First steps

* fix sorting of filtered order list

fixes #628

* implement comments on pr

.travis.yml

@@ -13,11 +13,11 @@ services:
 matrix:
   include:
     - python: 3.4
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/sqlite.cfg
+      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg
     - python: 3.5
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/sqlite.cfg
+      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg
     - python: 3.6
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/sqlite.cfg
+      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg
     - python: 3.4
       env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_mysql.cfg
     - python: 3.5

doc/_themes/pretix_theme/static/css/pretix.css

@@ -6063,3 +6063,39 @@ url('../opensans_regular_macroman/OpenSans-Regular-webfont.svg#open_sansregular'
         white-space: normal;
     }
 }
+
+img.screenshot, a.screenshot img {
+    box-shadow: 0 4px 18px 0 rgba(0,0,0,0.1), 0 6px 20px 0 rgba(0,0,0,0.09);
+}
+
+/* Changes */
+.versionchanged {
+    background: #e7f2fa;
+    padding: 12px;
+    line-height: 24px;
+    margin-bottom: 24px;
+    -webkit-font-smoothing: antialiased;
+}
+.versionmodified {
+    background: #6ab0de;
+    font-weight: bold;
+    display: block;
+    color: #fff;
+    margin: -12px;
+    padding: 6px 12px;
+    margin-bottom: 12px;
+    font-family: inherit;
+}
+.versionmodified:before {
+    font-family: "FontAwesome";
+    display: inline-block;
+    font-style: normal;
+    font-weight: normal;
+    line-height: 1;
+    text-decoration: inherit;
+    content: "";
+    margin-right: 4px;
+}
+.versionchanged p:last-child {
+    margin-bottom: 0;
+}

doc/admin/config.rst

@@ -60,6 +60,14 @@ Example::
 ``password_reset``
     Enables or disables password reset. Defaults to ``on``.
 
+``long_sessions``
+    Enables or disables the "keep me logged in" button. Defaults to ``on``.
+
+``ecb_rates``
+    By default, pretix periodically downloads a XML file from the European Central Bank to retrieve exchange rates
+    that are used to print tax amounts in the customer currency on invoices for some currencies. Set to ``off`` to
+    disable this feature. Defaults to ``on``.
+
 
 Locale settings
 ---------------
@@ -164,14 +172,9 @@ Django settings
 Example::
 
     [django]
-    hosts=localhost
     secret=j1kjps5a5&4ilpn912s7a1!e2h!duz^i3&idu@_907s$wrz@x-
     debug=off
 
-``hosts``
-    Comma-separated list of allowed host names for this installation.
-    Default: ``localhost``
-
 ``secret``
     The secret to be used by Django for signing and verification purposes. If this
     setting is not provided, pretix will generate a random secret on the first start

doc/api/fundamentals.rst

@@ -4,6 +4,8 @@ Basic concepts
 This page describes basic concepts and definition that you need to know to interact
 with pretix' REST API, such as authentication, pagination and similar definitions.
 
+.. _`rest-auth`:
+
 Obtaining an API token
 ----------------------
 
@@ -13,12 +15,14 @@ or choose an existing team that has the level of permissions the token should ha
 create a new token using the form below the list of team members:
 
 .. image:: img/token_form.png
+   :class: screenshot
 
 You can enter a description for the token to distinguish from other tokens later on.
 Once you click "Add", you will be provided with an API token in the success message.
 Copy this token, as you won't be able to retrieve it again.
 
 .. image:: img/token_success.png
+   :class: screenshot
 
 Authentication
 --------------

doc/api/resources/events.rst

@@ -26,8 +26,12 @@ presale_end                           datetime                   The date at whi
 location                              multi-lingual string       The event location (or ``null``)
 has_subevents                         boolean                    ``True`` if the event series feature is active for this
                                                                  event
+meta_data                             dict                       Values set for organizer-specific meta data parameters.
 ===================================== ========================== =======================================================
 
+.. versionchanged:: 1.7
+
+   The ``meta_data`` field has been added.
 
 Endpoints
 ---------
@@ -69,7 +73,8 @@ Endpoints
             "presale_start": null,
             "presale_end": null,
             "location": null,
-            "has_subevents": false
+            "has_subevents": false,
+            "meta_data": {}
           }
         ]
       }
@@ -112,7 +117,8 @@ Endpoints
         "presale_start": null,
         "presale_end": null,
         "location": null,
-        "has_subevents": false
+        "has_subevents": false,
+        "meta_data": {}
       }
 
    :param organizer: The ``slug`` field of the organizer to fetch

doc/api/resources/index.rst

@@ -7,6 +7,7 @@ Resources and endpoints
    organizers
    events
    subevents
+   taxrules
    categories
    items
    questions

doc/api/resources/invoices.rst

@@ -29,9 +29,18 @@ payment_provider_text                 string                     Text to be prin
 footer_text                           string                     Text to be printed in the page footer area
 lines                                 list of objects            The actual invoice contents
 ├ description                         string                     Text representing the invoice line (e.g. product name)
-├ gross_value                         money (string)             Price including VAT
-├ tax_value                           money (string)             VAT amount
-└ tax_rate                            decimal (string)           Used VAT rate
+├ gross_value                         money (string)             Price including taxes
+├ tax_value                           money (string)             Tax amount included
+├ tax_name                            string                     Name of used tax rate (e.g. "VAT")
+└ tax_rate                            decimal (string)           Used tax rate
+foreign_currency_display              string                     If the invoice should also show the total and tax
+                                                                 amount in a different currency, this contains the
+                                                                 currency code (``null`` otherwise).
+foreign_currency_rate                 decimal (string)           If ``foreign_currency_rate`` is set and the system
+                                                                 knows the exchange rate to the event currency at
+                                                                 invoicing time, it is stored here.
+foreign_currency_rate_date            date                       If ``foreign_currency_rate`` is set, this signifies the
+                                                                 date at which the currency rate was obtained.
 ===================================== ========================== =======================================================
 
 
@@ -42,6 +51,12 @@ lines                                 list of objects            The actual invo
    number.
 
 
+.. versionchanged:: 1.7
+
+   The attributes ``lines.tax_name``, ``foreign_currency_display``, ``foreign_currency_rate``, and
+   ``foreign_currency_rate_date`` have been added.
+
+
 Endpoints
 ---------
 
@@ -88,9 +103,13 @@ Endpoints
                 "description": "Budget Ticket",
                 "gross_value": "23.00",
                 "tax_value": "0.00",
+                "tax_name": "VAT",
                 "tax_rate": "0.00"
               }
-            ]
+            ],
+            "foreign_currency_display": "PLN",
+            "foreign_currency_rate": "4.2408",
+            "foreign_currency_rate_date": "2017-07-24"
           }
         ]
       }
@@ -147,9 +166,13 @@ Endpoints
             "description": "Budget Ticket",
             "gross_value": "23.00",
             "tax_value": "0.00",
+            "tax_name": "VAT",
             "tax_rate": "0.00"
           }
-        ]
+        ],
+        "foreign_currency_display": "PLN",
+        "foreign_currency_rate": "4.2408",
+        "foreign_currency_rate_date": "2017-07-24"
       }
 
    :param organizer: The ``slug`` field of the organizer to fetch

doc/api/resources/items.rst

@@ -27,6 +27,7 @@ free_price                            boolean                    If ``True``, cu
                                                                  lower than the price defined by ``default_price`` or
                                                                  otherwise).
 tax_rate                              decimal (string)           The VAT rate to be applied for this item.
+tax_rule                              integer                    The internal ID of the applied tax rule (or ``null``).
 admission                             boolean                    ``True`` for items that grant admission to the event
                                                                  (such as primary tickets) and ``False`` for others
                                                                  (such as add-ons or merchandise).
@@ -49,6 +50,9 @@ min_per_order                         integer                    This product ca
 max_per_order                         integer                    This product can only be bought if it is included at
                                                                  most this many times in the order (or ``null`` for no
                                                                  limitation).
+checkin_attention                     boolean                    If ``True``, the check-in app should show a warning
+                                                                 that this ticket requires special attention if such
+                                                                 a product is being scanned.
 has_variations                        boolean                    Shows whether or not this item has variations
                                                                  (read-only).
 variations                            list of objects            A list with one object for each variation of this item.
@@ -70,6 +74,11 @@ addons                                list of objects            Definition of a
 └ position                            integer                    An integer, used for sorting
 ===================================== ========================== =======================================================
 
+.. versionchanged:: 1.7
+
+   The attribute ``tax_rule`` has been added. ``tax_rate`` is kept for compatibility. The attribute
+   ``checkin_attention`` has been added.
+
 
 Endpoints
 ---------
@@ -108,6 +117,7 @@ Endpoints
             "description": null,
             "free_price": false,
             "tax_rate": "0.00",
+            "tax_rule": 1,
             "admission": false,
             "position": 0,
             "picture": null,
@@ -118,6 +128,7 @@ Endpoints
             "allow_cancel": true,
             "min_per_order": null,
             "max_per_order": null,
+            "checkin_attention": false,
             "has_variations": false,
             "variations": [
               {
@@ -188,6 +199,7 @@ Endpoints
         "description": null,
         "free_price": false,
         "tax_rate": "0.00",
+        "tax_rule": 1,
         "admission": false,
         "position": 0,
         "picture": null,
@@ -198,6 +210,7 @@ Endpoints
         "allow_cancel": true,
         "min_per_order": null,
         "max_per_order": null,
+        "checkin_attention": false,
         "has_variations": false,
         "variations": [
           {

doc/api/resources/orders.rst

@@ -27,20 +27,38 @@ expires                               datetime                   The order will
 payment_date                          date                       Date of payment receival
 payment_provider                      string                     Payment provider used for this order
 payment_fee                           money (string)             Payment fee included in this order's total
-payment_fee_tax_rate                  decimal (string)           VAT rate applied to the payment fee
-payment_fee_tax_value                 money (string)             VAT value included in the payment fee
+payment_fee_tax_rate                  decimal (string)           Tax rate applied to the payment fee
+payment_fee_tax_value                 money (string)             Tax value included in the payment fee
+payment_fee_tax_rule                  integer                    The ID of the used tax rule (or ``null``)
 total                                 money (string)             Total value of this order
 comment                               string                     Internal comment on this order
 invoice_address                       object                     Invoice address information (can be ``null``)
 ├ last_modified                       datetime                   Last modification date of the address
 ├ company                             string                     Customer company name
+├ is_business                         boolean                    Business or individual customers (always ``False``
+                                                                 for orders created before pretix 1.7, do not rely on
+                                                                 it).
 ├ name                                string                     Customer name
 ├ street                              string                     Customer street
 ├ zipcode                             string                     Customer ZIP code
 ├ city                                string                     Customer city
 ├ country                             string                     Customer country
-└ vat_id                              string                     Customer VAT ID
+├ vat_id                              string                     Customer VAT ID
+└ vat_id_validated                    string                     ``True``, if the VAT ID has been validated against the
+                                                                 EU VAT service and validation was successful. This only
+                                                                 happens in rare cases.
 position                              list of objects            List of order positions (see below)
+fees                                  list of objects            List of fees included in the order total (i.e.
+                                                                 payment fees)
+├ fee_type                            string                     Type of fee (currently ``payment``, ``passbook``,
+                                                                 ``other``)
+├ value                               money (string)             Fee amount
+├ description                         string                     Human-readable string with more details (can be empty)
+├ internal_type                       string                     Internal string (i.e. ID of the payment provider),
+                                                                 can be empty
+├ tax_rate                            decimal (string)           VAT rate applied for this fee
+├ tax_value                           money (string)             VAT included in this fee
+└ tax_rule                            integer                    The ID of the used tax rule (or ``null``)
 downloads                             list of objects            List of ticket download options for order-wise ticket
                                                                  downloading. This might be a multi-page PDF or a ZIP
                                                                  file of tickets for outputs that do not support
@@ -56,6 +74,12 @@ downloads                             list of objects            List of ticket
    The ``invoice_address.country`` attribute contains a two-letter country code for all new orders. For old orders,
    a custom text might still be returned.
 
+.. versionchanged:: 1.7
+
+   The attributes ``invoice_address.vat_id_validated`` and ``invoice_address.is_business`` have been added.
+   The attributes ``order.payment_fee``, ``order.payment_fee_tax_rate`` and ``order.payment_fee_tax_value`` have been
+   deprecated in favour of the new ``fees`` attribute but will still be served and removed in 1.9.
+
 
 Order position resource
 -----------------------
@@ -76,6 +100,7 @@ attendee_email                        string                     Specified atten
 voucher                               integer                    Internal ID of the voucher used for this position (or ``null``)
 tax_rate                              decimal (string)           VAT rate applied for this position
 tax_value                             money (string)             VAT included in this position
+tax_rule                              integer                    The ID of the used tax rule (or ``null``)
 secret                                string                     Secret code printed on the tickets for validation
 addon_to                              integer                    Internal ID of the position this position is an add-on for (or ``null``)
 subevent                              integer                    ID of the date inside an event series this position belongs to (or ``null``).
@@ -90,6 +115,10 @@ answers                               list of objects            Answers to user
 └ options                             list of integers           Internal IDs of selected option(s)s (only for choice types)
 ===================================== ========================== =======================================================
 
+.. versionchanged:: 1.7
+
+   The attribute ``tax_rule`` has been added.
+
 
 Order endpoints
 ---------------
@@ -129,20 +158,20 @@ Order endpoints
             "expires": "2017-12-10T10:00:00Z",
             "payment_date": "2017-12-05",
             "payment_provider": "banktransfer",
-            "payment_fee": "0.00",
-            "payment_fee_tax_rate": "0.00",
-            "payment_fee_tax_value": "0.00",
+            "fees": [],
             "total": "23.00",
             "comment": "",
             "invoice_address": {
                 "last_modified": "2017-12-01T10:00:00Z",
+                "is_business": True,
                 "company": "Sample company",
                 "name": "John Doe",
                 "street": "Test street 12",
                 "zipcode": "12345",
                 "city": "Testington",
                 "country": "Testikistan",
-                "vat_id": "EU123456789"
+                "vat_id": "EU123456789",
+                "vat_id_validated": False
             },
             "positions": [
               {
@@ -157,6 +186,7 @@ Order endpoints
                 "voucher": null,
                 "tax_rate": "0.00",
                 "tax_value": "0.00",
+                "tax_rule": null,
                 "secret": "z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
                 "addon_to": null,
                 "subevent": null,
@@ -233,20 +263,20 @@ Order endpoints
         "expires": "2017-12-10T10:00:00Z",
         "payment_date": "2017-12-05",
         "payment_provider": "banktransfer",
-        "payment_fee": "0.00",
-        "payment_fee_tax_rate": "0.00",
-        "payment_fee_tax_value": "0.00",
+        "fees": [],
         "total": "23.00",
         "comment": "",
         "invoice_address": {
             "last_modified": "2017-12-01T10:00:00Z",
             "company": "Sample company",
+            "is_business": True,
             "name": "John Doe",
             "street": "Test street 12",
             "zipcode": "12345",
             "city": "Testington",
             "country": "Testikistan",
-            "vat_id": "EU123456789"
+            "vat_id": "EU123456789",
+            "vat_id_validated": False
         },
         "positions": [
           {
@@ -260,6 +290,7 @@ Order endpoints
             "attendee_email": null,
             "voucher": null,
             "tax_rate": "0.00",
+            "tax_rule": null,
             "tax_value": "0.00",
             "secret": "z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
             "addon_to": null,
@@ -379,6 +410,7 @@ Order position endpoints
             "attendee_email": null,
             "voucher": null,
             "tax_rate": "0.00",
+            "tax_rule": null,
             "tax_value": "0.00",
             "secret": "z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
             "addon_to": null,
@@ -457,6 +489,7 @@ Order position endpoints
         "attendee_email": null,
         "voucher": null,
         "tax_rate": "0.00",
+        "tax_rule": null,
         "tax_value": "0.00",
         "secret": "z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
         "addon_to": null,

doc/api/resources/subevents.rst

@@ -31,8 +31,13 @@ variation_price_overrides             list of objects            List of variati
                                                                  the default price
 ├ variation                           integer                    The internal variation ID
 └ price                               money (string)             The price or ``null`` for the default price
+meta_data                             dict                       Values set for organizer-specific meta data parameters.
 ===================================== ========================== =======================================================
 
+.. versionchanged:: 1.7
+
+   The ``meta_data`` field has been added.
+
 
 Endpoints
 ---------
@@ -78,7 +83,8 @@ Endpoints
                 "price": "12.00"
               }
             ],
-            "variation_price_overrides": []
+            "variation_price_overrides": [],
+            "meta_data": {}
           }
         ]
       }
@@ -126,7 +132,8 @@ Endpoints
             "price": "12.00"
           }
         ],
-        "variation_price_overrides": []
+        "variation_price_overrides": [],
+        "meta_data": {}
       }
 
    :param organizer: The ``slug`` field of the organizer to fetch

doc/api/resources/taxrules.rst

@@ -0,0 +1,109 @@
+Tax rules
+=========
+
+Resource description
+--------------------
+
+Tax rules specify how tax should be calculated for specific products.
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal ID of the tax rule
+name                                  multi-lingual string       The tax rules' name
+rate                                  decimal (string)           Tax rate in percent
+price_includes_tax                    boolean                    If ``true`` (default), tax is assumed to be included in
+                                                                 the specified product price
+eu_reverse_charge                     boolean                    If ``true``, EU reverse charge rules are applied
+home_country                          string                     Merchant country (required for reverse charge), can be
+                                                                 ``null`` or empty string
+===================================== ========================== =======================================================
+
+.. versionchanged:: 1.7
+
+   This resource has been added.
+
+
+Endpoints
+---------
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/taxrules/
+
+   Returns a list of all tax rules configured for an event.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/taxrules/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: text/javascript
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "name": {"en": "VAT"},
+            "rate": "19.00",
+            "price_includes_tax": true,
+            "eu_reverse_charge": false,
+            "home_country": "DE"
+          }
+        ]
+      }
+
+   :query page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of a valid organizer
+   :param event: The ``slug`` field of the event to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view it.
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/taxrules/(id)/
+
+   Returns information on one tax rule, identified by its ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/taxrules/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: text/javascript
+
+      {
+        "id": 1,
+        "name": {"en": "VAT"},
+        "rate": "19.00",
+        "price_includes_tax": true,
+        "eu_reverse_charge": false,
+        "home_country": "DE"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param id: The ``slug`` field of the sub-event to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view it.

doc/conf.py

@@ -13,6 +13,10 @@
 # All configuration values have a default; values that are commented out
 # serve to show the default.
 
+from docutils.parsers.rst.directives.admonitions import BaseAdmonition
+from sphinx.util import compat
+compat.make_admonition = BaseAdmonition  # See https://github.com/spinus/sphinxcontrib-images/issues/41
+
 import sys
 import os
 
@@ -38,9 +42,9 @@ django.setup()
 extensions = [
     'sphinx.ext.autodoc',
     'sphinx.ext.doctest',
-    'sphinx.ext.todo',
     'sphinx.ext.coverage',
     'sphinxcontrib.httpdomain',
+    'sphinxcontrib.images',
 ]
 
 # Add any paths that contain templates here, relative to this directory.
@@ -281,3 +285,8 @@ texinfo_documents = [
 
 # If true, do not generate a @detailmenu in the "Top" node's menu.
 #texinfo_no_detailmenu = False
+
+
+images_config = {
+    'default_image_width': '250px'
+}

doc/development/api/customview.rst

@@ -60,7 +60,85 @@ your views::
     def admin_view(request, organizer, event):
         ...
 
-Similarly, there is ``organizer_permission_required`` and ``OrganizerPermissionRequiredMixin``.
+Similarly, there is ``organizer_permission_required`` and ``OrganizerPermissionRequiredMixin``. In case of
+event-related views, there is also a signal that allows you to add the view to the event navigation like this::
+
+
+    from django.core.urlresolvers import resolve, reverse
+    from django.dispatch import receiver
+    from django.utils.translation import ugettext_lazy as _
+    from pretix.control.signals import nav_event
+
+
+    @receiver(nav_event, dispatch_uid='friends_tickets_nav')
+    def navbar_info(sender, request, **kwargs):
+        url = resolve(request.path_info)
+        if not request.user.has_event_permission(request.organizer, request.event, 'can_change_vouchers'):
+            return []
+        return [{
+            'label': _('My plugin view'),
+            'icon': 'heart',
+            'url': reverse('plugins:myplugin:index', kwargs={
+                'event': request.event.slug,
+                'organizer': request.organizer.slug,
+            }),
+            'active': url.namespace == 'plugins:myplugin' and url.url_name == 'review',
+        }]
+
+
+Event settings view
+-------------------
+
+A special case of a control panel view is a view hooked into the event settings page. For this case, there is a
+special navigation signal::
+
+    @receiver(nav_event_settings, dispatch_uid='friends_tickets_nav_settings')
+    def navbar_settings(sender, request, **kwargs):
+        url = resolve(request.path_info)
+        return [{
+            'label': _('My settings'),
+            'url': reverse('plugins:myplugin:settings', kwargs={
+                'event': request.event.slug,
+                'organizer': request.organizer.slug,
+            }),
+            'active': url.namespace == 'plugins:myplugin' and url.url_name == 'settings',
+        }]
+
+Also, your view should inherit from ``EventSettingsViewMixin`` and your template from ``pretixcontrol/event/settings_base.html``
+for good integration. If you just want to display a form, you could do it like the following::
+
+    class MySettingsView(EventSettingsViewMixin, EventSettingsFormView):
+        model = Event
+        permission = 'can_change_settings'
+        form_class = MySettingsForm
+        template_name = 'my_plugin/settings.html'
+
+        def get_success_url(self, **kwargs):
+            return reverse('plugins:myplugin:settings', kwargs={
+                'organizer': self.request.event.organizer.slug,
+                'event': self.request.event.slug,
+            })
+
+With this template::
+
+    {% extends "pretixcontrol/event/settings_base.html" %}
+    {% load i18n %}
+    {% load bootstrap3 %}
+    {% block title %} {% trans "Friends Tickets Settings" %} {% endblock %}
+    {% block inside %}
+        <form action="" method="post" class="form-horizontal">
+            {% csrf_token %}
+            <fieldset>
+                <legend>{% trans "Friends Tickets Settings" %}</legend>
+                {% bootstrap_form form layout="horizontal" %}
+            </fieldset>
+            <div class="form-group submit-group">
+                <button type="submit" class="btn btn-primary btn-save">
+                    {% trans "Save" %}
+                </button>
+            </div>
+        </form>
+    {% endblock %}
 
 Frontend views
 --------------
@@ -68,35 +146,34 @@ Frontend views
 Including a custom view into the participant-facing frontend is a little bit different as there is
 no path prefix like ``control/``.
 
-First, define your URL in your ``urls.py``, but this time in the ``event_patterns`` section::
+First, define your URL in your ``urls.py``, but this time in the ``event_patterns`` section and wrapped by
+``event_url``::
 
-    from django.conf.urls import url
+    from pretix.multidomain import event_url
 
     from . import views
 
     event_patterns = [
-        url(r'^mypluginname/', views.frontend_view, name='frontend'),
+        event_url(r'^mypluginname/', views.frontend_view, name='frontend'),
     ]
 
-You can then implement a view as you would normally do, but you need to apply a decorator to your
-view if you want pretix's default behavior::
-
-    from pretix.presale.utils import event_view
-
-    @event_view
-    def some_event_view(request, *args, **kwargs):
-        ...
-
-This decorator will check the URL arguments for their ``event`` and ``organizer`` parameters and
-correctly ensure that:
+You can then implement a view as you would normally do. It will be automatically ensured that:
 
 * The requested event exists
-* The requested event is activated (can be overridden by decorating with ``@event_view(require_live=False)``)
+* The requested event is active (you can disable this check using ``event_url(…, require_live=True)``)
 * The event is accessed via the domain it should be accessed
 * The ``request.event`` attribute contains the correct ``Event`` object
 * The ``request.organizer`` attribute contains the correct ``Organizer`` object
+* Your plugin is enabled
 * The locale is set correctly
 
+.. versionchanged:: 1.7
+
+   The ``event_url()`` wrapper has been added in 1.7 to replace the former ``@event_view`` decorator. The
+   ``event_url()`` wrapper is optional and using ``url()`` still works, but you will not be able to set the
+   ``require_live`` setting any more via the decorator. The ``@event_view`` decorator is now deprecated and
+   does nothing.
+
 REST API viewsets
 -----------------
 

doc/development/api/general.rst

@@ -19,13 +19,13 @@ Order events
 There are multiple signals that will be sent out in the ordering cycle:
 
 .. automodule:: pretix.base.signals
-   :members: validate_cart, order_paid, order_placed
+   :members: validate_cart, fee_calculation_for_cart, order_fee_calculation, order_paid, order_placed, order_fee_type_name, allow_ticket_download
 
 Frontend
 --------
 
 .. automodule:: pretix.presale.signals
-   :members: html_head, html_footer, footer_links, front_page_top, front_page_bottom, contact_form_fields, question_form_fields, checkout_confirm_messages
+   :members: html_head, html_footer, footer_links, front_page_top, front_page_bottom, contact_form_fields, question_form_fields, checkout_confirm_messages, checkout_confirm_page_content
 
 
 .. automodule:: pretix.presale.signals
@@ -47,20 +47,26 @@ Backend
 -------
 
 .. automodule:: pretix.control.signals
-   :members: nav_event, html_head, quota_detail_html, nav_topbar, nav_global, nav_organizer
+   :members: nav_event, html_head, quota_detail_html, nav_topbar, nav_global, nav_organizer, nav_event_settings, order_info
 
 
 .. automodule:: pretix.base.signals
-   :members: logentry_display, requiredaction_display
+   :members: logentry_display, logentry_object_link, requiredaction_display
 
 Vouchers
 """"""""
 
 .. automodule:: pretix.control.signals
-   :members: voucher_form_class, voucher_form_html
+   :members: voucher_form_class, voucher_form_html, voucher_form_validation
 
 Dashboards
 """"""""""
 
 .. automodule:: pretix.control.signals
    :members: event_dashboard_widgets, user_dashboard_widgets
+
+Ticket designs
+""""""""""""""
+
+.. automodule:: pretix.plugins.ticketoutputpdf.signals
+   :members: layout_text_variables

doc/development/api/plugins.rst

@@ -114,6 +114,19 @@ method to make your receivers available::
         def ready(self):
             from . import signals  # NOQA
 
+You can optionally specify code that is executed when your plugin is activated for an event
+in the ``installed`` method::
+
+    class PaypalApp(AppConfig):
+        …
+
+        def installed(self, event):
+            pass  # Your code here
+
+
+Note that ``installed`` will *not* be called if the plugin in indirectly activated for an event
+because the event is created with settings copied from another event.
+
 Views
 -----
 

doc/development/concepts.rst

@@ -59,7 +59,7 @@ If an item is assigned to multiple quotas, it can only be bought if *all of them
 If multiple items are assigned to the same quota, the quota will be counted as sold out as soon as the
 *sum* of the two items exceeds the quota limit.
 
