "Please enter the amount the organizer can keep."
 msgstr "Voer het bedrag in dat de organisator mag houden."
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Voer een hoeveelheid voor een van de producten in."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 msgid "required"
 msgstr "verplicht"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr "Tijdzone:"
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr "Je lokale tijd:"
 

src/pretix/locale/pl/LC_MESSAGES/djangojs.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2022-07-01 07:50+0000\n"
+"POT-Creation-Date: 2022-07-25 16:59+0000\n"
 "PO-Revision-Date: 2019-09-24 19:00+0000\n"
 "Last-Translator: Serge Bazanski <q3k@hackerspace.pl>\n"
 "Language-Team: Polish <https://translate.pretix.eu/projects/pretix/pretix-js/"
@@ -303,16 +303,20 @@ msgid "Order canceled"
 msgstr ""
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:62
+msgid "Ticket code is ambiguous on list"
+msgstr ""
+
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
 #, fuzzy
 #| msgid "Check-in QR"
 msgid "Checked-in Tickets"
 msgstr "QR zameldowania"
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:63
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
 msgid "Valid Tickets"
 msgstr ""
 
-#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:64
+#: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:65
 msgid "Currently inside"
 msgstr ""
 
@@ -686,22 +690,22 @@ msgstr "od %(currency)s %(price)s"
 msgid "Please enter the amount the organizer can keep."
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:377
+#: pretix/static/pretixpresale/js/ui/main.js:378
 msgid "Please enter a quantity for one of the ticket types."
 msgstr "Proszę wybrać liczbę dla jednego z typów biletów."
 
-#: pretix/static/pretixpresale/js/ui/main.js:413
+#: pretix/static/pretixpresale/js/ui/main.js:414
 #, fuzzy
 #| msgid "Cart expired"
 msgid "required"
 msgstr "Koszyk wygasł"
 
-#: pretix/static/pretixpresale/js/ui/main.js:516
-#: pretix/static/pretixpresale/js/ui/main.js:535
+#: pretix/static/pretixpresale/js/ui/main.js:517
+#: pretix/static/pretixpresale/js/ui/main.js:536
 msgid "Time zone:"
 msgstr ""
 
-#: pretix/static/pretixpresale/js/ui/main.js:526
+#: pretix/static/pretixpresale/js/ui/main.js:527
 msgid "Your local time:"
 msgstr ""