-The availability of a quota is currently calculated by substracting the following numbers from the quota
+The availability of a quota is currently calculated by subtracting the following numbers from the quota
 limit:
 
 * The number of orders placed for an item that are either already paid or within their granted payment period

doc/development/implementation/background.rst

@@ -14,7 +14,7 @@ Implementing a task
 A common pattern for implementing asynchronous tasks can be seen a lot in ``pretix.base.services``
 and looks like this::
 
-    from pretix.celery import app
+    from pretix.celery_app import app
 
     @app.task
     def my_task(argument1, argument2):

doc/development/implementation/models.rst

@@ -32,6 +32,15 @@ Organizers and events
 .. autoclass:: pretix.base.models.RequiredAction
    :members:
 
+.. autoclass:: pretix.base.models.EventMetaProperty
+   :members:
+
+.. autoclass:: pretix.base.models.EventMetaValue
+   :members:
+
+.. autoclass:: pretix.base.models.SubEventMetaValue
+   :members:
+
 
 Items
 -----

doc/development/index.rst

@@ -10,6 +10,3 @@ Developer documentation
    implementation/index
    api/index
    structure
-
-.. TODO::
-   Document settings objects, ItemVariation objects, form fields.

doc/plugins/pretixdroid.rst

@@ -99,6 +99,7 @@ uses to communicate with the pretix server.
             "variation": null,
             "attendee_name": "Peter Higgs",
             "redeemed": false,
+            "attention": false,
             "paid": true
           },
           ...
@@ -107,10 +108,10 @@ uses to communicate with the pretix server.
       }
 
    :query query: Search query
-         :query key: Secret API key
-         :statuscode 200: Valid request
-         :statuscode 404: Unknown organizer or event
-         :statuscode 403: Invalid authorization key
+   :query key: Secret API key
+   :statuscode 200: Valid request
+   :statuscode 404: Unknown organizer or event
+   :statuscode 403: Invalid authorization key
 
 .. http:get:: /pretixdroid/api/(organizer)/(event)/download/
 
@@ -140,6 +141,7 @@ uses to communicate with the pretix server.
             "variation": null,
             "attendee_name": "Peter Higgs",
             "redeemed": false,
+            "attention": false,
             "paid": true
           },
           ...

doc/requirements.txt

@@ -2,3 +2,4 @@
 sphinx
 sphinx-rtd-theme
 sphinxcontrib-httpdomain
+sphinxcontrib-images

doc/user/events/create.rst

@@ -0,0 +1,97 @@
+Creating an event
+=================
+
+After you have created an organizer account, the next step is to create your event. An event is the basic object in
+pretix that everything is organized around. One event corresponds to one ticket shop with all its products, quotas,
+orders and settings.
+
+To create an event, you can click the "Create a new event" tile on your dashboard or the button above the list of
+events. You will then be presented with the first step of event creation:
+
+.. thumbnail:: ../../screens/event/create_step1.png
+   :align: center
+   :class: screenshot
+
+Here, you first need to decide for the organizer the event belongs to. You will not be able to change this
+association later. This will determine default settings for the event, as well as access control to the event's
+settings.
+
+Second, you need to select the languages that the ticket shop should be available in. You can change this setting
+later, but if you select it correctly now, it will automatically ask you for all descriptions in the respective
+languages starting from the next step.
+
+Last on this page, you can decide if this event represents an event series. In this cases, the event will turn into
+multiple events included in once, meaning that you will get one combined ticket shop for multiple actual events. This
+is useful if you have a large number of events that are very similar to each other and that should be sold together
+(i.e. users should be able to buy tickets for multiple events at the same time). Those single events can differ in
+available products, quotas, prices and some meta information, but most settings need to be the same for all of them.
+We recommend to use this feature only if you really know that you need it and if you really run a lot of events, not if
+you run e.g. a yearly conference.
+
+Once you set these values, you can procede to the next step:
+
+.. thumbnail:: ../../screens/event/create_step2.png
+   :align: center
+   :class: screenshot
+
+In this step, you will be asked more detailled questions about your event. In particular, you can fill in the
+following fields:
+
+Name
+   This is the public name of your event. It should be descriptive and tell both you and the user which event you are
+   dealing with, but should still be concise. You probably know how your event is named already ;)
+
+Short form
+   This will be used in multiple places. For example, the URL of your ticket shop will include this short form of
+   your event name, but it will also be the default prefix e.g. for invoice numbers. We recommend to use some natural
+   abbreviation of your event name, maybe together with a date, of no more than 10 characters. This is the only value
+   on this page that can't be changed later.
+
+Event start time
+   The date and time that your event starts at. You can later configure settings to hide the time, if you don't want
+   to show that.
+
+Event end time
+   The date and time your event ends at. You can later configure settings to hide this value completely -- or you can
+   just leave it empty. It's optional!
+
+Location
+   This is the location of your event in a human-readable format. We will show this on the ticket shop frontpage, but
+   it might also be used e.g. in Wallet tickets.
+
+Event currency
+   This is the currency all prices and payments in your shop will be handled in.
+
+Sales tax rate
+   If you need to pay a form of sales tax (also known as VAT in many countries) on your products, you can set a tax rate
+   in percent here that will be used as a default later. After creating your event, you can also create multiple tax
+   rates or fine-tune the tax settings.
+
+Default language
+   If you selected multiple supported languages in the previous step, you can now decide which one should be
+   displayed by default.
+
+Start of presale
+   If you set this date, no ticket will be sold before this date. We normally recommend not to set this date during
+   event creation because it will make testing your shop harder.
+
+End of presale
+   If you set this date, no ticket will be sold after this date.
+
+If all of this is set, you can proceed to the next step. If this is your first event, there will not be a next step
+and you are done! If you have already created events before, you will be asked if you want to copy settings from one
+of them:
+
+.. thumbnail:: ../../screens/event/create_step3.png
+   :align: center
+   :class: screenshot
+
+If you do so, all products, categories, quotas and most settings of the other event will be taken over. You should
+still review them if they make sense for your new event, but it could save you a lot of work. After this step, your
+event is created successfully:
+
+.. thumbnail:: ../../screens/event/create_step4.png
+   :align: center
+   :class: screenshot
+
+You can now fine-tune all settings to your liking, publish your event and start selling tickets!

doc/user/events/taxes.rst

@@ -0,0 +1,109 @@
+Tax rules
+=========
+
+In most countries, you will be required to pay some form of sales tax for your event tickets. If you don't know about
+the exact rules, you should consult a professional tax consultant right now.
+
+To implement those taxes in pretix, you can create one or multiple "tax rules". A tax rule specifies when and at what
+rate should be calculated on a product price. Taxes will then be correctly displayed in the product list, order
+details and on invoices.
+
+At the time of this writing, every product can be assigned exactly one tax rule. To view and change the tax rules of
+your event, go to the respective section in your event's settings:
+
+.. thumbnail:: ../../screens/event/tax_list.png
+   :align: center
+   :class: screenshot
+
+On this page, you can create, edit and delete your tax rules. Clicking on the name of a tax rule will take you to its
+detailled settings:
+
+.. thumbnail:: ../../screens/event/tax_detail.png
+   :align: center
+   :class: screenshot
+
+Here, you can tune the following parameters:
+
+Name
+    What is the (short) name of this tax? This is probably "VAT" in English and should be very short as it will be
+    displayed in lots of places.
+
+Rate
+    This is the tax rate in percent.
+
+The configured product prices include the tax amount
+    If this setting is enabled (the default), then a product configured to a price of 10.00 EUR will, at a tax rate of
+    19.00 %, be interpreted as a product with a total gross price of 10.00 EUR including 1.60 EUR taxes, leading to a
+    net price of 8.40 EUR. If you disable this setting, the price will be interpreted as a net price of 10.00 EUR,
+    leading to a total price to pay of 11.90 EUR.
+
+Use EU reverse charge taxation rules
+    This enables reverse charge taxation (see section below).
+
+Merchant country
+    This is probably your country of residence, but in some cases it could also be the country your event is
+    located in. This is the place of taxation in the sense of EU reverse charge rules (see section below).
+
+EU reverse charge
+-----------------
+
+.. warning:: Everything contained in this section is not legal advice. Please consult a tax consultant
+             before making decisions. We are not responsible for the correct handling of taxes in your
+             ticket shop.
+
+"Reverse charge" is a rule in European VAT legislation that specifies how taxes are paid
+if you provide goods to a buyer in a different European country than you reside in yourself.
+If the buyer is a VAT-paying business in their country, you charge them only the net price without
+taxes and state that the buyer is responsible for paying the correct taxes themselves.
+
+.. warning:: We firmly believe that reverse charge rules are **not applicable** for most events handled
+             with pretix and therefore **strongly recommend not to enable this feature** if you do not have
+             a specific reason to do so. The reasoning behind this is that according to article 52 of the
+             `VAT directive`_ (page 17), the place of supply is always the location of your event and
+             therefore the tax rate of the event country always has to be paid regardless of the location
+             of the visitor.
+
+If you enable the reverse charge feature and specify your merchant country, then the following process
+will be performed during order creation:
+
+* The user will first be presented with the "normal" prices (net or gross, as configured).
+
+* The user adds a product to their cart. The cart will at this point always show gross prices *with*
+  taxes.
+
+* In the next step, the user can enter an invoice address. Tax will be removed from the price if one of the
+  following statements is true:
+
+  * The invoice address is in a non-EU country.
+
+  * The invoice address is a business address in an EU-country different from the merchant country and has a valid VAT ID.
+
+* In the second case, a reverse charge note will be added to the invoice.
+
+VAT IDs are validated against the EUs validation web service. Should that service be unavailable, the user
+needs to pay VAT tax and reclaim the taxes at a later point in time with their government.
+
+If you and the buyer are residing in EU countries that use different currencies, the invoice will show
+the total and VAT amount also in the local currency of the buyer, if the system was able to obtain a
+conversion rate from the European Central Bank's webservice within the last 7 days.
+
+For existing orders, a change of the invoice address will not result in a change of taxes automatically.
+You can trigger this manually in the backend by going to the order's detail view. There, first click
+the "Check" button next to the VAT ID. Then, go to "Change products" and select the option "Recalculate
+taxes" at the end of the page.
+
+.. note:: In the invoicing settings, you should turn the setting "Ask for VAT ID" on for this to work.
+
+.. note:: During back-and-forth modification of taxation status, unfortunately there can be rounding
+          errors of usually up to one cent from the intended price. This is unavoidable due to the
+          flexible nature in which prices are being calculated.
+
+Taxation of payment fees
+------------------------
+
+In the payment part of your event settings, you can choose the tax rule that needs to be applied for
+payment method fees. This works in the same way as product prices, with the small difference that the
+"configured product prices include the tax amount" settings is ignored and payment fees will always be
+treated as gross values.
+
+.. _VAT directive: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32006L0112&from=EN

doc/user/index.rst

@@ -1,7 +1,13 @@
 User Guide
 ==========
 
+This section of our documentation is dedicated to show you the way around pretix if you are an event organizer
+wanting to use pretix to sell tickets.
+
 .. toctree::
    :maxdepth: 2
 
+   organizers/index
+   events/create
+   events/taxes
    payments/index

doc/user/organizers/index.rst

@@ -0,0 +1,112 @@
+Organizer accounts and teams
+============================
+
+Organizer account
+-----------------
+
+The basis of all your operations within pretix is your organizer account. It represents an entity that is running
+events, for example a company, yourself or any other institution.
+Every event belongs to one organizer account and events within the same organizer account are assumed to belong together
+in some sense, whereas events in different organizer accounts are completely isolated.
+
+If you want to use the hosted pretix service, you can create an organizer account on our `Get started`_ page. Otherwise,
+ask your pretix administrator for access to an organizer account.
+
+You can find out all organizer accounts you have access to by going to your global dashboard (click on the pretix logo
+in the top-left corner) and then select "Organizers" from the navigation bar on the left side. Then, choose one of the
+organizer accounts presented, if there are multiple of them:
+
+.. thumbnail:: ../../screens/organizer/list.png
+   :align: center
+   :class: screenshot
+
+This overview shows you all event that belong to the organizer and you have access to:
+
+.. thumbnail:: ../../screens/organizer/event_list.png
+   :align: center
+   :class: screenshot
+
+With the "Edit" button at the top, next to the organizer account name, you can modify properties of the organizer
+account such as its name and display settings for the public profile page of the organizer account:
+
+.. thumbnail:: ../../screens/organizer/edit.png
+   :align: center
+   :class: screenshot
+
+.. tip::
+
+   The profile page will be shown as ``https://pretix.eu/slug/`` where ``slug`` is to be replaced by the short form of
+   the organizer name that you entered during account creation and ``pretix.eu`` is to be replaced by your
+   installation's domain name if you are not using our hosted service.
+
+   Instead, you can also use a custom domain for the profile page and your events, for example
+   ``https://tickets.example.com/`` if ``example.com`` is a domain that you own. In this case, please contact the pretix
+   hosted support or your system administrator to set up the custom domain.
+
+Teams
+-----
+
+We don't expect you to work on your events all by yourself and therefore, pretix comes with ways to invite your fellow
+team members to access your pretix organizer account. To manage teams, click on the "Teams" link on your organizer
+settings page (see above how to find it). This shows you a list of teams that should contain at least one team already:
+
+.. thumbnail:: ../../screens/organizer/team_list.png
+   :align: center
+   :class: screenshot
+
+If you click on a team name, you get to a page that shows you the current members of the team:
+
+.. thumbnail:: ../../screens/organizer/team_detail.png
+   :align: center
+   :class: screenshot
+
+You see that there is a list of pretix user accounts (i.e. email addresses), who are part of the team. To add a user to
+the team, just enter their email address in the text box next to the "Add" button. If the user already has an account
+in the pretix system they will instantly get access to the team. Otherwise, they will be sent an email with an invitation
+link that can be used to create an account. This account will then instantly have access to the team. Users can be part
+of as many teams as you want.
+
+In the section below, you can also create access tokens for our :ref:`rest-api`. You can read more on this topic in the
+section :ref:`rest-auth` of the API documentation.
+
+Next to the team name, you again see a button called "Edit" that allows you to modify the permissions of the team.
+Permissions separate into two areas:
+
+* **Organizer permissions** allow actions on the level of an organizer account, in particular:
+
+   * Can create events – To create a new event under this organizer account, users need to have this permission
+
+   * Can change teams and permissions – This permission is required to perform the kind of action you are doing right now.
+     Anyone with this permission can assign arbitrary other permissions to themselves, so this is the most powerful
+     permission there is to give.
+
+   * Can change organizer settings – This permission is required to perform changes to the settings of the organizer
+     account, e.g. its name or display settings.
+
+* **Event permissions** allow actions on the level of an event. You can give the team access to all events of the
+  organizer (including future ones that are not yet created) or just a selected set of events. The specific permissions to choose from are:
+
+   * Can change event settings – This permission gives access to most areas of the control panel that are not controlled
+     by one of the other event permissions, especially those that are related to setting up and configuring the event.
+
+   * Can change product settings – This permission allows to create and modify products and objects that are closely
+     related to products, such as product categories, quotas, and questions.
+
+   * Can view orders – This permission allows viewing the list of orders and allindividual order details, but not
+     changing anything about it. This also includes the various exports offered.
+
+   * Can change orders – This permission allows all actions that involve changing an order, such as changing the products
+     in an order, marking an order as paid or refunden, importing banking data, etc. This only works properly if the
+     same users also have the "Can view orders" permission.
+
+   * Can view vouchers – This permission allows viewing the list of vouchers including the voucher codes themselves and
+     their redemption status.
+
+   * Can change vouchers – This permission allows to create and modify vouchers in all their details. It only works
+     properly if the same users also have the "Can view vouchers" permission.
+
+.. thumbnail:: ../../screens/organizer/team_edit.png
+   :align: center
+   :class: screenshot
+
+.. _Get started: https://pretix.eu/about/en/setup

doc/user/payments/banktransfer.rst

@@ -3,7 +3,7 @@
 Bank transfer
 =============
 
-To accept payments with bank transfer, you only need to fill one important field in pretix' settings: In "Bank
+To accept payments with bank transfer, you only need to fill out one important field in pretix' settings: In "Bank
 account details" you should specify everything one needs to know to transfer money to you, e.g. your IBAN and BIC,
 the name of your bank and for international transfers, preferably also your address and the bank's address.
 
@@ -17,6 +17,7 @@ The easiest way to import payment data is to download a CSV file from your onlin
 export of some sort. You can go to "Import bank data" in pretix to upload a new file:
 
 .. image:: img/bank1.png
+   :class: screenshot
 
 If you upload a file for the first time, pretix will not know what information is contained in which column as every
 bank builds completely different CSV files. Therefore, pretix will ask you for that information. It will show you the

doc/user/payments/paypal.rst

@@ -8,41 +8,49 @@ PayPal account, you can create one on `paypal.com`_.
 If you look into pretix' settings, you are required to fill in two keys:
 
 .. image:: img/paypal_pretix.png
+   :class: screenshot
 
 Unfortunately, it is not straightforward how to get those keys from PayPal's website. In order to do so, you
 need to go to `developer.paypal.com`_ to link the account to your pretix event.
 Click on "Log In" in the top-right corner and log in with your PayPal account.
 
 .. image:: img/paypal2.png
+   :class: screenshot
 
 Then, click on "Dashboard" in the top-right corner.
 
 .. image:: img/paypal3.png
+   :class: screenshot
 
 In the dashboard, scroll down until you see the headline "REST API Apps". Click "Create App".
 
 .. image:: img/paypal4.png
+   :class: screenshot
 
 Enter any name for the application that helps you to identify it later. Then confirm with "Create App".
 
 .. image:: img/paypal5.png
+   :class: screenshot
 
 On the next page, before you do anything else, switch the mode on the right to "Live" to get the correct keys.
 Then, copy the "Client ID" and the "Secret" and enter them into the appropriate fields in the payment settings in
 pretix.
 
 .. image:: img/paypal6.png
+   :class: screenshot
 
 Finally, we need to create a webhook. The webhook tells PayPal to notify pretix e.g. if a payment gets cancelled so
 pretix can cancel the ticket as well. If you have multiple events connected to your PayPal account, you need multiple
 webhooks. To create one, scroll a bit down and click "Add Webhook".
 
 .. image:: img/paypal7.png
+   :class: screenshot
 
 Then, enter the webhook URL that you find on the pretix settings page. It should look similar to the one in the
 screenshot but contain your event name. Tick the box "All events" and save.
 
 .. image:: img/paypal8.png
+   :class: screenshot
 
 That's it, you are ready to go!
 

doc/user/payments/stripe.rst

@@ -9,6 +9,7 @@ Dashboard. As you can see in the following screenshot, you will be presented wit
 and one for live payments. In each set, there is a secret and a publishable keys.
 
 .. image:: img/stripe1.png
+   :class: screenshot
 
 Choose one of the two sets and copy the two keys to the appropriate fields in pretix' settings. To perform actual
 payments, you will need to use the live keys, but you can use the test keys to test the payment flow before you go live.
@@ -21,6 +22,7 @@ that you are currently on. Then, click "Add endpoint" and enter the URL that you
 configuration in pretix' settings.
 
 .. image:: img/stripe2.png
+   :class: screenshot
 
 Again, you can choose between live mode and test mode here.
 

src/make_testdata.py

@@ -47,14 +47,15 @@ question = Question.objects.create(
     event=event, question='Age',
     type=Question.TYPE_NUMBER, required=False
 )
+tr19 = event.tax_rules.create(rate=19)
 item_ticket = Item.objects.create(
     event=event, category=cat_tickets, name='Ticket',
-    default_price=23, tax_rate=19, admission=True
+    default_price=23, tax_rule=tr19, admission=True
 )
 item_ticket.questions.add(question)
 item_shirt = Item.objects.create(
     event=event, category=cat_merch, name='T-Shirt',
-    default_price=15, tax_rate=19
+    default_price=15, tax_rule=tr19
 )
 var_s = ItemVariation.objects.create(item=item_shirt, value='S')
 var_m = ItemVariation.objects.create(item=item_shirt, value='M')

src/pretix/__init__.py

@@ -1 +1 @@
-__version__ = "1.6.0"
+__version__ = "1.8.0.dev0"

src/pretix/api/serializers/event.py

@@ -1,15 +1,28 @@
+from django_countries.serializers import CountryFieldMixin
+from rest_framework.fields import Field
+
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
-from pretix.base.models import Event
+from pretix.base.models import Event, TaxRule
 from pretix.base.models.event import SubEvent
 from pretix.base.models.items import SubEventItem, SubEventItemVariation
 
 
+class MetaDataField(Field):
+
+    def to_representation(self, value):
+        return {
+            v.property.name: v.value for v in value.meta_values.all()
+        }
+
+
 class EventSerializer(I18nAwareModelSerializer):
+    meta_data = MetaDataField(source='*')
+
     class Meta:
         model = Event
         fields = ('name', 'slug', 'live', 'currency', 'date_from',
                   'date_to', 'date_admission', 'is_public', 'presale_start',
-                  'presale_end', 'location', 'has_subevents')
+                  'presale_end', 'location', 'has_subevents', 'meta_data')
 
 
 class SubEventItemSerializer(I18nAwareModelSerializer):
@@ -27,9 +40,16 @@ class SubEventItemVariationSerializer(I18nAwareModelSerializer):
 class SubEventSerializer(I18nAwareModelSerializer):
     item_price_overrides = SubEventItemSerializer(source='subeventitem_set', many=True)
     variation_price_overrides = SubEventItemVariationSerializer(source='subeventitemvariation_set', many=True)
+    meta_data = MetaDataField(source='*')
 
     class Meta:
         model = SubEvent
         fields = ('id', 'name', 'date_from', 'date_to', 'active', 'date_admission',
                   'presale_start', 'presale_end', 'location',
-                  'item_price_overrides', 'variation_price_overrides')
+                  'item_price_overrides', 'variation_price_overrides', 'meta_data')
+
+
+class TaxRuleSerializer(CountryFieldMixin, I18nAwareModelSerializer):
+    class Meta:
+        model = TaxRule
+        fields = ('id', 'name', 'rate', 'price_includes_tax', 'eu_reverse_charge', 'home_country')

src/pretix/api/serializers/item.py

@@ -1,3 +1,5 @@
+from decimal import Decimal
+
 from rest_framework import serializers
 
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
@@ -21,17 +23,26 @@ class InlineItemAddOnSerializer(serializers.ModelSerializer):
                   'position')
 
 
+class ItemTaxRateField(serializers.Field):
+    def to_representation(self, i):
+        if i.tax_rule:
+            return str(Decimal(i.tax_rule.rate))
+        else:
+            return str(Decimal('0.00'))
+
+
 class ItemSerializer(I18nAwareModelSerializer):
     addons = InlineItemAddOnSerializer(many=True)
     variations = InlineItemVariationSerializer(many=True)
+    tax_rate = ItemTaxRateField(source='*', read_only=True)
 
     class Meta:
         model = Item
         fields = ('id', 'category', 'name', 'active', 'description',
-                  'default_price', 'free_price', 'tax_rate', 'admission',
+                  'default_price', 'free_price', 'tax_rate', 'tax_rule', 'admission',
                   'position', 'picture', 'available_from', 'available_until',
                   'require_voucher', 'hide_without_voucher', 'allow_cancel',
-                  'min_per_order', 'max_per_order', 'has_variations',
+                  'min_per_order', 'max_per_order', 'checkin_attention', 'has_variations',
                   'variations', 'addons')
 
 

src/pretix/api/serializers/order.py

@@ -1,3 +1,5 @@
+from decimal import Decimal
+
 from rest_framework import serializers
 from rest_framework.reverse import reverse
 
@@ -6,6 +8,7 @@ from pretix.base.models import (
     Checkin, Invoice, InvoiceAddress, InvoiceLine, Order, OrderPosition,
     QuestionAnswer,
 )
+from pretix.base.models.orders import OrderFee
 from pretix.base.signals import register_ticket_outputs
 
 
@@ -22,7 +25,8 @@ class InvoiceAdddressSerializer(I18nAwareModelSerializer):
 
     class Meta:
         model = InvoiceAddress
-        fields = ('last_modified', 'company', 'name', 'street', 'zipcode', 'city', 'country', 'vat_id')
+        fields = ('last_modified', 'is_business', 'company', 'name', 'street', 'zipcode', 'city', 'country', 'vat_id',
+                  'vat_id_validated')
 
 
 class AnswerSerializer(I18nAwareModelSerializer):
@@ -97,25 +101,47 @@ class OrderPositionSerializer(I18nAwareModelSerializer):
         model = OrderPosition
         fields = ('id', 'order', 'positionid', 'item', 'variation', 'price', 'attendee_name', 'attendee_email',
                   'voucher', 'tax_rate', 'tax_value', 'secret', 'addon_to', 'subevent', 'checkins', 'downloads',
-                  'answers')
+                  'answers', 'tax_rule')
+
+
+class OrderFeeSerializer(I18nAwareModelSerializer):
+    class Meta:
+        model = OrderFee
+        fields = ('fee_type', 'value', 'description', 'internal_type', 'tax_rate', 'tax_value', 'tax_rule')
+
+
+class PaymentFeeLegacyField(serializers.Field):
+    def __init__(self, *args, **kwargs):
+        self.attr = kwargs.pop('attribute')
+        super().__init__(*args, **kwargs)
+
+    def to_representation(self, instance: Order):
+        return str(
+            sum([getattr(f, self.attr) for f in instance.fees.all() if f.fee_type == OrderFee.FEE_TYPE_PAYMENT],
+                Decimal('0.00'))
+        )
 
 
 class OrderSerializer(I18nAwareModelSerializer):
     invoice_address = InvoiceAdddressSerializer()
     positions = OrderPositionSerializer(many=True)
+    fees = OrderFeeSerializer(many=True)
     downloads = OrderDownloadsField(source='*')
+    payment_fee = PaymentFeeLegacyField(source='*', attribute='value')  # TODO: Remove in 1.9
+    payment_fee_tax_rate = PaymentFeeLegacyField(source='*', attribute='tax_rate')  # TODO: Remove in 1.9
+    payment_fee_tax_value = PaymentFeeLegacyField(source='*', attribute='tax_value')  # TODO: Remove in 1.9
 
     class Meta:
         model = Order
         fields = ('code', 'status', 'secret', 'email', 'locale', 'datetime', 'expires', 'payment_date',
-                  'payment_provider', 'payment_fee', 'payment_fee_tax_rate', 'payment_fee_tax_value',
-                  'total', 'comment', 'invoice_address', 'positions', 'downloads')
+                  'payment_provider', 'fees', 'total', 'comment', 'invoice_address', 'positions', 'downloads',
+                  'payment_fee', 'payment_fee_tax_rate', 'payment_fee_tax_value')
 
 
 class InlineInvoiceLineSerializer(I18nAwareModelSerializer):
     class Meta:
         model = InvoiceLine
-        fields = ('description', 'gross_value', 'tax_value', 'tax_rate')
+        fields = ('description', 'gross_value', 'tax_value', 'tax_rate', 'tax_name')
 
 
 class InvoiceSerializer(I18nAwareModelSerializer):
@@ -126,4 +152,5 @@ class InvoiceSerializer(I18nAwareModelSerializer):
     class Meta:
         model = Invoice
         fields = ('order', 'number', 'is_cancellation', 'invoice_from', 'invoice_to', 'date', 'refers', 'locale',
-                  'introductory_text', 'additional_text', 'payment_provider_text', 'footer_text', 'lines')
+                  'introductory_text', 'additional_text', 'payment_provider_text', 'footer_text', 'lines',
+                  'foreign_currency_display', 'foreign_currency_rate', 'foreign_currency_rate_date')

src/pretix/api/urls.py

@@ -22,6 +22,7 @@ event_router.register(r'vouchers', voucher.VoucherViewSet)
 event_router.register(r'orders', order.OrderViewSet)
 event_router.register(r'orderpositions', order.OrderPositionViewSet)
 event_router.register(r'invoices', order.InvoiceViewSet)
+event_router.register(r'taxrules', event.TaxRuleViewSet)
 event_router.register(r'waitinglistentries', waitinglist.WaitingListViewSet)
 
 # Force import of all plugins to give them a chance to register URLs with the router

src/pretix/api/views/event.py

@@ -1,8 +1,10 @@
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from rest_framework import filters, viewsets
 
-from pretix.api.serializers.event import EventSerializer, SubEventSerializer
-from pretix.base.models import Event, ItemCategory
+from pretix.api.serializers.event import (
+    EventSerializer, SubEventSerializer, TaxRuleSerializer,
+)
+from pretix.base.models import Event, ItemCategory, TaxRule
 from pretix.base.models.event import SubEvent
 
 
@@ -13,7 +15,7 @@ class EventViewSet(viewsets.ReadOnlyModelViewSet):
     lookup_url_kwarg = 'event'
 
     def get_queryset(self):
-        return self.request.organizer.events.all()
+        return self.request.organizer.events.prefetch_related('meta_values', 'meta_values__property')
 
 
 class SubEventFilter(FilterSet):
@@ -32,3 +34,11 @@ class SubEventViewSet(viewsets.ReadOnlyModelViewSet):
         return self.request.event.subevents.prefetch_related(
             'subeventitem_set', 'subeventitemvariation_set'
         )
+
+
+class TaxRuleViewSet(viewsets.ReadOnlyModelViewSet):
+    serializer_class = TaxRuleSerializer
+    queryset = TaxRule.objects.none()
+
+    def get_queryset(self):
+        return self.request.event.tax_rules.all()

src/pretix/api/views/item.py

@@ -1,3 +1,5 @@
+import django_filters
+from django.db.models import Q
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from rest_framework import viewsets
 from rest_framework.decorators import detail_route
@@ -12,6 +14,14 @@ from pretix.base.models import Item, ItemCategory, Question, Quota
 
 
 class ItemFilter(FilterSet):
+    tax_rate = django_filters.CharFilter(method='tax_rate_qs')
+
+    def tax_rate_qs(self, queryset, name, value):
+        if value in ("0", "None", "0.00"):
+            return queryset.filter(Q(tax_rule__isnull=True) | Q(tax_rule__rate=0))
+        else:
+            return queryset.filter(tax_rule__rate=value)
+
     class Meta:
         model = Item
         fields = ['active', 'category', 'admission', 'tax_rate', 'free_price']
@@ -26,7 +36,7 @@ class ItemViewSet(viewsets.ReadOnlyModelViewSet):
     filter_class = ItemFilter
 
     def get_queryset(self):
-        return self.request.event.items.prefetch_related('variations', 'addons').all()
+        return self.request.event.items.select_related('tax_rule').prefetch_related('variations', 'addons').all()
 
 
 class ItemCategoryFilter(FilterSet):

src/pretix/api/views/order.py

@@ -37,7 +37,8 @@ class OrderViewSet(viewsets.ReadOnlyModelViewSet):
 
     def get_queryset(self):
         return self.request.event.orders.prefetch_related(
-            'positions', 'positions__checkins', 'positions__item', 'positions__answers', 'positions__answers__options'
+            'positions', 'positions__checkins', 'positions__item', 'positions__answers', 'positions__answers__options',
+            'fees'
         ).select_related(
             'invoice_address'
         )

src/pretix/base/__init__.py

@@ -11,7 +11,7 @@ class PretixBaseConfig(AppConfig):
         from . import payment  # NOQA
         from . import exporters  # NOQA
         from . import invoice  # NOQA
-        from .services import export, mail, tickets, cart, orders, cleanup, update_check  # NOQA
+        from .services import export, mail, tickets, cart, orders, invoices, cleanup, update_check  # NOQA
 
         try:
             from .celery_app import app as celery_app  # NOQA

src/pretix/base/email.py

@@ -2,12 +2,15 @@ import logging
 from smtplib import SMTPRecipientsRefused, SMTPSenderRefused
 
 from django.core.mail.backends.smtp import EmailBackend
+from django.utils.translation import ugettext_lazy as _
+from i18nfield.forms import I18nFormField, I18nTextarea
+
+from pretix.base.validators import PlaceholderValidator
 
 logger = logging.getLogger('pretix.base.email')
 
 
 class CustomSMTPBackend(EmailBackend):
-
     def test(self, from_addr):
         try:
             self.open()
@@ -24,3 +27,72 @@ class CustomSMTPBackend(EmailBackend):
                 raise SMTPRecipientsRefused(senderrs)
         finally:
             self.close()
+
+
+class MailTemplateRenderer:
+    def __init__(self, placeholders: list):
+        self.placeholders = placeholders
+
+    def formfield(self, **kwargs):
+        defaults = {
+            'required': False,
+            'widget': I18nTextarea,
+            'validators': [],
+            'help_text': ''
+        }
+        defaults.update(kwargs)
+        if defaults['help_text']:
+            defaults['help_text'] += ' '
+        defaults['help_text'] += _('Available placeholders: {list}').format(
+            list=', '.join(['{' + v + '}' for v in self.placeholders])
+        )
+        defaults['validators'].append(PlaceholderValidator(['{' + v + '}' for v in self.placeholders]))
+        return I18nFormField(**defaults)
+
+    def preview(self, text, **kwargs):
+        return text.format(**kwargs)
+
+    def render(self, text, values):
+        set_placeholders = set(values.keys())
+        expected_palceholders = set(self.placeholders)
+        if set_placeholders != expected_palceholders:
+            raise ValueError('Invalid placeholder set. Unknown placeholders: {}. Missing placeholders: {}'.format(
+                set_placeholders - expected_palceholders, expected_palceholders - set_placeholders
+            ))
+
+        return text.format_map(values)
+
+
+mail_text_order_placed = MailTemplateRenderer(
+    ['event', 'total', 'currency', 'date', 'payment_info', 'url', 'invoice_name', 'invoice_company']
+)
+mail_text_order_paid = MailTemplateRenderer(
+    ['event', 'url', 'invoice_name', 'invoice_company', 'payment_info']
+)
+mail_text_order_free = MailTemplateRenderer(
+    ['event', 'url', 'invoice_name', 'invoice_company']
+)
+mail_text_order_changed = MailTemplateRenderer(
+    ['event', 'url', 'invoice_name', 'invoice_company']
+)
+mail_text_resend_link = MailTemplateRenderer(
+    ['event', 'url', 'invoice_name', 'invoice_company']
+)
+mail_text_resend_all_links = MailTemplateRenderer(
+    ['event', 'orders']
+)
+mail_text_order_expire_warning = MailTemplateRenderer(
+    ['event', 'url', 'expire_date', 'invoice_name', 'invoice_company']
+)
+mail_text_waiting_list = MailTemplateRenderer(
+    ['event', 'url', 'product', 'hours', 'code']
+)
+mail_text_order_canceled = MailTemplateRenderer(
+    ['event', 'url', 'code']
+)
+mail_text_order_custom_mail = MailTemplateRenderer(
+    ['expire_date', 'event', 'code', 'date', 'url', 'invoice_name', 'invoice_company']
+)
+mail_text_download_reminder = MailTemplateRenderer(
+    ['event', 'url']
+)

src/pretix/base/exporters/answers.py

@@ -41,7 +41,7 @@ class AnswerFilesExporter(BaseExporter):
             with ZipFile(os.path.join(d, 'tmp.zip'), 'w') as zipf:
                 for i in qs:
                     if i.file:
-                        i.file.open('r')
+                        i.file.open('rb')
                         fname = '{}-{}-{}-q{}-{}'.format(
                             self.event.slug.upper(),
                             i.orderposition.order.code,

src/pretix/base/exporters/json.py

@@ -1,4 +1,5 @@
 import json
+from decimal import Decimal
 
 from django.core.serializers.json import DjangoJSONEncoder
 from django.dispatch import receiver
@@ -32,7 +33,8 @@ class JSONExporter(BaseExporter):
                         'name': str(item.name),
                         'category': item.category_id,
                         'price': item.default_price,
-                        'tax_rate': item.tax_rate,
+                        'tax_rate': item.tax_rule.rate if item.tax_rule else Decimal('0.00'),
+                        'tax_name': str(item.tax_rule.name) if item.tax_rule else None,
                         'admission': item.admission,
                         'active': item.active,
                         'variations': [
@@ -44,7 +46,7 @@ class JSONExporter(BaseExporter):
                                 'name': str(variation)
                             } for variation in item.variations.all()
                         ]
-                    } for item in self.event.items.all().prefetch_related('variations')
+                    } for item in self.event.items.select_related('tax_rule').prefetch_related('variations')
                 ],
                 'questions': [
                     {
@@ -59,7 +61,13 @@ class JSONExporter(BaseExporter):
                         'status': order.status,
                         'user': order.email,
                         'datetime': order.datetime,
-                        'payment_fee': order.payment_fee,
+                        'fees': [
+                            {
+                                'type': fee.fee_type,
+                                'description': fee.description,
+                                'value': fee.value,
+                            } for fee in order.fees.all()
+                        ],
                         'total': order.total,
                         'positions': [
                             {
@@ -80,7 +88,7 @@ class JSONExporter(BaseExporter):
                             } for position in order.positions.all()
                         ]
                     } for order in
-                    self.event.orders.all().prefetch_related('positions', 'positions__answers')
+                    self.event.orders.all().prefetch_related('positions', 'positions__answers', 'fees')
                 ],
                 'quotas': [
                     {

src/pretix/base/exporters/orderlist.py

@@ -1,9 +1,9 @@
-import csv
 import io
 from collections import OrderedDict
 from decimal import Decimal
 
 import pytz
+from defusedcsv import csv
 from django import forms
 from django.db.models import Sum
 from django.dispatch import receiver
@@ -11,6 +11,7 @@ from django.utils.formats import localize
 from django.utils.translation import ugettext as _, ugettext_lazy
 
 from pretix.base.models import InvoiceAddress, Order, OrderPosition
+from pretix.base.models.orders import OrderFee
 
 from ..exporter import BaseExporter
 from ..signals import register_data_exporters
@@ -35,7 +36,10 @@ class OrderListExporter(BaseExporter):
 
     def _get_all_tax_rates(self, qs):
         tax_rates = set(
-            qs.exclude(payment_fee=0).values_list('payment_fee_tax_rate', flat=True).distinct().order_by()
+            a for a
+            in OrderFee.objects.filter(
+                order__event=self.event
+            ).values_list('tax_rate', flat=True).distinct().order_by()
         )
         tax_rates |= set(
             a for a
@@ -59,7 +63,7 @@ class OrderListExporter(BaseExporter):
         headers = [
             _('Order code'), _('Order total'), _('Status'), _('Email'), _('Order date'),
             _('Company'), _('Name'), _('Address'), _('ZIP code'), _('City'), _('Country'), _('VAT ID'),
-            _('Payment date'), _('Payment type'), _('Payment method fee'),
+            _('Payment date'), _('Payment type'), _('Fees'),
         ]
 
         for tr in tax_rates:
@@ -78,6 +82,16 @@ class OrderListExporter(BaseExporter):
             for k, v in self.event.get_payment_providers().items()
         }
 
+        full_fee_sum_cache = {
+            o['order__id']: o['grosssum'] for o in
+            OrderFee.objects.values('tax_rate', 'order__id').order_by().annotate(grosssum=Sum('value'))
+        }
+        fee_sum_cache = {
+            (o['order__id'], o['tax_rate']): o for o in
+            OrderFee.objects.values('tax_rate', 'order__id').order_by().annotate(
+                taxsum=Sum('tax_value'), grosssum=Sum('value')
+            )
+        }
         sum_cache = {
             (o['order__id'], o['tax_rate']): o for o in
             OrderPosition.objects.values('tax_rate', 'order__id').order_by().annotate(
@@ -109,19 +123,18 @@ class OrderListExporter(BaseExporter):
             row += [
                 order.payment_date.astimezone(tz).strftime('%Y-%m-%d') if order.payment_date else '',
                 provider_names.get(order.payment_provider, order.payment_provider),
-                localize(order.payment_fee)
+                localize(full_fee_sum_cache.get(order.id) or Decimal('0.00'))
             ]
 
             for tr in tax_rates:
                 taxrate_values = sum_cache.get((order.id, tr), {'grosssum': Decimal('0.00'), 'taxsum': Decimal('0.00')})
-                if tr == order.payment_fee_tax_rate and order.payment_fee_tax_value:
-                    taxrate_values['grosssum'] += order.payment_fee
-                    taxrate_values['taxsum'] += order.payment_fee_tax_value
+                fee_taxrate_values = fee_sum_cache.get((order.id, tr), {'grosssum': Decimal('0.00'), 'taxsum': Decimal('0.00')})
 
                 row += [
-                    localize(taxrate_values['grosssum']),
-                    localize(taxrate_values['grosssum'] - taxrate_values['taxsum']),
-                    localize(taxrate_values['taxsum']),
+                    localize(taxrate_values['grosssum'] + fee_taxrate_values['grosssum']),
+                    localize(taxrate_values['grosssum'] - taxrate_values['taxsum']
+                             + fee_taxrate_values['grosssum'] - fee_taxrate_values['taxsum']),
+                    localize(taxrate_values['taxsum'] + fee_taxrate_values['taxsum']),
                 ]
 
             row.append(', '.join([i.number for i in order.invoices.all()]))

src/pretix/base/forms/__init__.py

@@ -9,8 +9,6 @@ from hierarkey.forms import HierarkeyForm
 from pretix.base.models import Event
 from pretix.base.reldate import RelativeDateField, RelativeDateTimeField
 
-from .validators import PlaceholderValidator  # NOQA
-
 logger = logging.getLogger('pretix.plugins.ticketoutputpdf')
 
 

src/pretix/base/forms/auth.py

@@ -1,4 +1,5 @@
 from django import forms
+from django.conf import settings
 from django.contrib.auth import authenticate
 from django.contrib.auth.password_validation import (
     password_validators_help_texts, validate_password,
@@ -15,6 +16,7 @@ class LoginForm(forms.Form):
     """
     email = forms.EmailField(label=_("E-mail"), max_length=254)
     password = forms.CharField(label=_("Password"), widget=forms.PasswordInput)
+    keep_logged_in = forms.BooleanField(label=_("Keep me logged in"), required=False)
 
     error_messages = {
         'invalid_login': _("Please enter a correct email address and password."),
@@ -29,6 +31,8 @@ class LoginForm(forms.Form):
         self.request = request
         self.user_cache = None
         super().__init__(*args, **kwargs)
+        if not settings.PRETIX_LONG_SESSIONS:
+            del self.fields['keep_logged_in']
 
     def clean(self):
         email = self.cleaned_data.get('email')
@@ -90,6 +94,12 @@ class RegistrationForm(forms.Form):
         }),
         required=True
     )
+    keep_logged_in = forms.BooleanField(label=_("Keep me logged in"), required=False)
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if not settings.PRETIX_LONG_SESSIONS:
+            del self.fields['keep_logged_in']
 
     def clean(self):
         password1 = self.cleaned_data.get('password', '')

src/pretix/base/forms/validators.py

@@ -1,38 +0,0 @@
-import re
-
-from django.core.exceptions import ValidationError
-from django.core.validators import BaseValidator
-from django.utils.translation import ugettext_lazy as _
-from i18nfield.strings import LazyI18nString
-
-
-class PlaceholderValidator(BaseValidator):
-    """
-    Takes list of allowed placeholders,
-    validates form field by checking for placeholders,
-    which are not presented in taken list.
-    """
-
-    def __init__(self, limit_value):
-        super().__init__(limit_value)
-        self.limit_value = limit_value
-
-    def __call__(self, value):
-        if isinstance(value, LazyI18nString):
-            for l, v in value.data.items():
-                self.__call__(v)
-            return
-
-        data_placeholders = list(re.findall(r'({[\w\s]*})', value, re.X))
-        invalid_placeholders = []
-        for placeholder in data_placeholders:
-            if placeholder not in self.limit_value:
-                invalid_placeholders.append(placeholder)
-        if invalid_placeholders:
-            raise ValidationError(
-                _('Invalid placeholder(s): %(value)s'),
-                code='invalid',
-                params={'value': ", ".join(invalid_placeholders,)})
-
-    def clean(self, x):
-        return x

src/pretix/base/invoice.py

@@ -3,11 +3,13 @@ from decimal import Decimal
 from io import BytesIO
 from typing import Tuple
 
+import vat_moss.exchange_rates
 from django.contrib.staticfiles import finders
 from django.dispatch import receiver
 from django.utils.formats import date_format, localize
 from django.utils.translation import pgettext
 from reportlab.lib import pagesizes
+from reportlab.lib.enums import TA_LEFT
 from reportlab.lib.styles import ParagraphStyle, StyleSheet1
 from reportlab.lib.units import mm
 from reportlab.lib.utils import ImageReader
@@ -15,10 +17,11 @@ from reportlab.pdfbase import pdfmetrics
 from reportlab.pdfbase.ttfonts import TTFont
 from reportlab.pdfgen.canvas import Canvas
 from reportlab.platypus import (
-    BaseDocTemplate, Frame, NextPageTemplate, PageTemplate, Paragraph, Spacer,
-    Table, TableStyle,
+    BaseDocTemplate, Frame, KeepTogether, NextPageTemplate, PageTemplate,
+    Paragraph, Spacer, Table, TableStyle,
 )
 
+from pretix.base.decimal import round_decimal
 from pretix.base.models import Event, Invoice
 from pretix.base.signals import register_invoice_renderers
 
@@ -86,6 +89,8 @@ class BaseReportlabInvoiceRenderer(BaseInvoiceRenderer):
         stylesheet = StyleSheet1()
         stylesheet.add(ParagraphStyle(name='Normal', fontName='OpenSans', fontSize=10, leading=12))
         stylesheet.add(ParagraphStyle(name='Heading1', fontName='OpenSansBd', fontSize=15, leading=15 * 1.2))
+        stylesheet.add(ParagraphStyle(name='FineprintHeading', fontName='OpenSansBd', fontSize=8, leading=12))
+        stylesheet.add(ParagraphStyle(name='Fineprint', fontName='OpenSans', fontSize=8, leading=10))
         return stylesheet
 
     def _register_fonts(self):
@@ -355,12 +360,13 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
                 localize(line.net_value) + " " + self.invoice.event.currency,
                 localize(line.gross_value) + " " + self.invoice.event.currency,
             ))
-            taxvalue_map[line.tax_rate] += line.tax_value
-            grossvalue_map[line.tax_rate] += line.gross_value
+            taxvalue_map[line.tax_rate, line.tax_name] += line.tax_value
+            grossvalue_map[line.tax_rate, line.tax_name] += line.gross_value
             total += line.gross_value
 
-        tdata.append(
-            [pgettext('invoice', 'Invoice total'), '', '', localize(total) + " " + self.invoice.event.currency])
+        tdata.append([
+            pgettext('invoice', 'Invoice total'), '', '', localize(total) + " " + self.invoice.event.currency
+        ])
         colwidths = [a * doc.width for a in (.55, .15, .15, .15)]
         table = Table(tdata, colWidths=colwidths, repeatRows=1)
         table.setStyle(TableStyle(tstyledata))
@@ -376,33 +382,94 @@ class ClassicInvoiceRenderer(BaseReportlabInvoiceRenderer):
             story.append(Spacer(1, 15 * mm))
 
         tstyledata = [
-            ('SPAN', (1, 0), (-1, 0)),
-            ('ALIGN', (2, 1), (-1, -1), 'RIGHT'),
+            ('ALIGN', (1, 0), (-1, -1), 'RIGHT'),
             ('LEFTPADDING', (0, 0), (0, -1), 0),
             ('RIGHTPADDING', (-1, 0), (-1, -1), 0),
             ('FONTSIZE', (0, 0), (-1, -1), 8),
+            ('FONTNAME', (0, 0), (-1, -1), 'OpenSans'),
         ]
-        tdata = [('', pgettext('invoice', 'Included taxes'), '', '', ''),
-                 ('', pgettext('invoice', 'Tax rate'),
-                  pgettext('invoice', 'Net value'), pgettext('invoice', 'Gross value'), pgettext('invoice', 'Tax'))]
+        thead = [
+            pgettext('invoice', 'Tax rate'),
+            pgettext('invoice', 'Net value'),
+            pgettext('invoice', 'Gross value'),
+            pgettext('invoice', 'Tax'),
+            ''
+        ]
+        tdata = [thead]
 
-        for rate, gross in grossvalue_map.items():
+        for idx, gross in grossvalue_map.items():
+            rate, name = idx
             if rate == 0:
                 continue
-            tax = taxvalue_map[rate]
-            tdata.append((
-                '',
-                localize(rate) + " %",
-                localize((gross - tax)) + " " + self.invoice.event.currency,
+            tax = taxvalue_map[idx]
+            tdata.append([
+                localize(rate) + " % " + name,
+                localize(gross - tax) + " " + self.invoice.event.currency,
                 localize(gross) + " " + self.invoice.event.currency,
                 localize(tax) + " " + self.invoice.event.currency,
+                ''
+            ])
+
+        def fmt(val):
+            try:
+                return vat_moss.exchange_rates.format(val, self.invoice.foreign_currency_display)
+            except ValueError:
+                return localize(val) + ' ' + self.invoice.foreign_currency_display
+
+        if len(tdata) > 1:
+            colwidths = [a * doc.width for a in (.25, .15, .15, .15, .3)]
+            table = Table(tdata, colWidths=colwidths, repeatRows=2, hAlign=TA_LEFT)
+            table.setStyle(TableStyle(tstyledata))
+            story.append(KeepTogether([
+                Paragraph(pgettext('invoice', 'Included taxes'), self.stylesheet['FineprintHeading']),
+                table
+            ]))
+
+            if self.invoice.foreign_currency_display and self.invoice.foreign_currency_rate:
+                tdata = [thead]
+
+                for idx, gross in grossvalue_map.items():
+                    rate, name = idx
+                    if rate == 0:
+                        continue
+                    tax = taxvalue_map[idx]
+                    gross = round_decimal(gross * self.invoice.foreign_currency_rate)
+                    tax = round_decimal(tax * self.invoice.foreign_currency_rate)
+                    net = gross - tax
+
+                    tdata.append([
+                        localize(rate) + " % " + name,
+                        fmt(net), fmt(gross), fmt(tax), ''
+                    ])
+
+                table = Table(tdata, colWidths=colwidths, repeatRows=2, hAlign=TA_LEFT)
+                table.setStyle(TableStyle(tstyledata))
+
+                story.append(KeepTogether([
+                    Spacer(1, height=2 * mm),
+                    Paragraph(
+                        pgettext(
+                            'invoice', 'Using the conversion rate of 1:{rate} as published by the European Central Bank on '
+                                       '{date}, this corresponds to:'
+                        ).format(rate=localize(self.invoice.foreign_currency_rate),
+                                 date=date_format(self.invoice.foreign_currency_rate_date, "SHORT_DATE_FORMAT")),
+                        self.stylesheet['Fineprint']
+                    ),
+                    Spacer(1, height=3 * mm),
+                    table
+                ]))
+        elif self.invoice.foreign_currency_display and self.invoice.foreign_currency_rate:
+            story.append(Spacer(1, 5 * mm))
+            story.append(Paragraph(
+                pgettext(
+                    'invoice', 'Using the conversion rate of 1:{rate} as published by the European Central Bank on '
+                               '{date}, the invoice total corresponds to {total}.'
+                ).format(rate=localize(self.invoice.foreign_currency_rate),
+                         date=date_format(self.invoice.foreign_currency_rate_date, "SHORT_DATE_FORMAT"),
+                         total=fmt(total)),
+                self.stylesheet['Fineprint']
             ))
 
-        if len(tdata) > 2:
-            colwidths = [a * doc.width for a in (.45, .10, .15, .15, .15)]
-            table = Table(tdata, colWidths=colwidths, repeatRows=2)
-            table.setStyle(TableStyle(tstyledata))
-            story.append(table)
         return story
 
 

src/pretix/base/middleware.py

@@ -7,6 +7,7 @@ from django.core.urlresolvers import get_script_prefix
 from django.http import HttpRequest, HttpResponse
 from django.utils import timezone, translation
 from django.utils.cache import patch_vary_headers
+from django.utils.crypto import get_random_string
 from django.utils.deprecation import MiddlewareMixin
 from django.utils.translation import LANGUAGE_SESSION_KEY
 from django.utils.translation.trans_real import (
@@ -165,6 +166,9 @@ class SecurityMiddleware(MiddlewareMixin):
         '/api/v1/docs/',
     )
 
+    def process_request(self, request):
+        request.csp_nonce = get_random_string(length=32)
+
     def process_response(self, request, resp):
         if settings.DEBUG and resp.status_code >= 400:
             # Don't use CSP on debug error page as it breaks of Django's fancy error
@@ -179,20 +183,25 @@ class SecurityMiddleware(MiddlewareMixin):
             # frame-src is deprecated but kept for compatibility with CSP 1.0 browsers, e.g. Safari 9
             'frame-src': ['{static}', 'https://checkout.stripe.com', 'https://js.stripe.com'],
             'child-src': ['{static}', 'https://checkout.stripe.com', 'https://js.stripe.com'],
-            'style-src': ["{static}"],
-            'connect-src': ["{dynamic}", "https://checkout.stripe.com"],
-            'img-src': ["{static}", "data:", "https://*.stripe.com"],
+            'style-src': ["{static}", "{media}", "'nonce-{nonce}'"],
+            'connect-src': ["{dynamic}", "{media}", "https://checkout.stripe.com"],
+            'img-src': ["{static}", "{media}", "data:", "https://*.stripe.com"],
+            'font-src': ["{static}"],
             # form-action is not only used to match on form actions, but also on URLs
             # form-actions redirect to. In the context of e.g. payment providers or
             # single-sign-on this can be nearly anything so we cannot really restrict
             # this. However, we'll restrict it to HTTPS.
             'form-action': ["{dynamic}", "https:"],
+            'report-uri': ["/csp_report/"],
         }
         if 'Content-Security-Policy' in resp:
             _merge_csp(h, _parse_csp(resp['Content-Security-Policy']))
 
         staticdomain = "'self'"
         dynamicdomain = "'self'"
+        mediadomain = "'self'"
+        if settings.MEDIA_URL.startswith('http'):
+            mediadomain += " " + settings.MEDIA_URL[:settings.MEDIA_URL.find('/', 9)]
         if settings.STATIC_URL.startswith('http'):
             staticdomain += " " + settings.STATIC_URL[:settings.STATIC_URL.find('/', 9)]
         if settings.SITE_URL.startswith('http'):
@@ -211,6 +220,14 @@ class SecurityMiddleware(MiddlewareMixin):
                     domain = '%s:%d' % (domain, siteurlsplit.port)
                 dynamicdomain += " " + domain
 
-        if request.path not in self.CSP_EXEMPT:
-            resp['Content-Security-Policy'] = _render_csp(h).format(static=staticdomain, dynamic=dynamicdomain)
+        if request.path not in self.CSP_EXEMPT and not getattr(resp, '_csp_ignore', False):
+            resp['Content-Security-Policy'] = _render_csp(h).format(static=staticdomain, dynamic=dynamicdomain,
+                                                                    media=mediadomain, nonce=request.csp_nonce)
+            for k, v in h.items():
+                h[k] = ' '.join(v).format(static=staticdomain, dynamic=dynamicdomain, media=mediadomain,
+                                          nonce=request.csp_nonce).split(' ')
+            resp['Content-Security-Policy'] = _render_csp(h)
+        elif 'Content-Security-Policy' in resp:
+            del resp['Content-Security-Policy']
+
         return resp

src/pretix/base/migrations/0071_auto_20170729_1616.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.3 on 2017-07-29 16:16
+from __future__ import unicode_literals
+
+import i18nfield.fields
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0070_auto_20170719_0910'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='question',
+            name='help_text',
+            field=i18nfield.fields.I18nTextField(blank=True, help_text='If the question needs to be explained or clarified, do it here!', null=True, verbose_name='Help text'),
+        ),
+        migrations.AlterField(
+            model_name='invoiceaddress',
+            name='vat_id',
+            field=models.CharField(blank=True, help_text='Only for business customers within the EU.', max_length=255, verbose_name='VAT ID'),
+        ),
+    ]

src/pretix/base/migrations/0072_order_download_reminder_sent.py

@@ -0,0 +1,20 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.4 on 2017-08-04 13:42
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0071_auto_20170729_1616'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='order',
+            name='download_reminder_sent',
+            field=models.BooleanField(default=False),
+        ),
+    ]

src/pretix/base/migrations/0073_auto_20170716_1333.py

@@ -0,0 +1,181 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.2 on 2017-07-16 13:33
+from __future__ import unicode_literals
+
+import django.db.models.deletion
+import django_countries.fields
+import i18nfield.fields
+from django.core.cache import cache
+from django.db import migrations, models
+from i18nfield.strings import LazyI18nString
+
+
+def tax_rate_converter(app, schema_editor):
+    EventSettingsStore = app.get_model('pretixbase', 'Event_SettingsStore')
+    Item = app.get_model('pretixbase', 'Item')
+    TaxRule = app.get_model('pretixbase', 'TaxRule')
+    Order = app.get_model('pretixbase', 'Order')
+    OrderPosition = app.get_model('pretixbase', 'OrderPosition')
+    InvoiceLine = app.get_model('pretixbase', 'InvoiceLine')
+    n = LazyI18nString({
+        'en': 'VAT',
+        'de': 'MwSt.',
+        'de-informal': 'MwSt.'
+    })
+
+    for i in Item.objects.select_related('event').exclude(tax_rate=0):
+        try:
+            i.tax_rule = i.event.tax_rules.get(rate=i.tax_rate)
+        except TaxRule.DoesNotExist:
+            tr = i.event.tax_rules.create(rate=i.tax_rate, name=n)
+            i.tax_rule = tr
+        i.save()
+
+    for o in Order.objects.select_related('event').exclude(payment_fee_tax_rate=0):
+        try:
+            o.payment_fee_tax_rule = o.event.tax_rules.get(rate=o.payment_fee_tax_rate)
+        except TaxRule.DoesNotExist:
+            tr = o.event.tax_rules.create(rate=o.payment_fee_tax_rate, name=n)
+            o.tax_rule = tr
+        o.save()
+
+    for op in OrderPosition.objects.select_related('order', 'order__event').exclude(tax_rate=0):
+        try:
+            op.tax_rule = op.order.event.tax_rules.get(rate=op.tax_rate)
+        except TaxRule.DoesNotExist:
+            tr = op.order.event.tax_rules.create(rate=op.tax_rate, name=n)
+            op.tax_rule = tr
+        op.save()
+
+    for il in InvoiceLine.objects.select_related('invoice', 'invoice__event').exclude(tax_rate=0):
+        try:
+            il.tax_name = il.invoice.event.tax_rules.get(rate=op.tax_rate).name
+        except TaxRule.DoesNotExist:
+            tr = il.invoice.event.tax_rules.create(rate=op.tax_rate, name=n)
+            il.tax_name = tr.name
+        il.save()
+
+    for setting in EventSettingsStore.objects.filter(key='tax_rate_default'):
+        try:
+            tr = setting.object.tax_rules.get(rate=setting.value)
+        except TaxRule.DoesNotExist:
+            tr = setting.object.tax_rules.create(rate=setting.value, name=n)
+        setting.value = tr.pk
+        setting.save()
+        cache.delete('hierarkey_{}_{}'.format('event', setting.object.pk))
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('pretixbase', '0072_order_download_reminder_sent'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='TaxRule',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', i18nfield.fields.I18nCharField(help_text='Should be short, e.g. "VAT"', max_length=190,
+                                                        verbose_name='Name')),
+                ('rate', models.DecimalField(decimal_places=2, max_digits=10, verbose_name='Tax rate')),
+                ('price_includes_tax', models.BooleanField(default=True,
+                                                           verbose_name='The configured product prices includes the '
+                                                                        'tax amount')),
+                ('eu_reverse_charge',
+                 models.BooleanField(default=False, help_text='Not recommended. Most events will NOT be '
+                                                              'qualified for reverse charge since the place of '
+                                                              'taxation is the location of the event. This option '
+                                                              'only enables reverse charge for business customers who '
+                                                              'entered a valid EU VAT ID. Only enable this option '
+                                                              'after consulting a tax counsel. No warranty given for '
+                                                              'correct tax calculation.',
+                                     verbose_name='Use EU reverse charge taxation')),
+                ('home_country', models.CharField(blank=True,
+                                                  choices=[('AT', 'Austria'), ('BE', 'Belgium'), ('BG', 'Bulgaria'),
+                                                           ('HR', 'Croatia'), ('CY', 'Cyprus'),
+                                                           ('CZ', 'Czech Republic'), ('DK', 'Denmark'),
+                                                           ('EE', 'Estonia'), ('FI', 'Finland'), ('FR', 'France'),
+                                                           ('DE', 'Germany'), ('GR', 'Greece'), ('HU', 'Hungary'),
+                                                           ('IE', 'Ireland'), ('IT', 'Italy'), ('LV', 'Latvia'),
+                                                           ('LT', 'Lithuania'), ('LU', 'Luxembourg'), ('MT', 'Malta'),
+                                                           ('NL', 'Netherlands'), ('PL', 'Poland'), ('PT', 'Portugal'),
+                                                           ('RO', 'Romania'), ('SK', 'Slovakia'), ('SI', 'Slovenia'),
+                                                           ('ES', 'Spain'), ('SE', 'Sweden'), ('UJ', 'United Kingdom')],
+                                                  help_text='Your country. Only relevant for EU reverse charge.',
+                                                  max_length=2, verbose_name='Merchant country')),
+                ('event', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='tax_rules',
+                                            to='pretixbase.Event')),
+            ],
+        ),
+        migrations.AddField(
+            model_name='item',
+            name='tax_rule',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT,
+                                    to='pretixbase.TaxRule', verbose_name='Sales tax'),
+        ),
+        migrations.AddField(
+            model_name='order',
+            name='payment_fee_tax_rule',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT,
+                                    to='pretixbase.TaxRule'),
+        ),
+        migrations.AddField(
+            model_name='orderposition',
+            name='tax_rule',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT,
+                                    to='pretixbase.TaxRule'),
+        ),
+        migrations.RunPython(
+            tax_rate_converter, migrations.RunPython.noop
+        ),
+        migrations.RemoveField(
+            model_name='item',
+            name='tax_rate',
+        ),
+        migrations.AddField(
+            model_name='invoiceaddress',
+            name='vat_id_validated',
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AlterField(
+            model_name='invoiceaddress',
+            name='vat_id',
+            field=models.CharField(blank=True, help_text='Only for business customers within the EU.', max_length=255, verbose_name='VAT ID'),
+        ),
+        migrations.AlterField(
+            model_name='taxrule',
+            name='home_country',
+            field=django_countries.fields.CountryField(blank=True, help_text='Your country of residence. This is the country the EU reverse charge rule will not apply in, if configured above.', max_length=2, verbose_name='Merchant country'),
+        ),
+        migrations.AddField(
+            model_name='cartposition',
+            name='includes_tax',
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name='invoiceline',
+            name='tax_name',
+            field=models.CharField(default='', max_length=190),
+            preserve_default=False,
+        ),
+        migrations.AlterField(
+            model_name='taxrule',
+            name='eu_reverse_charge',
+            field=models.BooleanField(default=False, help_text='Not recommended. Most events will NOT be qualified for reverse charge since the place of taxation is the location of the event. This option disables charging VAT for all customers outside the EU and for business customers in different EU countries that do not customers who entered a valid EU VAT ID. Only enable this option after consulting a tax counsel. No warranty given for correct tax calculation. USE AT YOUR OWN RISK.', verbose_name='Use EU reverse charge taxation rules'),
+        ),
+        migrations.AddField(
+            model_name='invoice',
+            name='foreign_currency_display',
+            field=models.CharField(blank=True, max_length=50, null=True),
+        ),
+        migrations.AddField(
+            model_name='invoice',
+            name='foreign_currency_rate',
+            field=models.DecimalField(blank=True, decimal_places=4, max_digits=10, null=True),
+        ),
+        migrations.AddField(
+            model_name='invoice',
+            name='foreign_currency_rate_date',
+            field=models.DateField(blank=True, null=True),
+        ),
+    ]

src/pretix/base/migrations/0075_auto_20170828_0901.py

@@ -0,0 +1,60 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.4 on 2017-08-28 09:01
+from __future__ import unicode_literals
+
+import django.core.validators
+import django.db.models.deletion
+from django.db import migrations, models
+
+import pretix.base.models.base
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0074_auto_20170825_1258'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='EventMetaProperty',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(db_index=True, help_text='Can not contain spaces or special characters execpt underscores', max_length=50, validators=[django.core.validators.RegexValidator(message='The property name may only contain letters, numbers and underscores.', regex='^[a-zA-Z0-9_]+$')], verbose_name='Name')),
+                ('default', models.TextField()),
+                ('organizer', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='meta_properties', to='pretixbase.Organizer')),
+            ],
+            options={
+                'abstract': False,
+            },
+            bases=(models.Model, pretix.base.models.base.LoggingMixin),
+        ),
+        migrations.CreateModel(
+            name='EventMetaValue',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('value', models.TextField()),
+                ('event', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='meta_values', to='pretixbase.Event')),
+                ('property', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='event_values', to='pretixbase.EventMetaProperty')),
+            ],
+            bases=(models.Model, pretix.base.models.base.LoggingMixin),
+        ),
+        migrations.CreateModel(
+            name='SubEventMetaValue',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('value', models.TextField()),
+                ('property', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='subevent_values', to='pretixbase.EventMetaProperty')),
+                ('subevent', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='meta_values', to='pretixbase.SubEvent')),
+            ],
+            bases=(models.Model, pretix.base.models.base.LoggingMixin),
+        ),
+        migrations.AlterUniqueTogether(
+            name='subeventmetavalue',
+            unique_together=set([('subevent', 'property')]),
+        ),
+        migrations.AlterUniqueTogether(
+            name='eventmetavalue',
+            unique_together=set([('event', 'property')]),
+        ),
+    ]

src/pretix/base/migrations/0076_orderfee.py

@@ -0,0 +1,72 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.4 on 2017-08-28 14:35
+from __future__ import unicode_literals
+
+from decimal import Decimal
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+def fee_converter(app, schema_editor):
+    OrderFee = app.get_model('pretixbase', 'OrderFee')
+    Order = app.get_model('pretixbase', 'Order')
+
+    of = []
+    for o in Order.objects.exclude(payment_fee=Decimal('0.00')).iterator():
+        of.append(OrderFee(
+            order=o,
+            value=o.payment_fee,
+            fee_type='payment',
+            tax_rate=o.payment_fee_tax_rate,
+            tax_rule=o.payment_fee_tax_rule,
+            tax_value=o.payment_fee_tax_value,
+            internal_type=o.payment_provider
+        ))
+        if len(of) > 900:
+            OrderFee.objects.bulk_create(of)
+            of = []
+    OrderFee.objects.bulk_create(of)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0075_auto_20170828_0901'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='OrderFee',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('value', models.DecimalField(decimal_places=2, max_digits=10, verbose_name='Value')),
+                ('description', models.CharField(blank=True, max_length=190)),
+                ('internal_type', models.CharField(blank=True, max_length=255)),
+                ('fee_type', models.CharField(choices=[('payment', 'Payment method fee'), ('shipping', 'Shipping fee')], max_length=100)),
+                ('tax_rate', models.DecimalField(decimal_places=2, max_digits=7, verbose_name='Tax rate')),
+                ('tax_value', models.DecimalField(decimal_places=2, max_digits=10, verbose_name='Tax value')),
+                ('order', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='fees', to='pretixbase.Order', verbose_name='Order')),
+                ('tax_rule', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, to='pretixbase.TaxRule')),
+            ],
+        ),
+        migrations.RunPython(
+            fee_converter, migrations.RunPython.noop
+        ),
+        migrations.RemoveField(
+            model_name='order',
+            name='payment_fee',
+        ),
+        migrations.RemoveField(
+            model_name='order',
+            name='payment_fee_tax_rate',
+        ),
+        migrations.RemoveField(
+            model_name='order',
+            name='payment_fee_tax_rule',
+        ),
+        migrations.RemoveField(
+            model_name='order',
+            name='payment_fee_tax_value',
+        ),
+    ]

src/pretix/base/migrations/0077_auto_20170829_1126.py

@@ -0,0 +1,41 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.4 on 2017-08-29 11:26
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+def assign_positions(app, schema_editor):
+    Invoice = app.get_model('pretixbase', 'Invoice')
+
+    for i in Invoice.objects.iterator():
+        for j, l in enumerate(i.lines.all()):
+            l.position = j
+            l.save()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0076_orderfee'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='invoiceline',
+            name='position',
+            field=models.PositiveIntegerField(default=0),
+        ),
+        migrations.AlterField(
+            model_name='orderfee',
+            name='fee_type',
+            field=models.CharField(choices=[('payment', 'Payment fee'), ('shipping', 'Shipping fee'), ('other', 'Other fees')], max_length=100),
+        ),
+        migrations.RunPython(
+            assign_positions, migrations.RunPython.noop
+        ),
+        migrations.AlterModelOptions(
+            name='invoiceline',
+            options={'ordering': ('position', 'pk')},
+        ),
+    ]

src/pretix/base/models/__init__.py

@@ -19,5 +19,6 @@ from .orders import (
     generate_secret,
 )
 from .organizer import Organizer, Organizer_SettingsStore, Team, TeamInvite
+from .tax import TaxRule
 from .vouchers import Voucher
 from .waitinglist import WaitingListEntry

src/pretix/base/models/event.py

@@ -189,7 +189,7 @@ class Event(EventMixin, LoggedModel):
     )
     live = models.BooleanField(default=False, verbose_name=_("Shop is live"))
     currency = models.CharField(max_length=10,
-                                verbose_name=_("Default currency"),
+                                verbose_name=_("Event currency"),
                                 choices=CURRENCY_CHOICES,
                                 default=settings.DEFAULT_CURRENCY)
     date_from = models.DateTimeField(verbose_name=_("Event start time"))
@@ -304,6 +304,13 @@ class Event(EventMixin, LoggedModel):
         self.is_public = other.is_public
         self.save()
 
+        tax_map = {}
+        for t in other.tax_rules.all():
+            tax_map[t.pk] = t
+            t.pk = None
+            t.event = self
+            t.save()
+
         category_map = {}
         for c in ItemCategory.objects.filter(event=other):
             category_map[c.pk] = c
@@ -322,6 +329,8 @@ class Event(EventMixin, LoggedModel):
                 i.picture.save(i.picture.name, i.picture)
             if i.category_id:
                 i.category = category_map[i.category_id]
+            if i.tax_rule_id:
+                i.tax_rule = tax_map[i.tax_rule_id]
             i.save()
             for v in vars:
                 variation_map[v.pk] = v
@@ -371,7 +380,18 @@ class Event(EventMixin, LoggedModel):
                 )
                 newname = default_storage.save(fname, fi)
                 s.value = 'file://' + newname
-            s.save()
+                s.save()
+            elif s.key == 'tax_rate_default':
+                try:
+                    if int(s.value) in tax_map:
+                        s.value = tax_map.get(int(s.value)).pk
+                        s.save()
+                    else:
+                        s.delete()
+                except ValueError:
+                    s.delete()
+            else:
+                s.save()
 
         event_copy_data.send(sender=self, other=other)
 
@@ -432,6 +452,12 @@ class Event(EventMixin, LoggedModel):
             )
         ).order_by('date_from', 'name')
 
+    @property
+    def meta_data(self):
+        data = {p.name: p.default for p in self.organizer.meta_properties.all()}
+        data.update({v.property.name: v.value for v in self.meta_values.select_related('property').all()})
+        return data
+
 
 class SubEvent(EventMixin, LoggedModel):
     """
@@ -521,6 +547,12 @@ class SubEvent(EventMixin, LoggedModel):
             for si in SubEventItemVariation.objects.filter(subevent=self, price__isnull=False)
         }
 
+    @property
+    def meta_data(self):
+        data = self.event.meta_data
+        data.update({v.property.name: v.value for v in self.meta_values.select_related('property').all()})
+        return data
+
 
 def generate_invite_token():
     return get_random_string(length=32, allowed_chars=string.ascii_lowercase + string.digits)
@@ -569,3 +601,74 @@ class RequiredAction(models.Model):
             if response:
                 return response
         return self.action_type
+
+
+class EventMetaProperty(LoggedModel):
+    """
+    An organizer account can have EventMetaProperty objects attached to define meta information fields
+    for its events. This information can be re-used for example in ticket layouts.
+
+    :param organizer: The organizer this property is defined for.
+    :type organizer: Organizer
+    :param name: Name
+    :type name: Name of the property, used in various places
+    :param default: Default value
+    :type default: str
+    """
+    organizer = models.ForeignKey(Organizer, related_name="meta_properties", on_delete=models.CASCADE)
+    name = models.CharField(
+        max_length=50, db_index=True,
+        help_text=_(
+            "Can not contain spaces or special characters execpt underscores"
+        ),
+        validators=[
+            RegexValidator(
+                regex="^[a-zA-Z0-9_]+$",
+                message=_("The property name may only contain letters, numbers and underscores."),
+            ),
+        ],
+        verbose_name=_("Name"),
+    )
+    default = models.TextField(blank=True)
+
+
+class EventMetaValue(LoggedModel):
+    """
+    A meta-data value assigned to an event.
+
+    :param event: The event this metadata is valid for
+    :type event: Event
+    :param property: The property this value belongs to
+    :type property: EventMetaProperty
+    :param value: The actual value
+    :type value: str
+    """
+    event = models.ForeignKey('Event', on_delete=models.CASCADE,
+                              related_name='meta_values')
+    property = models.ForeignKey('EventMetaProperty', on_delete=models.CASCADE,
+                                 related_name='event_values')
+    value = models.TextField()
+
+    class Meta:
+        unique_together = ('event', 'property')
+
+
+class SubEventMetaValue(LoggedModel):
+    """
+    A meta-data value assigned to a sub-event.
+
+    :param event: The event this metadata is valid for
+    :type event: Event
+    :param property: The property this value belongs to
+    :type property: EventMetaProperty
+    :param value: The actual value
+    :type value: str
+    """
+    subevent = models.ForeignKey('SubEvent', on_delete=models.CASCADE,
+                                 related_name='meta_values')
+    property = models.ForeignKey('EventMetaProperty', on_delete=models.CASCADE,
+                                 related_name='subevent_values')
+    value = models.TextField()
+
+    class Meta:
+        unique_together = ('subevent', 'property')

src/pretix/base/models/invoices.py

@@ -53,6 +53,12 @@ class Invoice(models.Model):
     :type payment_provider_text: str
     :param footer_text: A footer text, displayed smaller and centered on every page
     :type footer_text: str
+    :param foreign_currency_display: A different currency that taxes should also be displayed in.
+    :type foreign_currency_display: str
+    :param foreign_currency_rate: The rate of a forein currency that the taxes should be displayed in.
+    :type foreign_currency_rate: Decimal
+    :param foreign_currency_rate_date: The date of the forein currency exchange rates.
+    :type foreign_currency_rate_date: date
     :param file: The filename of the rendered invoice
     :type file: File
     """
@@ -71,6 +77,9 @@ class Invoice(models.Model):
     additional_text = models.TextField(blank=True)
     payment_provider_text = models.TextField(blank=True)
     footer_text = models.TextField(blank=True)
+    foreign_currency_display = models.CharField(max_length=50, null=True, blank=True)
+    foreign_currency_rate = models.DecimalField(decimal_places=4, max_digits=10, null=True, blank=True)
+    foreign_currency_rate_date = models.DateField(null=True, blank=True)
     file = models.FileField(null=True, blank=True, upload_to=invoice_filename)
 
     @staticmethod
@@ -155,13 +164,20 @@ class InvoiceLine(models.Model):
     :type tax_value: decimal.Decimal
     :param tax_rate: The applied tax rate in percent
     :type tax_rate: decimal.Decimal
+    :param tax_name: The name of the applied tax rate
+    :type tax_name: str
     """
     invoice = models.ForeignKey('Invoice', related_name='lines')
+    position = models.PositiveIntegerField(default=0)
     description = models.TextField()
     gross_value = models.DecimalField(max_digits=10, decimal_places=2)
     tax_value = models.DecimalField(max_digits=10, decimal_places=2, default=Decimal('0.00'))
     tax_rate = models.DecimalField(max_digits=7, decimal_places=2, default=Decimal('0.00'))
+    tax_name = models.CharField(max_length=190)
 
     @property
     def net_value(self):
         return self.gross_value - self.tax_value
+
+    class Meta:
+        ordering = ('position', 'pk')

src/pretix/base/models/items.py

@@ -13,8 +13,8 @@ from django.utils.timezone import now
 from django.utils.translation import pgettext_lazy, ugettext_lazy as _
 from i18nfield.fields import I18nCharField, I18nTextField
 
-from pretix.base.decimal import round_decimal
 from pretix.base.models.base import LoggedModel
+from pretix.base.models.tax import TaxedPrice
 
 from .event import Event, SubEvent
 
@@ -159,6 +159,8 @@ class Item(LoggedModel):
     :type max_per_order: int
     :param min_per_order: Minimum number of times this item needs to be in an order if bought at all. None for unlimited.
     :type min_per_order: int
+    :param checkin_attention: Requires special attention at checkin
+    :type checkin_attention: bool
     """
 
     event = models.ForeignKey(
@@ -202,10 +204,11 @@ class Item(LoggedModel):
                     "additional donations for your event. This is currently not supported for products that are "
                     "bought as an add-on to other products.")
     )
-    tax_rate = models.DecimalField(
-        verbose_name=_("Taxes included in percent"),
-        max_digits=7, decimal_places=2,
-        default=Decimal('0.00')
+    tax_rule = models.ForeignKey(
+        'TaxRule',
+        verbose_name=_('Sales tax'),
+        on_delete=models.PROTECT,
+        null=True, blank=True
     )
     admission = models.BooleanField(
         verbose_name=_("Is an admission ticket"),
@@ -265,6 +268,13 @@ class Item(LoggedModel):
                     'empty or set it to 0, there is no special limit for this product. The limit for the maximum '
                     'number of items in the whole order applies regardless.')
     )
+    checkin_attention = models.BooleanField(
+        verbose_name=_('Requires special attention'),
+        default=False,
+        help_text=_('If you set this, the check-in app will show a visible warning that this ticket requires special '
+                    'attention. You can use this for example for student tickets to indicate to the person at '
+                    'check-in that the student ID card still needs to be checked.')
+    )
     # !!! Attention: If you add new fields here, also add them to the copying code in
     # pretix/control/views/item.py if applicable.
 
@@ -286,10 +296,12 @@ class Item(LoggedModel):
         if self.event:
             self.event.get_cache().clear()
 
-    @property
-    def default_price_net(self):
-        tax_value = round_decimal(self.default_price * (1 - 100 / (100 + self.tax_rate)))
-        return self.default_price - tax_value
+    def tax(self, price=None, base_price_is='auto'):
+        price = price if price is not None else self.default_price
+        if not self.tax_rule:
+            return TaxedPrice(gross=price, net=price, tax=Decimal('0.00'),
+                              rate=Decimal('0.00'), name='')
+        return self.tax_rule.tax(price, base_price_is=base_price_is)
 
     def is_available(self, now_dt: datetime=None) -> bool:
         """
@@ -396,10 +408,11 @@ class ItemVariation(models.Model):
     def price(self):
         return self.default_price if self.default_price is not None else self.item.default_price
 
-    @property
-    def net_price(self):
-        tax_value = round_decimal(self.price * (1 - 100 / (100 + self.item.tax_rate)))
-        return self.price - tax_value
+    def tax(self, price=None):
+        price = price or self.price
+        if not self.item.tax_rule:
+            return TaxedPrice(gross=price, net=price, tax=Decimal('0.00'), rate=Decimal('0.00'), name='')
+        return self.item.tax_rule.tax(price)
 
     def delete(self, *args, **kwargs):
         super().delete(*args, **kwargs)
@@ -545,6 +558,11 @@ class Question(LoggedModel):
     question = I18nTextField(
         verbose_name=_("Question")
     )
+    help_text = I18nTextField(
+        verbose_name=_("Help text"),
+        help_text=_("If the question needs to be explained or clarified, do it here!"),
+        null=True, blank=True,
+    )
     type = models.CharField(
         max_length=5,
         choices=TYPE_CHOICES,

src/pretix/base/models/log.py

@@ -5,9 +5,10 @@ from django.contrib.contenttypes.models import ContentType
 from django.db import models
 from django.urls import reverse
 from django.utils.functional import cached_property
+from django.utils.html import escape
 from django.utils.translation import pgettext_lazy, ugettext_lazy as _
 
-from pretix.base.models.event import SubEvent
+from pretix.base.signals import logentry_object_link
 
 
 class LogEntry(models.Model):
@@ -51,7 +52,7 @@ class LogEntry(models.Model):
 
     @cached_property
     def display_object(self):
-        from . import Order, Voucher, Quota, Item, ItemCategory, Question, Event
+        from . import Order, Voucher, Quota, Item, ItemCategory, Question, Event, TaxRule, SubEvent
 
         if self.content_type.model_class() is Event:
             return ''
@@ -68,7 +69,7 @@ class LogEntry(models.Model):
                     'organizer': self.event.organizer.slug,
                     'code': co.code
                 }),
-                'val': co.code,
+                'val': escape(co.code),
             }
         elif isinstance(co, Voucher):
             a_text = _('Voucher {val}…')
@@ -78,7 +79,7 @@ class LogEntry(models.Model):
                     'organizer': self.event.organizer.slug,
                     'voucher': co.id
                 }),
-                'val': co.code[:6],
+                'val': escape(co.code[:6]),
             }
         elif isinstance(co, Item):
             a_text = _('Product {val}')
@@ -88,7 +89,7 @@ class LogEntry(models.Model):
                     'organizer': self.event.organizer.slug,
                     'item': co.id
                 }),
-                'val': co.name,
+                'val': escape(co.name),
             }
         elif isinstance(co, SubEvent):
             a_text = pgettext_lazy('subevent', 'Date {val}')
@@ -98,7 +99,7 @@ class LogEntry(models.Model):
                     'organizer': self.event.organizer.slug,
                     'subevent': co.id
                 }),
-                'val': str(co)
+                'val': escape(str(co))
             }
         elif isinstance(co, Quota):
             a_text = _('Quota {val}')
@@ -108,7 +109,7 @@ class LogEntry(models.Model):
                     'organizer': self.event.organizer.slug,
                     'quota': co.id
                 }),
-                'val': co.name,
+                'val': escape(co.name),
             }
         elif isinstance(co, ItemCategory):
             a_text = _('Category {val}')
@@ -118,7 +119,7 @@ class LogEntry(models.Model):
                     'organizer': self.event.organizer.slug,
                     'category': co.id
                 }),
-                'val': co.name,
+                'val': escape(co.name),
             }
         elif isinstance(co, Question):
             a_text = _('Question {val}')
@@ -128,7 +129,17 @@ class LogEntry(models.Model):
                     'organizer': self.event.organizer.slug,
                     'question': co.id
                 }),
-                'val': co.question,
+                'val': escape(co.question),
+            }
+        elif isinstance(co, TaxRule):
+            a_text = _('Tax rule {val}')
+            a_map = {
+                'href': reverse('control:event.settings.tax.edit', kwargs={
+                    'event': self.event.slug,
+                    'organizer': self.event.organizer.slug,
+                    'rule': co.id
+                }),
+                'val': escape(co.name),
             }
 
         if a_text and a_map:
@@ -137,6 +148,9 @@ class LogEntry(models.Model):
         elif a_text:
             return a_text
         else:
+            for receiver, response in logentry_object_link.send(self.event, logentry=self):
+                if response:
+                    return response
             return ''
 
     @cached_property

src/pretix/base/models/orders.py

@@ -12,11 +12,10 @@ from django.db import models
 from django.db.models import F, Sum
 from django.db.models.signals import post_delete
 from django.dispatch import receiver
+from django.urls import reverse
 from django.utils.crypto import get_random_string
 from django.utils.encoding import escape_uri_path
 from django.utils.functional import cached_property
-from django.utils.html import escape
-from django.utils.safestring import mark_safe
 from django.utils.timezone import make_aware, now
 from django.utils.translation import pgettext_lazy, ugettext_lazy as _
 from django_countries.fields import CountryField
@@ -26,7 +25,6 @@ from pretix.base.i18n import language
 from pretix.base.models import User
 from pretix.base.reldate import RelativeDateWrapper
 
-from ..decimal import round_decimal
 from .base import LoggedModel
 from .event import Event, SubEvent
 from .items import Item, ItemVariation, Question, QuestionOption, Quota
@@ -80,18 +78,14 @@ class Order(LoggedModel):
     :type payment_date: datetime
     :param payment_provider: The payment provider selected by the user
     :type payment_provider: str
-    :param payment_fee: The payment fee calculated at checkout time
-    :type payment_fee: decimal.Decimal
-    :param payment_fee_tax_value: The absolute amount of tax included in the payment fee
-    :type payment_fee_tax_value: decimal.Decimal
-    :param payment_fee_tax_rate: The tax rate applied to the payment fee (in percent)
-    :type payment_fee_tax_rate: decimal.Decimal
     :param payment_info: Arbitrary information stored by the payment provider
     :type payment_info: str
     :param total: The total amount of the order, including the payment fee
     :type total: decimal.Decimal
     :param comment: An internal comment that will only be visible to staff, and never displayed to the user
     :type comment: str
+    :param download_reminder_sent: A field to indicate whether a download reminder has been sent.
+    :type download_reminder_sent: boolean
     :param meta_info: Additional meta information on the order, JSON-encoded.
     :type meta_info: str
     """
@@ -149,18 +143,6 @@ class Order(LoggedModel):
         max_length=255,
         verbose_name=_("Payment provider")
     )
-    payment_fee = models.DecimalField(
-        decimal_places=2, max_digits=10,
-        default=0, verbose_name=_("Payment method fee")
-    )
-    payment_fee_tax_rate = models.DecimalField(
-        decimal_places=2, max_digits=10,
-        verbose_name=_("Payment method fee tax rate")
-    )
-    payment_fee_tax_value = models.DecimalField(
-        decimal_places=2, max_digits=10,
-        default=0, verbose_name=_("Payment method fee tax")
-    )
     payment_info = models.TextField(
         verbose_name=_("Payment information"),
         null=True, blank=True
@@ -181,6 +163,10 @@ class Order(LoggedModel):
     expiry_reminder_sent = models.BooleanField(
         default=False
     )
+
+    download_reminder_sent = models.BooleanField(
+        default=False
+    )
     meta_info = models.TextField(
         verbose_name=_("Meta information"),
         null=True, blank=True
@@ -215,29 +201,11 @@ class Order(LoggedModel):
             self.assign_code()
         if not self.datetime:
             self.datetime = now()
-        if self.payment_fee_tax_rate is None:
-            self._calculate_tax()
         super().save(*args, **kwargs)
 
-    def _calculate_tax(self):
-        """
-        Calculates the taxes on the payment fees and sets the parameters payment_fee_tax_rate
-        and payment_fee_tax_value accordingly.
-        """
-        self.payment_fee_tax_rate = self.event.settings.get('tax_rate_default')
-        if self.payment_fee_tax_rate:
-            self.payment_fee_tax_value = round_decimal(
-                self.payment_fee * (1 - 100 / (100 + self.payment_fee_tax_rate)))
-        else:
-            self.payment_fee_tax_value = Decimal('0.00')
-
-    @property
-    def payment_fee_net(self):
-        return self.payment_fee - self.payment_fee_tax_value
-
     @cached_property
     def tax_total(self):
-        return (self.positions.aggregate(s=Sum('tax_value'))['s'] or 0) + self.payment_fee_tax_value
+        return (self.positions.aggregate(s=Sum('tax_value'))['s'] or 0) + (self.fees.aggregate(s=Sum('tax_value'))['s'] or 0)
 
     @property
     def net_total(self):
@@ -365,7 +333,7 @@ class Order(LoggedModel):
 
         return self._is_still_available()
 
-    def _is_still_available(self, now_dt: datetime=None) -> Union[bool, str]:
+    def _is_still_available(self, now_dt: datetime=None, count_waitinglist=True) -> Union[bool, str]:
         error_messages = {
             'unavailable': _('The ordered product "{item}" is no longer available.'),
         }
@@ -383,7 +351,7 @@ class Order(LoggedModel):
                 for quota in quotas:
                     if quota.id not in quota_cache:
                         quota_cache[quota.id] = quota
-                        quota.cached_availability = quota.availability(now_dt)[1]
+                        quota.cached_availability = quota.availability(now_dt, count_waitinglist=count_waitinglist)[1]
                     else:
                         # Use cached version
                         quota = quota_cache[quota.id]
@@ -487,7 +455,19 @@ class QuestionAnswer(models.Model):
     )
 
     @property
-    def file_link(self):
+    def backend_file_url(self):
+        if self.file:
+            if self.orderposition:
+                return reverse('control:event.order.download.answer', kwargs={
+                    'code': self.orderposition.order.code,
+                    'event': self.orderposition.order.event.slug,
+                    'organizer': self.orderposition.order.event.organizer.slug,
+                    'answer': self.pk,
+                })
+        return ""
+
+    @property
+    def frontend_file_url(self):
         from pretix.multidomain.urlreverse import eventreverse
 
         if self.file:
@@ -502,12 +482,13 @@ class QuestionAnswer(models.Model):
                     'answer': self.pk,
                 })
 
-            return mark_safe("<a href='{}'>{}</a>".format(
-                url,
-                escape(self.file.name.split('.', 1)[-1])
-            ))
+            return url
         return ""
 
+    @property
+    def file_name(self):
+        return self.file.name.split('.', 1)[-1]
+
     def __str__(self):
         if self.question.type == Question.TYPE_BOOLEAN and self.answer == "True":
             return str(_("Yes"))
@@ -633,6 +614,91 @@ class AbstractPosition(models.Model):
                 else self.variation.quotas.filter(subevent=self.subevent))
 
 
+class OrderFee(models.Model):
+    """
+    An OrderFee objet represents a fee that is added to the order total independently of
+    the actual positions. This might for example be a payment or a shipping fee.
+    """
+    FEE_TYPE_PAYMENT = "payment"
+    FEE_TYPE_SHIPPING = "shipping"
+    FEE_TYPE_OTHER = "other"
+    FEE_TYPES = (
+        (FEE_TYPE_PAYMENT, _("Payment fee")),
+        (FEE_TYPE_SHIPPING, _("Shipping fee")),
+        (FEE_TYPE_OTHER, _("Other fees")),
+    )
+
+    value = models.DecimalField(
+        decimal_places=2, max_digits=10,
+        verbose_name=_("Value")
+    )
+    order = models.ForeignKey(
+        Order,
+        verbose_name=_("Order"),
+        related_name='fees',
+        on_delete=models.PROTECT
+    )
+    fee_type = models.CharField(
+        max_length=100, choices=FEE_TYPES
+    )
+    description = models.CharField(max_length=190, blank=True)
+    internal_type = models.CharField(max_length=255, blank=True)
+    tax_rate = models.DecimalField(
+        max_digits=7, decimal_places=2,
+        verbose_name=_('Tax rate')
+    )
+    tax_rule = models.ForeignKey(
+        'TaxRule',
+        on_delete=models.PROTECT,
+        null=True, blank=True
+    )
+    tax_value = models.DecimalField(
+        max_digits=10, decimal_places=2,
+        verbose_name=_('Tax value')
+    )
+
+    @property
+    def net_value(self):
+        return self.value - self.tax_value
+
+    def __str__(self):
+        if self.description:
+            return '{} - {}'.format(self.get_fee_type_display(), self.description)
+        else:
+            return self.get_fee_type_display()
+
+    def __repr__(self):
+        return '<OrderFee: type %s, value %d>' % (
+            self.fee_type, self.value
+        )
+
+    def _calculate_tax(self):
+        try:
+            ia = self.order.invoice_address
+        except InvoiceAddress.DoesNotExist:
+            ia = None
+
+        if not self.tax_rule and self.fee_type == "payment" and self.order.event.settings.tax_rate_default:
+            self.tax_rule = self.order.event.settings.tax_rate_default
+
+        if self.tax_rule:
+            if self.tax_rule.tax_applicable(ia):
+                tax = self.tax_rule.tax(self.value, base_price_is='gross')
+                self.tax_rate = tax.rate
+                self.tax_value = tax.tax
+            else:
+                self.tax_value = Decimal('0.00')
+                self.tax_rate = Decimal('0.00')
+        else:
+            self.tax_value = Decimal('0.00')
+            self.tax_rate = Decimal('0.00')
+
+    def save(self, *args, **kwargs):
+        if self.tax_rate is None:
+            self._calculate_tax()
+        return super().save(*args, **kwargs)
+
+
 class OrderPosition(AbstractPosition):
     """
     An OrderPosition is one line of an order, representing one ordered item
@@ -653,6 +719,15 @@ class OrderPosition(AbstractPosition):
         max_digits=7, decimal_places=2,
         verbose_name=_('Tax rate')
     )
+    tax_rule = models.ForeignKey(
+        'TaxRule',
+        on_delete=models.PROTECT,
+        null=True, blank=True
+    )
+    tax_value = models.DecimalField(
+        max_digits=10, decimal_places=2,
+        verbose_name=_('Tax value')
+    )
     tax_value = models.DecimalField(
         max_digits=10, decimal_places=2,
         verbose_name=_('Tax value')
@@ -712,11 +787,22 @@ class OrderPosition(AbstractPosition):
         )
 
     def _calculate_tax(self):
-        self.tax_rate = self.item.tax_rate
-        if self.tax_rate:
-            self.tax_value = round_decimal(self.price * (1 - 100 / (100 + self.item.tax_rate)))
+        self.tax_rule = self.item.tax_rule
+        try:
+            ia = self.order.invoice_address
+        except InvoiceAddress.DoesNotExist:
+            ia = None
+        if self.tax_rule:
+            if self.tax_rule.tax_applicable(ia):
+                tax = self.tax_rule.tax(self.price, base_price_is='gross')
+                self.tax_rate = tax.rate
+                self.tax_value = tax.tax
+            else:
+                self.tax_value = Decimal('0.00')
+                self.tax_rate = Decimal('0.00')
         else:
             self.tax_value = Decimal('0.00')
+            self.tax_rate = Decimal('0.00')
 
     def save(self, *args, **kwargs):
         if self.tax_rate is None:
@@ -757,6 +843,9 @@ class CartPosition(AbstractPosition):
         verbose_name=_("Expiration date"),
         db_index=True
     )
+    includes_tax = models.BooleanField(
+        default=True
+    )
 
     class Meta:
         verbose_name = _("Cart position")
@@ -769,19 +858,23 @@ class CartPosition(AbstractPosition):
 
     @property
     def tax_rate(self):
-        return self.item.tax_rate
+        if self.includes_tax:
+            return self.item.tax(self.price, base_price_is='gross').rate
+        else:
+            return Decimal('0.00')
 
     @property
     def tax_value(self):
-        if not self.tax_rate:
+        if self.includes_tax:
+            return self.item.tax(self.price, base_price_is='gross').tax
+        else:
             return Decimal('0.00')
-        return round_decimal(self.price * (1 - 100 / (100 + self.item.tax_rate)))
 
 
 class InvoiceAddress(models.Model):
     last_modified = models.DateTimeField(auto_now=True)
-    is_business = models.BooleanField(default=False, verbose_name=_('Business customer'))
     order = models.OneToOneField(Order, null=True, blank=True, related_name='invoice_address')
+    is_business = models.BooleanField(default=False, verbose_name=_('Business customer'))
     company = models.CharField(max_length=255, blank=True, verbose_name=_('Company name'))
     name = models.CharField(max_length=255, verbose_name=_('Full name'), blank=True)
     street = models.TextField(verbose_name=_('Address'), blank=False)
@@ -791,6 +884,7 @@ class InvoiceAddress(models.Model):
     country = CountryField(verbose_name=_('Country'), blank=False, blank_label=_('Select country'))
     vat_id = models.CharField(max_length=255, blank=True, verbose_name=_('VAT ID'),
                               help_text=_('Only for business customers within the EU.'))
+    vat_id_validated = models.BooleanField(default=False)
 
 
 def cachedticket_name(instance, filename: str) -> str:

src/pretix/base/models/tax.py

@@ -0,0 +1,174 @@
+from decimal import Decimal
+
+from django.db import models
+from django.utils.formats import localize
+from django.utils.translation import ugettext_lazy as _
+from django_countries.fields import CountryField
+from i18nfield.fields import I18nCharField
+
+from pretix.base.decimal import round_decimal
+from pretix.base.models.base import LoggedModel
+
+
+class TaxedPrice:
+    def __init__(self, *, gross: Decimal, net: Decimal, tax: Decimal, rate: Decimal, name: str):
+        if net + tax != gross:
+            raise ValueError('Net value and tax value need to add to the gross value')
+        self.gross = gross
+        self.net = net
+        self.tax = tax
+        self.rate = rate
+        self.name = name
+
+    def __repr__(self):
+        return '{} + {}% = {}'.format(localize(self.net), localize(self.rate), localize(self.gross))
+
+
+TAXED_ZERO = TaxedPrice(
+    gross=Decimal('0.00'),
+    net=Decimal('0.00'),
+    tax=Decimal('0.00'),
+    rate=Decimal('0.00'),
+    name=''
+)
+
+EU_COUNTRIES = {
+    'AT', 'BE', 'BG', 'HR', 'CY', 'CZ', 'DK', 'EE', 'FI', 'FR', 'DE', 'GR', 'HU', 'IE', 'IT', 'LV', 'LT', 'LU', 'MT',
+    'NL', 'PL', 'PT', 'RO', 'SK', 'SI', 'ES', 'SE', 'GB'
+}
+EU_CURRENCIES = {
+    'BG': 'BGN',
+    'GB': 'GBP',
+    'HR': 'HRK',
+    'CZ': 'CZK',
+    'DK': 'DKK',
+    'HU': 'HUF',
+    'PL': 'PLN',
+    'RO': 'RON',
+    'SE': 'SEK'
+}
+
+
+class TaxRule(LoggedModel):
+    event = models.ForeignKey('Event', related_name='tax_rules')
+    name = I18nCharField(
+        verbose_name=_('Name'),
+        help_text=_('Should be short, e.g. "VAT"'),
+        max_length=190,
+    )
+    rate = models.DecimalField(
+        max_digits=10,
+        decimal_places=2,
+        verbose_name=_("Tax rate")
+    )
+    price_includes_tax = models.BooleanField(
+        verbose_name=_("The configured product prices include the tax amount"),
+        default=True,
+    )
+    eu_reverse_charge = models.BooleanField(
+        verbose_name=_("Use EU reverse charge taxation rules"),
+        default=False,
+        help_text=_("Not recommended. Most events will NOT be qualified for reverse charge since the place of "
+                    "taxation is the location of the event. This option disables charging VAT for all customers "
+                    "outside the EU and for business customers in different EU countries who entered a valid EU VAT "
+                    "ID. Only enable this option after consulting a tax counsel. No warranty given for correct tax "
+                    "calculation. USE AT YOUR OWN RISK.")
+    )
+    home_country = CountryField(
+        verbose_name=_('Merchant country'),
+        blank=True,
+        help_text=_('Your country of residence. This is the country the EU reverse charge rule will not apply in, '
+                    'if configured above.'),
+    )
+
+    @classmethod
+    def zero(cls):
+        return cls(
+            event=None,
+            name='',
+            rate=Decimal('0.00'),
+            price_includes_tax=True,
+            eu_reverse_charge=False
+        )
+
+    def clean(self):
+        if self.eu_reverse_charge and not self.home_country:
+            raise ValueError(_('You need to set your home country to use the reverse charge feature.'))
+
+    def __str__(self):
+        if self.price_includes_tax:
+            s = _('incl. {rate}% {name}').format(rate=self.rate, name=self.name)
+        else:
+            s = _('plus {rate}% {name}').format(rate=self.rate, name=self.name)
+        if self.eu_reverse_charge:
+            s += ' ({})'.format(_('reverse charge enabled'))
+        return str(s)
+
+    def tax(self, base_price, base_price_is='auto'):
+        if self.rate == Decimal('0.00'):
+            return TaxedPrice(
+                net=base_price, gross=base_price, tax=Decimal('0.00'),
+                rate=self.rate, name=self.name
+            )
+
+        if base_price_is == 'auto':
+            if self.price_includes_tax:
+                base_price_is = 'gross'
+            else:
+                base_price_is = 'net'
+
+        if base_price_is == 'gross':
+            gross = base_price
+            net = gross - round_decimal(base_price * (1 - 100 / (100 + self.rate)))
+        elif base_price_is == 'net':
+            net = base_price
+            gross = round_decimal(net * (1 + self.rate / 100))
+        else:
+            raise ValueError('Unknown base price type: {}'.format(base_price_is))
+
+        return TaxedPrice(
+            net=net, gross=gross, tax=gross - net,
+            rate=self.rate, name=self.name
+        )
+
+    def is_reverse_charge(self, invoice_address):
+        if not self.eu_reverse_charge:
+            return False
+
+        if not invoice_address or not invoice_address.country:
+            return False
+
+        if str(invoice_address.country) not in EU_COUNTRIES:
+            return False
+
+        if invoice_address.country == self.home_country:
+            return False
+
+        if invoice_address.is_business and invoice_address.vat_id and invoice_address.vat_id_validated:
+            return True
+
+        return False
+
+    def tax_applicable(self, invoice_address):
+        if not self.eu_reverse_charge:
+            # No reverse charge rules? Always apply VAT!
+            return True
+
+        if not invoice_address or not invoice_address.country:
+            # No country specified? Always apply VAT!
+            return True
+
+        if str(invoice_address.country) not in EU_COUNTRIES:
+            # Non-EU country? Never apply VAT!
+            return False
+
+        if invoice_address.country == self.home_country:
+            # Within same EU country? Always apply VAT!
+            return True
+
+        if invoice_address.is_business and invoice_address.vat_id and invoice_address.vat_id_validated:
+            # Reverse charge case
+            return False
+
+        # Consumer in different EU country / invalid VAT
+        return True

src/pretix/base/models/vouchers.py

@@ -2,6 +2,7 @@ from decimal import Decimal
 
 from django.conf import settings
 from django.core.exceptions import ValidationError
+from django.core.validators import MinLengthValidator
 from django.db import models
 from django.utils.crypto import get_random_string
 from django.utils.timezone import now
@@ -92,6 +93,7 @@ class Voucher(LoggedModel):
         verbose_name=_("Voucher code"),
         max_length=255, default=generate_code,
         db_index=True,
+        validators=[MinLengthValidator(5)]
     )
     max_usages = models.PositiveIntegerField(
         verbose_name=_("Maximum usages"),
@@ -251,7 +253,7 @@ class Voucher(LoggedModel):
             if self.price_mode == 'set':
                 return self.value
             elif self.price_mode == 'subtract':
-                return original_price - self.value
+                return max(original_price - self.value, Decimal('0.00'))
             elif self.price_mode == 'percent':
                 return round_decimal(original_price * (Decimal('100.00') - self.value) / Decimal('100.00'))
         return original_price

src/pretix/base/payment.py

@@ -149,7 +149,9 @@ class BasePaymentProvider:
             ('_fee_percent',
              forms.DecimalField(
                  label=_('Additional fee'),
-                 help_text=_('Percentage'),
+                 help_text=_('Percentage of the order total. Note that this percentage will currently only '
+                             'be calculated on the summed price of sold tickets, not on other fees like e.g. shipping '
+                             'fees, if there are any.'),
                  required=False
              )),
             ('_availability_date',
@@ -215,7 +217,7 @@ class BasePaymentProvider:
         required fields for you.
         """
         form = PaymentProviderForm(
-            data=(request.POST if request.method == 'POST' else None),
+            data=(request.POST if request.method == 'POST' and request.POST.get("payment") == self.identifier else None),
             prefix='payment_%s' % self.identifier,
             initial={
                 k.replace('payment_%s_' % self.identifier, ''): v
@@ -591,7 +593,11 @@ class FreeOrderProvider(BasePaymentProvider):
         messages.success(request, _('The order has been marked as refunded.'))
 
     def is_allowed(self, request: HttpRequest) -> bool:
-        return get_cart_total(request) == 0
+        from .services.cart import get_fees
+
+        total = get_cart_total(request)
+        total += sum([f.value for f in get_fees(self.event, request, total, None, None)])
+        return total == 0
 
     def order_change_allowed(self, order: Order) -> bool:
         return False

src/pretix/base/reldate.py

@@ -6,6 +6,7 @@ import pytz
 from dateutil import parser
 from django import forms
 from django.core.exceptions import ValidationError
+from django.db import models
 from django.utils.translation import ugettext_lazy as _
 
 BASE_CHOICES = (
@@ -107,6 +108,9 @@ class RelativeDateWrapper:
             data = parser.parse(input)
         return RelativeDateWrapper(data)
 
+    def __len__(self):
+        return len(self.to_string())
+
 
 class RelativeDateTimeWidget(forms.MultiWidget):
     template_name = 'pretixbase/forms/widgets/reldatetime.html'
@@ -168,6 +172,8 @@ class RelativeDateTimeField(forms.MultiValueField):
         )
         if 'widget' not in kwargs:
             kwargs['widget'] = RelativeDateTimeWidget(status_choices=status_choices, base_choices=BASE_CHOICES)
+        kwargs.pop('max_length', 0)
+        kwargs.pop('empty_value', 0)
         super().__init__(
             fields=fields, require_all_fields=False, *args, **kwargs
         )
@@ -277,3 +283,34 @@ class RelativeDateField(RelativeDateTimeField):
             raise ValidationError(self.error_messages['incomplete'])
 
         return super().clean(value)
+
+
+class ModelRelativeDateTimeField(models.CharField):
+    form_class = RelativeDateTimeField
+
+    def __init__(self, *args, **kwargs):
+        self.event = kwargs.pop('event', None)
+        kwargs.setdefault('max_length', 255)
+        super().__init__(*args, **kwargs)
+
+    def to_python(self, value):
+        if isinstance(value, RelativeDateWrapper):
+            return value
+        if value is None:
+            return None
+        return RelativeDateWrapper.from_string(value)
+
+    def get_prep_value(self, value):
+        if isinstance(value, RelativeDateWrapper):
+            return value.to_string()
+        return value
+
+    def from_db_value(self, value, expression, connection, context):
+        if value is None:
+            return None
+        return RelativeDateWrapper.from_string(value)
+
+    def formfield(self, **kwargs):
+        defaults = {'form_class': self.form_class}
+        defaults.update(kwargs)
+        return super().formfield(**defaults)

src/pretix/base/services/cart.py

@@ -6,18 +6,25 @@ from typing import List, Optional
 from celery.exceptions import MaxRetriesExceededError
 from django.db import transaction
 from django.db.models import Q
+from django.dispatch import receiver
 from django.utils.timezone import now
 from django.utils.translation import pgettext_lazy, ugettext as _
 
 from pretix.base.i18n import LazyLocaleException, language
 from pretix.base.models import (
-    CartPosition, Event, Item, ItemVariation, Voucher,
+    CartPosition, Event, InvoiceAddress, Item, ItemVariation, Voucher,
 )
 from pretix.base.models.event import SubEvent
+from pretix.base.models.orders import OrderFee
+from pretix.base.models.tax import TAXED_ZERO, TaxedPrice, TaxRule
 from pretix.base.services.async import ProfiledTask
 from pretix.base.services.locking import LockTimeoutException
 from pretix.base.services.pricing import get_price
+from pretix.base.templatetags.rich_text import rich_text
 from pretix.celery_app import app
+from pretix.presale.signals import (
+    checkout_confirm_messages, fee_calculation_for_cart,
+)
 
 
 class CartError(LazyLocaleException):
@@ -68,7 +75,7 @@ error_messages = {
 
 class CartManager:
     AddOperation = namedtuple('AddOperation', ('count', 'item', 'variation', 'price', 'voucher', 'quotas',
-                                               'addon_to', 'subevent'))
+                                               'addon_to', 'subevent', 'includes_tax'))
     RemoveOperation = namedtuple('RemoveOperation', ('position',))
     ExtendOperation = namedtuple('ExtendOperation', ('position', 'count', 'item', 'variation', 'price', 'voucher',
                                                      'quotas', 'subevent'))
@@ -78,7 +85,7 @@ class CartManager:
         AddOperation: 30
     }
 
-    def __init__(self, event: Event, cart_id: str):
+    def __init__(self, event: Event, cart_id: str, invoice_address: InvoiceAddress=None):
         self.event = event
         self.cart_id = cart_id
         self.now_dt = now()
@@ -89,6 +96,7 @@ class CartManager:
         self._subevents_cache = {}
         self._variations_cache = {}
         self._expiry = None
+        self.invoice_address = invoice_address
 
     @property
     def positions(self):
@@ -213,8 +221,12 @@ class CartManager:
 
     def _get_price(self, item: Item, variation: Optional[ItemVariation],
                    voucher: Optional[Voucher], custom_price: Optional[Decimal],
-                   subevent: Optional[SubEvent]):
-        return get_price(item, variation, voucher, custom_price, subevent, self.event.settings.display_net_prices)
+                   subevent: Optional[SubEvent], cp_is_net: bool=None):
+        return get_price(
+            item, variation, voucher, custom_price, subevent,
+            custom_price_is_net=cp_is_net if cp_is_net is not None else self.event.settings.display_net_prices,
+            invoice_address=self.invoice_address
+        )
 
     def extend_expired_positions(self):
         expired = self.positions.filter(expires__lte=self.now_dt).select_related(
@@ -222,7 +234,12 @@ class CartManager:
         ).prefetch_related('item__quotas', 'variation__quotas')
         err = None
         for cp in expired:
-            price = self._get_price(cp.item, cp.variation, cp.voucher, cp.price, cp.subevent)
+            if not cp.includes_tax:
+                price = self._get_price(cp.item, cp.variation, cp.voucher, cp.price, cp.subevent,
+                                        cp_is_net=True)
+                price = TaxedPrice(net=price.net, gross=price.net, rate=0, tax=0, name='')
+            else:
+                price = self._get_price(cp.item, cp.variation, cp.voucher, cp.price, cp.subevent)
 
             quotas = list(cp.quotas)
             if not quotas:
@@ -296,7 +313,7 @@ class CartManager:
             price = self._get_price(item, variation, voucher, i.get('price'), subevent)
             op = self.AddOperation(
                 count=i['count'], item=item, variation=variation, price=price, voucher=voucher, quotas=quotas,
-                addon_to=False, subevent=subevent
+                addon_to=False, subevent=subevent, includes_tax=bool(price.rate)
             )
             self._check_item_constraints(op)
             operations.append(op)
@@ -395,13 +412,13 @@ class CartManager:
                     quota_diff[quota] += 1
 
                 if price_included[cp.pk].get(item.category_id):
-                    price = Decimal('0.00')
+                    price = TAXED_ZERO
                 else:
                     price = self._get_price(item, variation, None, None, cp.subevent)
 
                 op = self.AddOperation(
                     count=1, item=item, variation=variation, price=price, voucher=None, quotas=quotas,
-                    addon_to=cp, subevent=cp.subevent
+                    addon_to=cp, subevent=cp.subevent, includes_tax=bool(price.rate)
                 )
                 self._check_item_constraints(op)
                 operations.append(op)
@@ -557,15 +574,14 @@ class CartManager:
                     for k in range(available_count):
                         new_cart_positions.append(CartPosition(
                             event=self.event, item=op.item, variation=op.variation,
-                            price=op.price, expires=self._expiry,
-                            cart_id=self.cart_id, voucher=op.voucher,
-                            addon_to=op.addon_to if op.addon_to else None,
-                            subevent=op.subevent
+                            price=op.price.gross, expires=self._expiry, cart_id=self.cart_id,
+                            voucher=op.voucher, addon_to=op.addon_to if op.addon_to else None,
+                            subevent=op.subevent, includes_tax=op.includes_tax
                         ))
                 elif isinstance(op, self.ExtendOperation):
                     if available_count == 1:
                         op.position.expires = self._expiry
-                        op.position.price = op.price
+                        op.position.price = op.price.gross
                         op.position.save()
                     elif available_count == 0:
                         op.position.delete()
@@ -591,8 +607,68 @@ class CartManager:
                 raise CartError(err)
 
 
+def update_tax_rates(event: Event, cart_id: str, invoice_address: InvoiceAddress):
+    positions = CartPosition.objects.filter(
+        cart_id=cart_id, event=event
+    ).select_related('item', 'item__tax_rule')
+    totaldiff = Decimal('0.00')
+    for pos in positions:
+        if not pos.item.tax_rule:
+            continue
+        charge_tax = pos.item.tax_rule.tax_applicable(invoice_address)
+        if pos.includes_tax and not charge_tax:
+            price = pos.item.tax(pos.price, base_price_is='gross').net
+            totaldiff += price - pos.price
+            pos.price = price
+            pos.includes_tax = False
+            pos.save(update_fields=['price', 'includes_tax'])
+        elif charge_tax and not pos.includes_tax:
+            price = pos.item.tax(pos.price, base_price_is='net').gross
+            totaldiff += price - pos.price
+            pos.price = price
+            pos.includes_tax = True
+            pos.save(update_fields=['price', 'includes_tax'])
+
+    return totaldiff
+
+
+def get_fees(event, request, total, invoice_address, provider):
+    fees = []
+
+    if provider and total != 0:
+        provider = event.get_payment_providers().get(provider)
+        if provider:
+            payment_fee = provider.calculate_fee(total)
+
+            if payment_fee:
+                payment_fee_tax_rule = event.settings.tax_rate_default or TaxRule.zero()
+                if payment_fee_tax_rule.tax_applicable(invoice_address):
+                    payment_fee_tax = payment_fee_tax_rule.tax(payment_fee, base_price_is='gross')
+                    fees.append(OrderFee(
+                        fee_type=OrderFee.FEE_TYPE_PAYMENT,
+                        value=payment_fee,
+                        tax_rate=payment_fee_tax.rate,
+                        tax_value=payment_fee_tax.tax,
+                        tax_rule=payment_fee_tax_rule
+                    ))
+                else:
+                    fees.append(OrderFee(
+                        fee_type=OrderFee.FEE_TYPE_PAYMENT,
+                        value=payment_fee,
+                        tax_rate=Decimal('0.00'),
+                        tax_value=Decimal('0.00'),
+                        tax_rule=payment_fee_tax_rule
+                    ))
+
+    for recv, resp in fee_calculation_for_cart.send(sender=event, request=request, invoice_address=invoice_address):
+        fees += resp
+
+    return fees
+
+
 @app.task(base=ProfiledTask, bind=True, max_retries=5, default_retry_delay=1, throws=(CartError,))
-def add_items_to_cart(self, event: int, items: List[dict], cart_id: str=None, locale='en') -> None:
+def add_items_to_cart(self, event: int, items: List[dict], cart_id: str=None, locale='en',
+                      invoice_address: int=None) -> None:
     """
     Adds a list of items to a user's cart.
     :param event: The event ID in question
@@ -602,9 +678,17 @@ def add_items_to_cart(self, event: int, items: List[dict], cart_id: str=None, lo
     """
     with language(locale):
         event = Event.objects.get(id=event)
+
+        ia = False
+        if invoice_address:
+            try:
+                ia = InvoiceAddress.objects.get(pk=invoice_address)
+            except InvoiceAddress.DoesNotExist:
+                pass
+
         try:
             try:
-                cm = CartManager(event=event, cart_id=cart_id)
+                cm = CartManager(event=event, cart_id=cart_id, invoice_address=ia)
                 cm.add_new_items(items)
                 cm.commit()
             except LockTimeoutException:
@@ -655,7 +739,8 @@ def clear_cart(self, event: int, cart_id: str=None, locale='en') -> None:
 
 
 @app.task(base=ProfiledTask, bind=True, max_retries=5, default_retry_delay=1, throws=(CartError,))
-def set_cart_addons(self, event: int, addons: List[dict], cart_id: str=None, locale='en') -> None:
+def set_cart_addons(self, event: int, addons: List[dict], cart_id: str=None, locale='en',
+                    invoice_address: int=None) -> None:
     """
     Removes a list of items from a user's cart.
     :param event: The event ID in question
@@ -664,12 +749,29 @@ def set_cart_addons(self, event: int, addons: List[dict], cart_id: str=None, loc
     """
     with language(locale):
         event = Event.objects.get(id=event)
+
+        ia = False
+        if invoice_address:
+            try:
+                ia = InvoiceAddress.objects.get(pk=invoice_address)
+            except InvoiceAddress.DoesNotExist:
+                pass
         try:
             try:
-                cm = CartManager(event=event, cart_id=cart_id)
+                cm = CartManager(event=event, cart_id=cart_id, invoice_address=ia)
                 cm.set_addons(addons)
                 cm.commit()
             except LockTimeoutException:
                 self.retry()
         except (MaxRetriesExceededError, LockTimeoutException):
             raise CartError(error_messages['busy'])
+
+
+@receiver(checkout_confirm_messages, dispatch_uid="cart_confirm_messages")
+def confirm_messages(sender, *args, **kwargs):
+    if not sender.settings.confirm_text:
+        return {}
+
+    return {
+        'confirm_text': rich_text(str(sender.settings.confirm_text))
+    }

src/pretix/base/services/invoices.py

@@ -1,19 +1,33 @@
 import copy
-from decimal import Decimal
+import json
+import logging
+import urllib.error
+from datetime import date, timedelta
+from decimal import ROUND_HALF_UP, Decimal
 
+import vat_moss.exchange_rates
+from django.conf import settings
 from django.core.files.base import ContentFile
+from django.core.serializers.json import DjangoJSONEncoder
 from django.db import transaction
 from django.db.models import Count
+from django.dispatch import receiver
 from django.utils import timezone
+from django.utils.timezone import now
 from django.utils.translation import pgettext, ugettext as _
 from i18nfield.strings import LazyI18nString
 
 from pretix.base.i18n import language
 from pretix.base.models import Invoice, InvoiceAddress, InvoiceLine, Order
+from pretix.base.models.tax import EU_CURRENCIES
 from pretix.base.services.async import TransactionAwareTask
+from pretix.base.settings import GlobalSettingsObject
+from pretix.base.signals import periodic_task
 from pretix.celery_app import app
 from pretix.helpers.database import rolledback_transaction
 
+logger = logging.getLogger(__name__)
+
 
 @transaction.atomic
 def build_invoice(invoice: Invoice) -> Invoice:
@@ -33,6 +47,7 @@ def build_invoice(invoice: Invoice) -> Invoice:
         invoice.payment_provider_text = str(payment).replace('\n', '<br />')
 
         try:
+            ia = invoice.order.invoice_address
             addr_template = pgettext("invoice", """{i.company}
 {i.name}
 {i.street}
@@ -44,7 +59,31 @@ def build_invoice(invoice: Invoice) -> Invoice:
             ).strip()
             if invoice.order.invoice_address.vat_id:
                 invoice.invoice_to += "\n" + pgettext("invoice", "VAT-ID: %s") % invoice.order.invoice_address.vat_id
+
+            cc = str(invoice.order.invoice_address.country)
+
+            if cc in EU_CURRENCIES and EU_CURRENCIES[cc] != invoice.event.currency:
+                invoice.foreign_currency_display = EU_CURRENCIES[cc]
+
+                if settings.FETCH_ECB_RATES:
+                    gs = GlobalSettingsObject()
+                    rates_date = gs.settings.get('ecb_rates_date', as_type=date)
+                    rates_dict = gs.settings.get('ecb_rates_dict', as_type=dict)
+                    convert = (
+                        rates_date and rates_dict and
+                        rates_date > (now() - timedelta(days=7)).date() and
+                        invoice.event.currency in rates_dict and
+                        invoice.foreign_currency_display in rates_dict
+                    )
+                    if convert:
+                        invoice.foreign_currency_rate = (
+                            Decimal(rates_dict[invoice.foreign_currency_display])
+                            / Decimal(rates_dict[invoice.event.currency])
+                        ).quantize(Decimal('0.0001'), ROUND_HALF_UP)
+                        invoice.foreign_currency_rate_date = rates_date
+
         except InvoiceAddress.DoesNotExist:
+            ia = None
             invoice.invoice_to = ""
 
         invoice.file = None
@@ -52,12 +91,15 @@ def build_invoice(invoice: Invoice) -> Invoice:
         invoice.lines.all().delete()
 
         positions = list(
-            invoice.order.positions.select_related('addon_to', 'item', 'variation').annotate(
+            invoice.order.positions.select_related('addon_to', 'item', 'tax_rule', 'variation').annotate(
                 addon_c=Count('addons')
             )
         )
+
+        reverse_charge = False
+
         positions.sort(key=lambda p: p.sort_key)
-        for p in positions:
+        for i, p in enumerate(positions):
             if not invoice.event.settings.invoice_include_free and p.price == Decimal('0.00') and not p.addon_c:
                 continue
 
@@ -67,17 +109,37 @@ def build_invoice(invoice: Invoice) -> Invoice:
             if p.addon_to_id:
                 desc = "  + " + desc
             InvoiceLine.objects.create(
-                invoice=invoice, description=desc,
+                position=i, invoice=invoice, description=desc,
                 gross_value=p.price, tax_value=p.tax_value,
-                tax_rate=p.tax_rate
+                tax_rate=p.tax_rate, tax_name=p.tax_rule.name if p.tax_rule else ''
             )
 
-        if invoice.order.payment_fee:
+            if p.tax_rule and p.tax_rule.is_reverse_charge(ia) and p.price and not p.tax_value:
+                reverse_charge = True
+
+        if reverse_charge:
+            if invoice.additional_text:
+                invoice.additional_text += "<br /><br />"
+            invoice.additional_text += pgettext(
+                "invoice",
+                "Reverse Charge: According to Article 194, 196 of Council Directive 2006/112/EEC, VAT liability "
+                "rests with the service recipient."
+            )
+            invoice.save()
+
+        offset = len(positions)
+        for i, fee in enumerate(invoice.order.fees.all()):
+            fee_title = _(fee.get_fee_type_display())
+            if fee.description:
+                fee_title += " - " + fee.description
             InvoiceLine.objects.create(
+                position=i + offset,
                 invoice=invoice,
-                description=_('Payment via {method}').format(method=str(payment_provider.verbose_name)),
-                gross_value=invoice.order.payment_fee, tax_value=invoice.order.payment_fee_tax_value,
-                tax_rate=invoice.order.payment_fee_tax_rate
+                description=fee_title,
+                gross_value=fee.value,
+                tax_value=fee.tax_value,
+                tax_rate=fee.tax_rate,
+                tax_name=fee.tax_rule.name if fee.tax_rule else ''
             )
 
         return invoice
@@ -135,6 +197,10 @@ def generate_invoice(order: Order):
     )
     invoice = build_invoice(invoice)
     invoice_pdf(invoice.pk)
+
+    if order.status in (Order.STATUS_CANCELED, Order.STATUS_REFUNDED):
+        generate_cancellation(invoice)
+
     return invoice
 
 
@@ -200,3 +266,20 @@ def build_preview_invoice_pdf(event):
             tax_rate=19
         )
         return event.invoice_renderer.generate(invoice)
+
+
+@receiver(signal=periodic_task)
+def fetch_ecb_rates(sender, **kwargs):
+    if not settings.FETCH_ECB_RATES:
+        return
+
+    gs = GlobalSettingsObject()
+    if gs.settings.ecb_rates_date == now().strftime("%Y-%m-%d"):
+        return
+
+    try:
+        date, rates = vat_moss.exchange_rates.fetch()
+        gs.settings.ecb_rates_date = date
+        gs.settings.ecb_rates_dict = json.dumps(rates, cls=DjangoJSONEncoder)
+    except urllib.error.URLError:
+        logger.exception('Could not retrieve rates from ECB')

src/pretix/base/services/mail.py

@@ -98,7 +98,7 @@ def mail(email: str, subject: str, template: Union[str, LazyI18nString],
             htmlctx['event'] = event
             htmlctx['color'] = event.settings.primary_color
 
-            if event.settings.mail_from == settings.DEFAULT_FROM_EMAIL and event.settings.contact_mail:
+            if event.settings.mail_from == settings.DEFAULT_FROM_EMAIL and event.settings.contact_mail and not headers.get('Reply-To'):
                 headers['Reply-To'] = event.settings.contact_mail
 
             prefix = event.settings.get('mail_prefix')
@@ -116,10 +116,10 @@ def mail(email: str, subject: str, template: Union[str, LazyI18nString],
                 body_plain += signature
                 body_plain += "\r\n\r\n-- \r\n"
 
-            body_plain += _(
-                "You are receiving this email because you placed an order for {event}."
-            ).format(event=event.name)
             if order:
+                body_plain += _(
+                    "You are receiving this email because you placed an order for {event}."
+                ).format(event=event.name)
                 htmlctx['order'] = order
                 body_plain += "\r\n"
                 body_plain += _(
@@ -141,9 +141,10 @@ def mail(email: str, subject: str, template: Union[str, LazyI18nString],
 
 @app.task
 def mail_send_task(to: List[str], subject: str, body: str, html: str, sender: str,
-                   event: int=None, headers: dict=None) -> bool:
-    email = EmailMultiAlternatives(subject, body, sender, to=to, headers=headers)
-    email.attach_alternative(inline_css(html), "text/html")
+                   event: int=None, headers: dict=None, bcc: List[str]=None) -> bool:
+    email = EmailMultiAlternatives(subject, body, sender, to=to, bcc=bcc, headers=headers)
+    if html is not None:
+        email.attach_alternative(inline_css(html), "text/html")
     if event:
         event = Event.objects.get(id=event)
         backend = event.get_mail_backend()
@@ -167,7 +168,7 @@ def render_mail(template, context):
         if context:
             body = body.format_map(TolerantDict(context))
         body_md = bleach.linkify(bleach.clean(markdown.markdown(body), tags=bleach.ALLOWED_TAGS + [
-            'p',
+            'p', 'pre'
         ]))
     else:
         tpl = get_template(template)

src/pretix/base/services/orders.py

@@ -23,7 +23,8 @@ from pretix.base.models import (
     User, Voucher,
 )
 from pretix.base.models.event import SubEvent
-from pretix.base.models.orders import CachedTicket, InvoiceAddress
+from pretix.base.models.orders import CachedTicket, InvoiceAddress, OrderFee
+from pretix.base.models.tax import TaxedPrice
 from pretix.base.payment import BasePaymentProvider
 from pretix.base.reldate import RelativeDateWrapper
 from pretix.base.services.async import ProfiledTask
@@ -33,7 +34,10 @@ from pretix.base.services.invoices import (
 from pretix.base.services.locking import LockTimeoutException
 from pretix.base.services.mail import SendMailException
 from pretix.base.services.pricing import get_price
-from pretix.base.signals import order_paid, order_placed, periodic_task
+from pretix.base.signals import (
+    allow_ticket_download, order_fee_calculation, order_paid, order_placed,
+    periodic_task,
+)
 from pretix.celery_app import app
 from pretix.multidomain.urlreverse import build_absolute_uri
 
@@ -236,7 +240,7 @@ def _check_date(event: Event, now_dt: datetime):
         raise OrderError(error_messages['ended'])
 
 
-def _check_positions(event: Event, now_dt: datetime, positions: List[CartPosition]):
+def _check_positions(event: Event, now_dt: datetime, positions: List[CartPosition], address: InvoiceAddress=None):
     err = None
     errargs = None
     _check_date(event, now_dt)
@@ -293,7 +297,7 @@ def _check_positions(event: Event, now_dt: datetime, positions: List[CartPositio
             continue
 
         price = get_price(cp.item, cp.variation, cp.voucher, cp.price, cp.subevent, custom_price_is_net=False,
-                          addon_to=cp.addon_to)
+                          addon_to=cp.addon_to, invoice_address=address)
 
         if price is False or len(quotas) == 0:
             err = err or error_messages['unavailable']
@@ -306,9 +310,10 @@ def _check_positions(event: Event, now_dt: datetime, positions: List[CartPositio
                 cp.delete()
                 continue
 
-        if price != cp.price and not (cp.item.free_price and cp.price > price):
+        if price.gross != cp.price and not (cp.item.free_price and cp.price > price.gross):
             positions[i] = cp
-            cp.price = price
+            cp.price = price.gross
+            cp.includes_tax = bool(price.rate)
             cp.save()
             err = err or error_messages['price_changed']
             continue
@@ -340,14 +345,28 @@ def _check_positions(event: Event, now_dt: datetime, positions: List[CartPositio
         raise OrderError(err, errargs)
 
 
+def _get_fees(positions: List[CartPosition], payment_provider: BasePaymentProvider, address: InvoiceAddress,
+              meta_info: dict, event: Event):
+    fees = []
+    total = sum([c.price for c in positions])
+    payment_fee = payment_provider.calculate_fee(total)
+    if payment_fee:
+        fees.append(OrderFee(fee_type=OrderFee.FEE_TYPE_PAYMENT, value=payment_fee,
+                             internal_type=payment_provider.identifier))
+
+    for recv, resp in order_fee_calculation.send(sender=event, invoice_address=address,
+                                                 meta_info=meta_info, posiitons=positions):
+        fees += resp
+    return fees
+
+
 def _create_order(event: Event, email: str, positions: List[CartPosition], now_dt: datetime,
-                  payment_provider: BasePaymentProvider, locale: str=None, address: int=None,
+                  payment_provider: BasePaymentProvider, locale: str=None, address: InvoiceAddress=None,
                   meta_info: dict=None):
     from datetime import time
 
-    total = sum([c.price for c in positions])
-    payment_fee = payment_provider.calculate_fee(total)
-    total += payment_fee
+    fees = _get_fees(positions, payment_provider, address, meta_info, event)
+    total = sum([c.price for c in positions]) + sum([c.value for c in fees])
 
     tz = pytz.timezone(event.settings.timezone)
     exp_by_date = now_dt.astimezone(tz) + timedelta(days=event.settings.get('payment_term_days', as_type=int))
@@ -385,24 +404,24 @@ def _create_order(event: Event, email: str, positions: List[CartPosition], now_d
             expires=expires,
             locale=locale,
             total=total,
-            payment_fee=payment_fee,
             payment_provider=payment_provider.identifier,
             meta_info=json.dumps(meta_info or {}),
         )
+
+        if address:
+            if address.order is not None:
+                address.pk = None
+            address.order = order
+            address.save()
+
+            order.save()
+
+        for fee in fees:
+            fee.order = order
+            fee._calculate_tax()
+            fee.save()
+
         OrderPosition.transform_cart_positions(positions, order)
-
-        if address is not None:
-            try:
-                addr = InvoiceAddress.objects.get(
-                    pk=address
-                )
-                if addr.order is not None:
-                    addr.pk = None
-                addr.order = order
-                addr.save()
-            except InvoiceAddress.DoesNotExist:
-                pass
-
         order.log_action('pretix.event.order.placed')
 
     order_placed.send(event, order=order)
@@ -417,6 +436,13 @@ def _perform_order(event: str, payment_provider: str, position_ids: List[str],
     if not pprov:
         raise OrderError(error_messages['internal'])
 
+    addr = None
+    if address is not None:
+        try:
+            addr = InvoiceAddress.objects.get(pk=address)
+        except InvoiceAddress.DoesNotExist:
+            pass
+
     with event.lock() as now_dt:
         positions = list(CartPosition.objects.filter(
             id__in=position_ids).select_related('item', 'variation', 'subevent'))
@@ -424,9 +450,9 @@ def _perform_order(event: str, payment_provider: str, position_ids: List[str],
             raise OrderError(error_messages['empty'])
         if len(position_ids) != len(positions):
             raise OrderError(error_messages['internal'])
-        _check_positions(event, now_dt, positions)
+        _check_positions(event, now_dt, positions, address=addr)
         order = _create_order(event, email, positions, now_dt, pprov,
-                              locale=locale, address=address, meta_info=meta_info)
+                              locale=locale, address=addr, meta_info=meta_info)
 
     if event.settings.get('invoice_generate') == 'True' and invoice_qualified(order):
         if not order.invoices.exists():
@@ -528,6 +554,43 @@ def send_expiry_warnings(sender, **kwargs):
                 logger.exception('Reminder email could not be sent')
 
 
+@receiver(signal=periodic_task)
+def send_download_reminders(sender, **kwargs):
+    today = now().replace(hour=0, minute=0, second=0, microsecond=0)
+
+    for e in Event.objects.filter(date_from__gte=today):
+        days = e.settings.get('mail_days_download_reminder', as_type=int)
+        if days is None:
+            continue
+
+        reminder_date = (e.date_from - timedelta(days=days)).replace(hour=0, minute=0, second=0, microsecond=0)
+
+        if now() < reminder_date:
+            continue
+        for o in e.orders.filter(status=Order.STATUS_PAID, download_reminder_sent=False):
+            if not all([r for rr, r in allow_ticket_download.send(e, order=o)]):
+                continue
+
+            o.download_reminder_sent = True
+            o.save()
+            email_template = e.settings.mail_text_download_reminder
+            email_context = {
+                'event': o.event.name,
+                'url': build_absolute_uri(o.event, 'presale:event.order', kwargs={
+                    'order': o.code,
+                    'secret': o.secret
+                }),
+            }
+            email_subject = _('Your ticket is ready for download: %(code)s') % {'code': o.code}
+            try:
+                o.send_mail(
+                    email_subject, email_template, email_context,
+                    'pretix.event.order.email.expire_warning_sent'
+                )
+            except SendMailException:
+                logger.exception('Reminder email could not be sent')
+
+
 class OrderChangeManager:
     error_messages = {
         'free_to_paid': _('You cannot change a free order to a paid order.'),
@@ -563,7 +626,8 @@ class OrderChangeManager:
         if (not variation and item.has_variations) or (variation and variation.item_id != item.pk):
             raise OrderError(self.error_messages['product_without_variation'])
 
-        price = get_price(item, variation, voucher=position.voucher, subevent=position.subevent)
+        price = get_price(item, variation, voucher=position.voucher, subevent=position.subevent,
+                          invoice_address=self._invoice_address)
 
         if price is None:  # NOQA
             raise OrderError(self.error_messages['product_invalid'])
@@ -573,16 +637,17 @@ class OrderChangeManager:
         if not new_quotas:
             raise OrderError(self.error_messages['quota_missing'])
 
-        if self.order.event.settings.invoice_include_free or price != Decimal('0.00') or position.price != Decimal('0.00'):
+        if self.order.event.settings.invoice_include_free or price.gross != Decimal('0.00') or position.price != Decimal('0.00'):
             self._invoice_dirty = True
 
-        self._totaldiff = price - position.price
+        self._totaldiff += price.gross - position.price
         self._quotadiff.update(new_quotas)
         self._quotadiff.subtract(position.quotas)
         self._operations.append(self.ItemOperation(position, item, variation, price))
 
     def change_subevent(self, position: OrderPosition, subevent: SubEvent):
-        price = get_price(position.item, position.variation, voucher=position.voucher, subevent=subevent)
+        price = get_price(position.item, position.variation, voucher=position.voucher, subevent=subevent,
+                          invoice_address=self._invoice_address)
 
         if price is None:  # NOQA
             raise OrderError(self.error_messages['product_invalid'])
@@ -592,24 +657,48 @@ class OrderChangeManager:
         if not new_quotas:
             raise OrderError(self.error_messages['quota_missing'])
 
-        if self.order.event.settings.invoice_include_free or price != Decimal('0.00') or position.price != Decimal('0.00'):
+        if self.order.event.settings.invoice_include_free or price.gross != Decimal('0.00') or position.price != Decimal('0.00'):
             self._invoice_dirty = True
 
-        self._totaldiff = price - position.price
+        self._totaldiff += price.gross - position.price
         self._quotadiff.update(new_quotas)
         self._quotadiff.subtract(position.quotas)
         self._operations.append(self.SubeventOperation(position, subevent, price))
 
     def change_price(self, position: OrderPosition, price: Decimal):
-        self._totaldiff = price - position.price
+        price = position.item.tax(price)
 
-        if self.order.event.settings.invoice_include_free or price != Decimal('0.00') or position.price != Decimal('0.00'):
+        self._totaldiff += price.gross - position.price
+
+        if self.order.event.settings.invoice_include_free or price.gross != Decimal('0.00') or position.price != Decimal('0.00'):
             self._invoice_dirty = True
 
         self._operations.append(self.PriceOperation(position, price))
 
+    def recalculate_taxes(self):
+        positions = self.order.positions.select_related('item', 'item__tax_rule')
+        ia = self._invoice_address
+        for pos in positions:
+            if not pos.item.tax_rule:
+                continue
+            if not pos.price:
+                continue
+
+            charge_tax = pos.item.tax_rule.tax_applicable(ia)
+            if pos.tax_value and not charge_tax:
+                net_price = pos.price - pos.tax_value
+                price = TaxedPrice(gross=net_price, net=net_price, tax=Decimal('0.00'), rate=Decimal('0.00'), name='')
+                if price.gross != pos.price:
+                    self._totaldiff += price.gross - pos.price
+                    self._operations.append(self.PriceOperation(pos, price))
+            elif charge_tax and not pos.tax_value:
+                price = pos.item.tax(pos.price, base_price_is='net')
+                if price.gross != pos.price:
+                    self._totaldiff += price.gross - pos.price
+                    self._operations.append(self.PriceOperation(pos, price))
+
     def cancel(self, position: OrderPosition):
-        self._totaldiff = -position.price
+        self._totaldiff += -position.price
         self._quotadiff.subtract(position.quotas)
         self._operations.append(self.CancelOperation(position))
 
@@ -619,7 +708,13 @@ class OrderChangeManager:
     def add_position(self, item: Item, variation: ItemVariation, price: Decimal, addon_to: Order = None,
                      subevent: SubEvent = None):
         if price is None:
-            price = get_price(item, variation, subevent=subevent)
+            price = get_price(item, variation, subevent=subevent, invoice_address=self._invoice_address)
+        else:
+            if item.tax_rule.tax_applicable(self._invoice_address):
+                price = item.tax(price, base_price_is='gross')
+            else:
+                price = TaxedPrice(gross=price, net=price, tax=Decimal('0.00'), rate=Decimal('0.00'), name='')
+
         if price is None:
             raise OrderError(self.error_messages['product_invalid'])
         if not addon_to and item.category and item.category.is_addon:
@@ -635,10 +730,10 @@ class OrderChangeManager:
         if not new_quotas:
             raise OrderError(self.error_messages['quota_missing'])
 
-        if self.order.event.settings.invoice_include_free or price != Decimal('0.00'):
+        if self.order.event.settings.invoice_include_free or price.gross != Decimal('0.00'):
             self._invoice_dirty = True
 
-        self._totaldiff = price
+        self._totaldiff += price.gross
         self._quotadiff.update(new_quotas)
         self._operations.append(self.AddOperation(item, variation, price, addon_to, subevent))
 
@@ -678,12 +773,14 @@ class OrderChangeManager:
                     'new_variation': op.variation.pk if op.variation else None,
                     'old_price': op.position.price,
                     'addon_to': op.position.addon_to_id,
-                    'new_price': op.price
+                    'new_price': op.price.gross
                 })
                 op.position.item = op.item
                 op.position.variation = op.variation
-                op.position.price = op.price
-                op.position._calculate_tax()
+                op.position.price = op.price.gross
+                op.position.tax_rate = op.price.rate
+                op.position.tax_value = op.price.tax
+                op.position.tax_rule = op.item.tax_rule
                 op.position.save()
             elif isinstance(op, self.SubeventOperation):
                 self.order.log_action('pretix.event.order.changed.subevent', user=self.user, data={
@@ -692,11 +789,13 @@ class OrderChangeManager:
                     'old_subevent': op.position.subevent.pk,
                     'new_subevent': op.subevent.pk,
                     'old_price': op.position.price,
-                    'new_price': op.price
+                    'new_price': op.price.gross
                 })
                 op.position.subevent = op.subevent
-                op.position.price = op.price
-                op.position._calculate_tax()
+                op.position.price = op.price.gross
+                op.position.tax_rate = op.price.rate
+                op.position.tax_value = op.price.tax
+                op.position.tax_rule = op.position.item.tax_rule
                 op.position.save()
             elif isinstance(op, self.PriceOperation):
                 self.order.log_action('pretix.event.order.changed.price', user=self.user, data={
@@ -704,10 +803,12 @@ class OrderChangeManager:
                     'positionid': op.position.positionid,
                     'old_price': op.position.price,
                     'addon_to': op.position.addon_to_id,
-                    'new_price': op.price
+                    'new_price': op.price.gross
                 })
-                op.position.price = op.price
-                op.position._calculate_tax()
+                op.position.price = op.price.gross
+                op.position.tax_rate = op.price.rate
+                op.position.tax_value = op.price.tax
+                op.position.tax_rule = op.position.item.tax_rule
                 op.position.save()
             elif isinstance(op, self.CancelOperation):
                 for opa in op.position.addons.all():
@@ -731,7 +832,8 @@ class OrderChangeManager:
             elif isinstance(op, self.AddOperation):
                 pos = OrderPosition.objects.create(
                     item=op.item, variation=op.variation, addon_to=op.addon_to,
-                    price=op.price, order=self.order,
+                    price=op.price.gross, order=self.order, tax_rate=op.price.rate,
+                    tax_value=op.price.tax, tax_rule=op.item.tax_rule,
                     positionid=nextposid, subevent=op.subevent
                 )
                 nextposid += 1
@@ -740,21 +842,27 @@ class OrderChangeManager:
                     'item': op.item.pk,
                     'variation': op.variation.pk if op.variation else None,
                     'addon_to': op.addon_to.pk if op.addon_to else None,
-                    'price': op.price,
+                    'price': op.price.gross,
                     'positionid': pos.positionid,
                     'subevent': op.subevent.pk if op.subevent else None,
                 })
 
     def _recalculate_total_and_payment_fee(self):
-        self.order.total = sum([p.price for p in self.order.positions.all()])
         payment_fee = Decimal('0.00')
         if self.order.total != 0:
             prov = self._get_payment_provider()
             if prov:
                 payment_fee = prov.calculate_fee(self.order.total)
-        self.order.payment_fee = payment_fee
-        self.order.total += payment_fee
-        self.order._calculate_tax()
+
+        if payment_fee:
+            fee = self.order.fees.get_or_create(fee_type=OrderFee.FEE_TYPE_PAYMENT, defaults={'value': 0})[0]
+            fee.value = payment_fee
+            fee._calculate_tax()
+            fee.save()
+        else:
+            self.order.fees.filter(fee_type=OrderFee.FEE_TYPE_PAYMENT).delete()
+
+        self.order.total = sum([p.price for p in self.order.positions.all()]) + sum([f.value for f in self.order.fees.all()])
         self.order.save()
 
     def _reissue_invoice(self):
@@ -768,6 +876,13 @@ class OrderChangeManager:
         if cancels == self.order.positions.count():
             raise OrderError(self.error_messages['complete_cancel'])
 
+    @property
+    def _invoice_address(self):
+        try:
+            return self.order.invoice_address
+        except InvoiceAddress.DoesNotExist:
+            return None
+
     def _notify_user(self):
         with language(self.order.locale):
             try:

src/pretix/base/services/pricing.py

@@ -1,21 +1,21 @@
 from decimal import Decimal
 
-from pretix.base.decimal import round_decimal
 from pretix.base.models import (
-    AbstractPosition, Item, ItemAddOn, ItemVariation, Voucher,
+    AbstractPosition, InvoiceAddress, Item, ItemAddOn, ItemVariation, Voucher,
 )
 from pretix.base.models.event import SubEvent
+from pretix.base.models.tax import TAXED_ZERO, TaxedPrice, TaxRule
 
 
 def get_price(item: Item, variation: ItemVariation = None,
               voucher: Voucher = None, custom_price: Decimal = None,
               subevent: SubEvent = None, custom_price_is_net: bool = False,
-              addon_to: AbstractPosition = None):
+              addon_to: AbstractPosition = None, invoice_address: InvoiceAddress = None) -> TaxedPrice:
     if addon_to:
         try:
             iao = addon_to.item.addons.get(addon_category_id=item.category_id)
             if iao.price_included:
-                return Decimal('0.00')
+                return TAXED_ZERO
         except ItemAddOn.DoesNotExist:
             pass
 
@@ -32,13 +32,31 @@ def get_price(item: Item, variation: ItemVariation = None,
     if voucher:
         price = voucher.calculate_price(price)
 
+    if item.tax_rule:
+        tax_rule = item.tax_rule
+    else:
+        tax_rule = TaxRule(
+            name='',
+            rate=Decimal('0.00'),
+            price_includes_tax=True,
+            eu_reverse_charge=False,
+        )
+    price = tax_rule.tax(price)
+
     if item.free_price and custom_price is not None and custom_price != "":
         if not isinstance(custom_price, Decimal):
             custom_price = Decimal(str(custom_price).replace(",", "."))
         if custom_price > 100000000:
             raise ValueError('price_too_high')
         if custom_price_is_net:
-            custom_price = round_decimal(custom_price * (100 + item.tax_rate) / 100)
-        price = max(custom_price, price)
+            price = tax_rule.tax(max(custom_price, price.net), base_price_is='net')
+        else:
+            price = tax_rule.tax(max(custom_price, price.gross), base_price_is='gross')
+
+    if invoice_address and not tax_rule.tax_applicable(invoice_address):
+        price.tax = Decimal('0.00')
+        price.rate = Decimal('0.00')
+        price.gross = price.net
+        price.name = ''
 
     return price

src/pretix/base/services/stats.py

@@ -6,6 +6,8 @@ from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.models import Event, Item, ItemCategory, Order, OrderPosition
 from pretix.base.models.event import SubEvent
+from pretix.base.models.orders import OrderFee
+from pretix.base.signals import order_fee_type_name
 
 
 class DummyObject:
@@ -157,33 +159,35 @@ def order_overview(event: Event, subevent: SubEvent=None) -> Tuple[List[Tuple[It
 
     # Payment fees
     payment_cat_obj = DummyObject()
-    payment_cat_obj.name = _('Payment method fees')
+    payment_cat_obj.name = _('Fees')
     payment_items = []
 
     if not subevent:
-        counters = event.orders.values('payment_provider', 'status').annotate(
-            cnt=Count('id'), payment_fee=Sum('payment_fee'), tax_value=Sum('payment_fee_tax_value')
-        ).order_by()
+        counters = OrderFee.objects.filter(
+            order__event=event
+        ).values(
+            'fee_type', 'internal_type', 'order__status'
+        ).annotate(cnt=Count('id'), value=Sum('value'), tax_value=Sum('tax_value')).order_by()
 
         num_canceled = {
-            o['payment_provider']: (o['cnt'], o['payment_fee'], o['payment_fee'] - o['tax_value'])
-            for o in counters if o['status'] == Order.STATUS_CANCELED
+            (o['fee_type'], o['internal_type']): (o['cnt'], o['value'], o['value'] - o['tax_value'])
+            for o in counters if o['order__status'] == Order.STATUS_CANCELED
         }
         num_refunded = {
-            o['payment_provider']: (o['cnt'], o['payment_fee'], o['payment_fee'] - o['tax_value'])
-            for o in counters if o['status'] == Order.STATUS_REFUNDED
+            (o['fee_type'], o['internal_type']): (o['cnt'], o['value'], o['value'] - o['tax_value'])
+            for o in counters if o['order__status'] == Order.STATUS_REFUNDED
         }
         num_pending = {
-            o['payment_provider']: (o['cnt'], o['payment_fee'], o['payment_fee'] - o['tax_value'])
-            for o in counters if o['status'] == Order.STATUS_PENDING
+            (o['fee_type'], o['internal_type']): (o['cnt'], o['value'], o['value'] - o['tax_value'])
+            for o in counters if o['order__status'] == Order.STATUS_PENDING
         }
         num_expired = {
-            o['payment_provider']: (o['cnt'], o['payment_fee'], o['payment_fee'] - o['tax_value'])
-            for o in counters if o['status'] == Order.STATUS_EXPIRED
+            (o['fee_type'], o['internal_type']): (o['cnt'], o['value'], o['value'] - o['tax_value'])
+            for o in counters if o['order__status'] == Order.STATUS_EXPIRED
         }
         num_paid = {
-            o['payment_provider']: (o['cnt'], o['payment_fee'], o['payment_fee'] - o['tax_value'])
-            for o in counters if o['status'] == Order.STATUS_PAID
+            (o['fee_type'], o['internal_type']): (o['cnt'], o['value'], o['value'] - o['tax_value'])
+            for o in counters if o['order__status'] == Order.STATUS_PAID
         }
         num_total = dictsum(num_pending, num_paid)
 
@@ -191,11 +195,21 @@ def order_overview(event: Event, subevent: SubEvent=None) -> Tuple[List[Tuple[It
             k: v.verbose_name
             for k, v in event.get_payment_providers().items()
         }
+        names = dict(OrderFee.FEE_TYPES)
 
-        for pprov, total in num_total.items():
+        for pprov, total in sorted(num_total.items(), key=lambda i: i[0]):
             ppobj = DummyObject()
-            ppobj.name = provider_names.get(pprov, pprov)
-            ppobj.provider = pprov
+            if pprov[0] == OrderFee.FEE_TYPE_PAYMENT:
+                ppobj.name = '{} - {}'.format(names[pprov[0]], provider_names.get(pprov[1], pprov[1]))
+            else:
+                name = pprov[1]
+                for r, resp in order_fee_type_name.send(sender=event, fee_type=pprov[0], internal_type=pprov[1]):
+                    if resp:
+                        name = resp
+                        break
+
+                ppobj.name = '{} - {}'.format(names[pprov[0]], name)
+            ppobj.provider = pprov[1]
             ppobj.has_variations = False
             ppobj.num_total = total
             ppobj.num_canceled = num_canceled.get(pprov, (0, 0, 0))

src/pretix/base/settings.py

@@ -1,4 +1,3 @@
-import decimal
 import json
 from datetime import datetime
 
@@ -10,6 +9,7 @@ from hierarkey.models import GlobalSettingsBase, Hierarkey
 from i18nfield.strings import LazyI18nString
 from typing import Any
 
+from pretix.base.models.tax import TaxRule
 from pretix.base.reldate import RelativeDateWrapper
 
 DEFAULTS = {
@@ -102,8 +102,8 @@ DEFAULTS = {
         'type': bool
     },
     'tax_rate_default': {
-        'default': '0.00',
-        'type': decimal.Decimal
+        'default': None,
+        'type': TaxRule
     },
     'invoice_generate': {
         'default': 'False',
@@ -209,6 +209,10 @@ DEFAULTS = {
         'default': None,
         'type': str
     },
+    'confirm_text': {
+        'default': None,
+        'type': str
+    },
     'mail_prefix': {
         'default': None,
         'type': str
@@ -360,6 +364,22 @@ Your {event} team"""))
 You can change your order details and view the status of your order at
 {url}
 
+Best regards,
+Your {event} team"""))
+    },
+    'mail_days_download_reminder': {
+        'type': int,
+        'default': None
+    },
+    'mail_text_download_reminder': {
+        'type': LazyI18nString,
+        'default': LazyI18nString.from_gettext(ugettext_noop("""Hello,
+
+you bought a ticket for {event}.
+
+If you did not do so already, you can download your ticket here:
+{url}
+
 Best regards,
 Your {event} team"""))
     },
@@ -395,6 +415,10 @@ Your {event} team"""))
         'default': '#8E44B3',
         'type': str
     },
+    'primary_font': {
+        'default': 'Open Sans',
+        'type': str
+    },
     'presale_css_file': {
         'default': None,
         'type': str

src/pretix/base/signals.py

@@ -166,6 +166,34 @@ to the user. The receivers are expected to return plain text.
 As with all event-plugin signals, the ``sender`` keyword argument will contain the event.
 """
 
+logentry_object_link = EventPluginSignal(
+    providing_args=["logentry"]
+)
+"""
+To display the relationship of an instance of the ``LogEntry`` model to another model
+to a human user, ``pretix.base.signals.logentry_object_link`` will be sent out with a
+``logentry`` argument.
+
+The first received response that is not ``None`` will be used to display the related object
+to the user. The receivers are expected to return a HTML link. The internal implementation
+builds the links like this::
+
+    a_text = _('Tax rule {val}')
+    a_map = {
+        'href': reverse('control:event.settings.tax.edit', kwargs={
+            'event': sender.slug,
+            'organizer': sender.organizer.slug,
+            'rule': logentry.content_object.id
+        }),
+        'val': escape(logentry.content_object.name),
+    }
+    a_map['val'] = '<a href="{href}">{val}</a>'.format_map(a_map)
+    return a_text.format_map(a_map)
+
+Make sure that any user content in the HTML code you return is properly escaped!
+As with all event-plugin signals, the ``sender`` keyword argument will contain the event.
+"""
+
 requiredaction_display = EventPluginSignal(
     providing_args=["action", "request"]
 )
@@ -209,3 +237,37 @@ register_global_settings = django.dispatch.Signal()
 All plugins that are installed may send fields for the global settings form, as
 an OrderedDict of (setting name, form field).
 """
+
+order_fee_calculation = EventPluginSignal(
+    providing_args=['request']
+)
+"""
+This signals allows you to add fees to an order while it is being created. You are expected to
+return a list of ``OrderFee`` objects that are not yet saved to the database
+(because there is no order yet).
+
+As with all plugin signals, the ``sender`` keyword argument will contain the event. A ``positions``
+argument will contain the cart positions and ``invoice_address`` the invoice address (useful for
+tax calculation). The argument ``meta_info`` contains the order's meta dictionary.
+"""
+
+order_fee_type_name = EventPluginSignal(
+    providing_args=['request', 'fee']
+)
+"""
+This signals allows you to return a human-readable description for a fee type based on the ``fee_type``
+and ``internal_type`` attributes of the ``OrderFee`` model that you get as keyword arguments. You are
+expected to return a string or None, if you don't know about this fee.
+
+As with all plugin signals, the ``sender`` keyword argument will contain the event.
+"""
+
+allow_ticket_download = EventPluginSignal(
+    providing_args=['order']
+)
+"""
+This signal is sent out to check if tickets for an order can be downloaded. If any receiver returns false,
+a download will not be offered.
+
+As with all event-plugin signals, the ``sender`` keyword argument will contain the event.
+"""

src/pretix/base/templatetags/escapejson.py

@@ -0,0 +1,13 @@
+from django import template
+from django.template.defaultfilters import stringfilter
+
+from pretix.helpers.escapejson import escapejson
+
+register = template.Library()
+
+
+@register.filter("escapejson")
+@stringfilter
+def escapejs_filter(value):
+    """Hex encodes characters for use in a application/json type script."""
+    return escapejson(value)

src/pretix/base/templatetags/rich_text.py

@@ -1,6 +1,12 @@
+import urllib.parse
+
 import bleach
 import markdown
+from bleach import DEFAULT_CALLBACKS
 from django import template
+from django.core import signing
+from django.urls import reverse
+from django.utils.http import is_safe_url
 from django.utils.safestring import mark_safe
 
 register = template.Library()
@@ -48,6 +54,15 @@ ALLOWED_ATTRIBUTES = {
 }
 
 
+def safelink_callback(attrs, new=False):
+    url = attrs.get((None, 'href'), '/')
+    if not is_safe_url(url) and not url.startswith('mailto:'):
+        signer = signing.Signer(salt='safe-redirect')
+        attrs[None, 'href'] = reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))
+        attrs[None, 'target'] = '_blank'
+    return attrs
+
+
 @register.filter
 def rich_text(text: str, **kwargs):
     """
@@ -58,5 +73,5 @@ def rich_text(text: str, **kwargs):
         markdown.markdown(text),
         tags=ALLOWED_TAGS,
         attributes=ALLOWED_ATTRIBUTES,
-    ))
+    ), callbacks=DEFAULT_CALLBACKS + [safelink_callback])
     return mark_safe(body_md)

src/pretix/base/templatetags/safelink.py

@@ -1,5 +1,7 @@
 from django import template
 
+from pretix.helpers.safedownload import get_token
+
 from ..views.redirect import safelink as sl
 
 register = template.Library()
@@ -8,3 +10,8 @@ register = template.Library()
 @register.simple_tag
 def safelink(url):
     return sl(url)
+
+
+@register.simple_tag
+def answer_token(request, answer):
+    return get_token(request, answer)

src/pretix/base/validators.py

@@ -1,6 +1,42 @@
+import re
+
 from django.core.exceptions import ValidationError
+from django.core.validators import BaseValidator
 from django.utils.deconstruct import deconstructible
 from django.utils.translation import ugettext_lazy as _
+from i18nfield.strings import LazyI18nString
+
+
+class PlaceholderValidator(BaseValidator):
+    """
+    Takes list of allowed placeholders,
+    validates form field by checking for placeholders,
+    which are not presented in taken list.
+    """
+
+    def __init__(self, limit_value):
+        super().__init__(limit_value)
+        self.limit_value = limit_value
+
+    def __call__(self, value):
+        if isinstance(value, LazyI18nString):
+            for l, v in value.data.items():
+                self.__call__(v)
+            return
+
+        data_placeholders = list(re.findall(r'({[\w\s]*})', value, re.X))
+        invalid_placeholders = []
+        for placeholder in data_placeholders:
+            if placeholder not in self.limit_value:
+                invalid_placeholders.append(placeholder)
+        if invalid_placeholders:
+            raise ValidationError(
+                _('Invalid placeholder(s): %(value)s'),
+                code='invalid',
+                params={'value': ", ".join(invalid_placeholders,)})
+
+    def clean(self, x):
+        return x
 
 
 class BlacklistValidator:
@@ -32,6 +68,7 @@ class EventSlugBlacklistValidator(BlacklistValidator):
         '__debug__',
         'api',
         'events',
+        'csp_report',
     ]
 
 
@@ -51,4 +88,5 @@ class OrganizerSlugBlacklistValidator(BlacklistValidator):
         '__debug__',
         'about',
         'api',
+        'csp_report',
     ]

src/pretix/base/views/async.py

@@ -19,11 +19,11 @@ class AsyncAction:
     error_url = None
     known_errortypes = []
 
-    def do(self, *args):
+    def do(self, *args, **kwargs):
         if not isinstance(self.task, app.Task):
             raise TypeError('Method has no task attached')
 
-        res = self.task.apply_async(args=args)
+        res = self.task.apply_async(args=args, kwargs=kwargs)
 
         if 'ajax' in self.request.GET or 'ajax' in self.request.POST:
             data = self._return_ajax_result(res)

src/pretix/base/views/csp.py

@@ -0,0 +1,24 @@
+import json
+import logging
+
+from django.http import HttpResponse, HttpResponseBadRequest
+from django.views.decorators.csrf import csrf_exempt
+
+logger = logging.getLogger('pretix.security.csp')
+
+
+@csrf_exempt
+def csp_report(request):
+    try:
+        body = json.loads(request.body.decode())
+        logger.warning(
+            'CSP violation at {r[document-uri]}\n'
+            'Referer: {r[referrer]}\n'
+            'Blocked: {r[blocked-uri]}\n'
+            'Violated: {r[violated-directive]}\n'
+            'Original polity: {r[original-policy]}'.format(r=body['csp-report'])
+        )
+    except (ValueError, KeyError) as e:
+        logger.exception('CSP report failed ' + str(e))
+        return HttpResponseBadRequest()
+    return HttpResponse()

src/pretix/control/forms/event.py

@@ -8,11 +8,15 @@ from django.utils.translation import ugettext_lazy as _
 from i18nfield.forms import I18nFormField, I18nTextarea
 from pytz import common_timezones, timezone
 
-from pretix.base.forms import I18nModelForm, PlaceholderValidator, SettingsForm
-from pretix.base.models import Event, Organizer
+from pretix.base.forms import I18nModelForm, SettingsForm
+from pretix.base.models import Event, Organizer, TaxRule
+from pretix.base.models.event import EventMetaValue
 from pretix.base.reldate import RelativeDateField, RelativeDateTimeField
+from pretix.base.validators import PlaceholderValidator
 from pretix.control.forms import ExtFileField, SlugWidget
 from pretix.multidomain.urlreverse import build_absolute_uri
+from pretix.presale.style import get_fonts
+from pretix.base import email
 
 
 class EventWizardFoundationForm(forms.Form):
@@ -58,6 +62,13 @@ class EventWizardBasicsForm(I18nModelForm):
         choices=settings.LANGUAGES,
         label=_("Default language"),
     )
+    tax_rate = forms.DecimalField(
+        label=_("Sales tax rate"),
+        help_text=_("Do you need to pay sales tax on your tickets? In this case, please enter the applicable tax rate "
+                    "here in percent. If you have a more complicated tax situation, you can add more tax rates and "
+                    "detailled configuration later."),
+        required=False
+    )
 
     class Meta:
         model = Event
@@ -155,6 +166,22 @@ class EventWizardCopyForm(forms.Form):
         )
 
 
+class EventMetaValueForm(forms.ModelForm):
+
+    def __init__(self, *args, **kwargs):
+        self.property = kwargs.pop('property')
+        super().__init__(*args, **kwargs)
+        self.fields['value'].required = False
+        self.fields['value'].widget.attrs['placeholder'] = self.property.default
+
+    class Meta:
+        model = EventMetaValue
+        fields = ['value']
+        widgets = {
+            'value': forms.TextInput
+        }
+
+
 class EventUpdateForm(I18nModelForm):
     def clean_slug(self):
         return self.instance.slug
@@ -314,6 +341,14 @@ class EventSettingsForm(SettingsForm):
         label=_("Imprint URL"),
         required=False,
     )
+    confirm_text = forms.CharField(
+        label=_('Confirmation text'),
+        help_text=_('This text needs to be confirmed by the user before a purchase is possible. You could for example '
+                    'link your terms of service here. If you use the Pages feature to publish your terms of service, '
+                    'you don\'t need this setting since you can configure it there.'),
+        required=False,
+        widget=forms.Textarea(attrs={"rows": 3})
+    )
     contact_mail = forms.EmailField(
         label=_("Contact address"),
         required=False,
@@ -375,10 +410,12 @@ class PaymentSettingsForm(SettingsForm):
                     "configured above."),
         required=False
     )
-    tax_rate_default = forms.DecimalField(
-        label=_('Tax rate for payment fees'),
-        help_text=_("The tax rate that applies for additional fees you configured for single payment methods "
-                    "(in percent)."),
+    tax_rate_default = forms.ModelChoiceField(
+        queryset=TaxRule.objects.none(),
+        label=_('Tax rule for payment fees'),
+        required=False,
+        help_text=_("The tax rule that applies for additional fees you configured for single payment methods. This "
+                    "will set the tax rate and reverse charge rules, other settings of the tax rule are ignored.")
     )
 
     def clean(self):
@@ -392,6 +429,10 @@ class PaymentSettingsForm(SettingsForm):
                 )
         return cleaned_data
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['tax_rate_default'].queryset = self.obj.tax_rules.all()
+
 
 class ProviderForm(SettingsForm):
     """
@@ -541,7 +582,6 @@ class MailSettingsForm(SettingsForm):
         label=_("Sender address"),
         help_text=_("Sender address for outgoing emails")
     )
-
     mail_text_signature = I18nFormField(
         label=_("Signature"),
         required=False,
@@ -549,50 +589,29 @@ class MailSettingsForm(SettingsForm):
         help_text=_("This will be attached to every email. Available placeholders: {event}"),
         validators=[PlaceholderValidator(['{event}'])]
     )
-
-    mail_text_order_placed = I18nFormField(
+    mail_text_order_placed = email.mail_text_order_placed.formfield(
         label=_("Text"),
         required=False,
-        widget=I18nTextarea,
-        help_text=_("Available placeholders: {event}, {total}, {currency}, {date}, {payment_info}, {url}, "
-                    "{invoice_name}, {invoice_company}"),
-        validators=[PlaceholderValidator(['{event}', '{total}', '{currency}', '{date}', '{payment_info}',
-                                          '{url}', '{invoice_name}', '{invoice_company}'])]
     )
-    mail_text_order_paid = I18nFormField(
+    mail_text_order_paid = email.mail_text_order_paid.formfield(
         label=_("Text"),
         required=False,
-        widget=I18nTextarea,
-        help_text=_("Available placeholders: {event}, {url}, {invoice_name}, {invoice_company}, {payment_info}"),
-        validators=[PlaceholderValidator(['{event}', '{url}', '{invoice_name}', '{invoice_company}', '{payment_info}'])]
     )
-    mail_text_order_free = I18nFormField(
+    mail_text_order_free = email.mail_text_order_free.formfield(
         label=_("Text"),
         required=False,
-        widget=I18nTextarea,
-        help_text=_("Available placeholders: {event}, {url}, {invoice_name}, {invoice_company}"),
-        validators=[PlaceholderValidator(['{event}', '{url}', '{invoice_name}', '{invoice_company}'])]
     )
-    mail_text_order_changed = I18nFormField(
+    mail_text_order_changed = email.mail_text_order_changed.formfield(
         label=_("Text"),
         required=False,
-        widget=I18nTextarea,
-        help_text=_("Available placeholders: {event}, {url}, {invoice_name}, {invoice_company}"),
-        validators=[PlaceholderValidator(['{event}', '{url}', '{invoice_name}', '{invoice_company}'])]
     )
-    mail_text_resend_link = I18nFormField(
+    mail_text_resend_link = email.mail_text_resend_link.formfield(
         label=_("Text (sent by admin)"),
         required=False,
-        widget=I18nTextarea,
-        help_text=_("Available placeholders: {event}, {url}, {invoice_name}, {invoice_company}"),
-        validators=[PlaceholderValidator(['{event}', '{url}', '{invoice_name}', '{invoice_company}'])]
     )
-    mail_text_resend_all_links = I18nFormField(
+    mail_text_resend_all_links = email.mail_text_resend_all_links.formfield(
         label=_("Text (requested by user)"),
         required=False,
-        widget=I18nTextarea,
-        help_text=_("Available placeholders: {event}, {orders}"),
-        validators=[PlaceholderValidator(['{event}', '{orders}'])]
     )
     mail_days_order_expire_warning = forms.IntegerField(
         label=_("Number of days"),
@@ -601,35 +620,32 @@ class MailSettingsForm(SettingsForm):
         help_text=_("This email will be sent out this many days before the order expires. If the "
                     "value is 0, the mail will never be sent.")
     )
-    mail_text_order_expire_warning = I18nFormField(
+    mail_text_order_expire_warning = email.mail_text_order_expire_warning.formfield(
         label=_("Text"),
         required=False,
-        widget=I18nTextarea,
-        help_text=_("Available placeholders: {event}, {url}, {expire_date}, {invoice_name}, {invoice_company}"),
-        validators=[PlaceholderValidator(['{event}', '{url}', '{expire_date}', '{invoice_name}', '{invoice_company}'])]
     )
-    mail_text_waiting_list = I18nFormField(
+    mail_text_waiting_list = email.mail_text_waiting_list.formfield(
         label=_("Text"),
         required=False,
-        widget=I18nTextarea,
-        help_text=_("Available placeholders: {event}, {url}, {product}, {hours}, {code}"),
-        validators=[PlaceholderValidator(['{event}', '{url}', '{product}', '{hours}', '{code}'])]
     )
-    mail_text_order_canceled = I18nFormField(
+    mail_text_order_canceled = email.mail_text_order_canceled.formfield(
         label=_("Text"),
         required=False,
-        widget=I18nTextarea,
-        help_text=_("Available placeholders: {event}, {code}, {url}"),
-        validators=[PlaceholderValidator(['{event}', '{code}', '{url}'])]
     )
-    mail_text_order_custom_mail = I18nFormField(
+    mail_text_order_custom_mail = email.mail_text_order_custom_mail.formfield(
         label=_("Text"),
         required=False,
-        widget=I18nTextarea,
-        help_text=_("Available placeholders: {expire_date}, {event}, {code}, {date}, {url}, "
-                    "{invoice_name}, {invoice_company}"),
-        validators=[PlaceholderValidator(['{expire_date}', '{event}', '{code}', '{date}', '{url}',
-                                          '{invoice_name}', '{invoice_company}'])]
+    )
+    mail_text_download_reminder = email.mail_text_download_reminder.formfield(
+        label=_("Text"),
+        required=False,
+    )
+    mail_days_download_reminder = forms.IntegerField(
+        label=_("Number of days"),
+        required=False,
+        min_value=0,
+        help_text=_("This email will be sent out this many days before the order event starts. If the "
+                    "field is empty, the mail will never be sent.")
     )
     smtp_use_custom = forms.BooleanField(
         label=_("Use custom SMTP server"),
@@ -690,11 +706,18 @@ class DisplaySettingsForm(SettingsForm):
     )
     logo_image = ExtFileField(
         label=_('Logo image'),
-        ext_whitelist=(".png", ".jpg", ".svg", ".gif", ".jpeg"),
+        ext_whitelist=(".png", ".jpg", ".gif", ".jpeg"),
         required=False,
         help_text=_('If you provide a logo image, we will by default not show your events name and date '
                     'in the page header. We will show your logo with a maximal height of 120 pixels.')
     )
+    primary_font = forms.ChoiceField(
+        label=_('Font'),
+        choices=[
+            ('Open Sans', 'Open Sans')
+        ],
+        help_text=_('Only respected by modern browsers.')
+    )
     frontpage_text = I18nFormField(
         label=_("Frontpage text"),
         required=False,
@@ -705,6 +728,12 @@ class DisplaySettingsForm(SettingsForm):
         required=False
     )
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['primary_font'].choices += [
+            (a, a) for a in get_fonts()
+        ]
+
 
 class TicketSettingsForm(SettingsForm):
     ticket_download = forms.BooleanField(
@@ -763,3 +792,9 @@ class CommentForm(I18nModelForm):
                 'class': 'helper-width-100',
             }),
         }
+
+
+class TaxRuleForm(I18nModelForm):
+    class Meta:
+        model = TaxRule
+        fields = ['name', 'rate', 'price_includes_tax', 'eu_reverse_charge', 'home_country']

src/pretix/control/forms/filter.py

@@ -1,15 +1,17 @@
 from django import forms
-from django.db.models import Q
+from django.db.models import Exists, OuterRef, Q
 from django.db.models.functions import Concat
 from django.utils.timezone import now
 from django.utils.translation import pgettext_lazy, ugettext_lazy as _
 
-from pretix.base.models import Item, Order, Organizer, SubEvent
+from pretix.base.models import Invoice, Item, Order, Organizer, SubEvent
 from pretix.base.signals import register_payment_providers
 from pretix.control.utils.i18n import i18ncomp
 
 
 class FilterForm(forms.Form):
+    orders = {}
+
     def filter_qs(self, qs):
         return qs
 
@@ -17,6 +19,13 @@ class FilterForm(forms.Form):
     def filtered(self):
         return self.is_valid() and any(self.cleaned_data.values())
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.fields['ordering'] = forms.ChoiceField(
+            choices=sum([[(a, b), ('-' + a, '-' + b)] for a, b in self.orders.items()], []),
+            required=False
+        )
+
 
 class OrderFilterForm(FilterForm):
     query = forms.CharField(
@@ -53,7 +62,18 @@ class OrderFilterForm(FilterForm):
                         & Q(code__icontains=Order.normalize_code(u.split("-")[1])))
             else:
                 code = Q(code__icontains=Order.normalize_code(u))
-            qs = qs.annotate(inr=Concat('invoices__prefix', 'invoices__invoice_no'))
+
+            matching_invoice = Invoice.objects.filter(
+                order=OuterRef('pk'),
+            ).annotate(
+                inr=Concat('prefix', 'invoice_no')
+            ).filter(
+                Q(invoice_no__iexact=u)
+                | Q(invoice_no__iexact=u.zfill(5))
+                | Q(inr=u)
+            )
+
+            qs = qs.annotate(has_inv=Exists(matching_invoice))
             qs = qs.filter(
                 code
                 | Q(email__icontains=u)
@@ -61,9 +81,7 @@ class OrderFilterForm(FilterForm):
                 | Q(positions__attendee_email__icontains=u)
                 | Q(invoice_address__name__icontains=u)
                 | Q(invoice_address__company__icontains=u)
-                | Q(invoices__invoice_no=u)
-                | Q(invoices__invoice_no=u.zfill(5))
-                | Q(inr=u)
+                | Q(has_inv=True)
             )
 
         if fdata.get('status'):
@@ -75,10 +93,16 @@ class OrderFilterForm(FilterForm):
             else:
                 qs = qs.filter(status=s)
 
+        if fdata.get('ordering'):
+            qs = qs.order_by(dict(self.fields['ordering'].choices)[fdata.get('ordering')])
+
         return qs
 
 
 class EventOrderFilterForm(OrderFilterForm):
+    orders = {'code': 'code', 'email': 'email', 'total': 'total',
+              'datetime': 'datetime', 'status': 'status', 'pcnt': 'pcnt'}
+
     item = forms.ModelChoiceField(
         label=_('Products'),
         queryset=Item.objects.none(),
@@ -139,6 +163,10 @@ class EventOrderFilterForm(OrderFilterForm):
 
 
 class OrderSearchFilterForm(OrderFilterForm):
+    orders = {'code': 'code', 'email': 'email', 'total': 'total',
+              'datetime': 'datetime', 'status': 'status', 'pcnt': 'pcnt',
+              'event': 'event'}
+
     organizer = forms.ModelChoiceField(
         label=_('Organizer'),
         queryset=Organizer.objects.none(),
@@ -167,6 +195,10 @@ class OrderSearchFilterForm(OrderFilterForm):
 
 
 class SubEventFilterForm(FilterForm):
+    orders = {
+        'date_from': 'date_from',
+        'active': 'active'
+    }
     status = forms.ChoiceField(
         label=_('Status'),
         choices=(
@@ -214,10 +246,20 @@ class SubEventFilterForm(FilterForm):
                 Q(name__icontains=i18ncomp(query)) | Q(location__icontains=query)
             )
 
+        if fdata.get('ordering'):
+            qs = qs.order_by(dict(self.fields['ordering'].choices)[fdata.get('ordering')])
+
         return qs
 
 
 class EventFilterForm(FilterForm):
+    orders = {
+        'slug': 'slug',
+        'organizer': 'organizer__name',
+        'date_from': 'order_from',
+        'date_to': 'order_to',
+        'live': 'live'
+    }
     status = forms.ChoiceField(
         label=_('Status'),
         choices=(
@@ -284,4 +326,7 @@ class EventFilterForm(FilterForm):
                 Q(name__icontains=i18ncomp(query)) | Q(slug__icontains=query)
             )
 
+        if fdata.get('ordering'):
+            qs = qs.order_by(dict(self.fields['ordering'].choices)[fdata.get('ordering')])
+
         return qs

src/pretix/control/forms/item.py

@@ -41,6 +41,7 @@ class QuestionForm(I18nModelForm):
         localized_fields = '__all__'
         fields = [
             'question',
+            'help_text',
             'type',
             'required',
             'items'
@@ -137,6 +138,8 @@ class ItemCreateForm(I18nModelForm):
         super().__init__(*args, **kwargs)
 
         self.fields['category'].queryset = self.instance.event.categories.all()
+        self.fields['tax_rule'].queryset = self.instance.event.tax_rules.all()
+        self.fields['tax_rule'].empty_label = _('No taxation')
         self.fields['copy_from'] = forms.ModelChoiceField(
             label=_("Copy product information"),
             queryset=self.event.items.all(),
@@ -191,11 +194,12 @@ class ItemCreateForm(I18nModelForm):
             self.instance.allow_cancel = self.cleaned_data['copy_from'].allow_cancel
             self.instance.min_per_order = self.cleaned_data['copy_from'].min_per_order
             self.instance.max_per_order = self.cleaned_data['copy_from'].max_per_order
+            self.instance.checkin_attention = self.cleaned_data['copy_from'].checkin_attention
             self.instance.position = (self.event.items.aggregate(p=Max('position'))['p'] or 0) + 1
 
         instance = super().save(*args, **kwargs)
 
-        if not self.event.has_subevents:
+        if not self.event.has_subevents and not self.cleaned_data.get('has_variations'):
             if self.cleaned_data.get('quota_option') == self.EXISTING and self.cleaned_data.get('quota_add_existing') is not None:
                 quota = self.cleaned_data.get('quota_add_existing')
                 quota.items.add(self.instance)
@@ -249,7 +253,7 @@ class ItemCreateForm(I18nModelForm):
             'category',
             'admission',
             'default_price',
-            'tax_rate',
+            'tax_rule',
             'allow_cancel'
         ]
 
@@ -258,6 +262,7 @@ class ItemUpdateForm(I18nModelForm):
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.fields['category'].queryset = self.instance.event.categories.all()
+        self.fields['tax_rule'].queryset = self.instance.event.tax_rules.all()
 
     class Meta:
         model = Item
@@ -271,7 +276,7 @@ class ItemUpdateForm(I18nModelForm):
             'picture',
             'default_price',
             'free_price',
-            'tax_rate',
+            'tax_rule',
             'available_from',
             'available_until',
             'require_voucher',
@@ -279,6 +284,7 @@ class ItemUpdateForm(I18nModelForm):
             'allow_cancel',
             'max_per_order',
             'min_per_order',
+            'checkin_attention'
         ]
         widgets = {
             'available_from': forms.DateTimeInput(attrs={'class': 'datetimepicker'}),

src/pretix/control/forms/orders.py

@@ -6,10 +6,14 @@ from django.utils.formats import localize
 from django.utils.timezone import now
 from django.utils.translation import pgettext_lazy, ugettext_lazy as _
 
-from pretix.base.forms import I18nModelForm, PlaceholderValidator
-from pretix.base.models import Item, ItemAddOn, Order, OrderPosition
+from pretix.base.email import mail_text_order_custom_mail
+from pretix.base.forms import I18nModelForm
+from pretix.base.models import (
+    InvoiceAddress, Item, ItemAddOn, Order, OrderPosition,
+)
 from pretix.base.models.event import SubEvent
 from pretix.base.services.pricing import get_price
+from pretix.base.validators import PlaceholderValidator
 
 
 class ExtendForm(I18nModelForm):
@@ -66,6 +70,22 @@ class SubEventChoiceField(forms.ModelChoiceField):
                                         p, self.instance.order.event.currency)
 
 
+class OtherOperationsForm(forms.Form):
+    recalculate_taxes = forms.BooleanField(
+        label=_('Re-calculate taxes'),
+        required=False,
+        help_text=_(
+            'This operation re-checks if taxes should be paid to the items due to e.g. configured reverse charge rules '
+            'and changes the prices and tax values accordingly. This is useful e.g. after an invoice address change. '
+            'Use with care and only if you need to. Note that rounding differences might occur in this procedure.'
+        )
+    )
+
+    def __init__(self, *args, **kwargs):
+        kwargs.pop('order')
+        super().__init__(*args, **kwargs)
+
+
 class OrderPositionAddForm(forms.Form):
     do = forms.BooleanField(
         label=_('Add a new product to the order'),
@@ -83,7 +103,7 @@ class OrderPositionAddForm(forms.Form):
         required=False,
         max_digits=10, decimal_places=2,
         label=_('Gross price'),
-        help_text=_("Keep empty for the product's default price")
+        help_text=_("Including taxes, if any. Keep empty for the product's default price")
     )
     subevent = forms.ModelChoiceField(
         SubEvent.objects.none(),
@@ -95,6 +115,12 @@ class OrderPositionAddForm(forms.Form):
     def __init__(self, *args, **kwargs):
         order = kwargs.pop('order')
         super().__init__(*args, **kwargs)
+
+        try:
+            ia = order.invoice_address
+        except InvoiceAddress.DoesNotExist:
+            ia = None
+
         choices = []
         for i in order.event.items.prefetch_related('variations').all():
             pname = str(i.name)
@@ -103,12 +129,12 @@ class OrderPositionAddForm(forms.Form):
             variations = list(i.variations.all())
             if variations:
                 for v in variations:
+                    p = get_price(i, v, invoice_address=ia)
                     choices.append(('%d-%d' % (i.pk, v.pk),
-                                    '%s – %s (%s %s)' % (pname, v.value, localize(v.price),
-                                                         order.event.currency)))
+                                    '%s – %s (%s %s)' % (pname, v.value, p, order.event.currency)))
             else:
-                choices.append((str(i.pk), '%s (%s %s)' % (pname, localize(i.default_price),
-                                                           order.event.currency)))
+                p = get_price(i, invoice_address=ia)
+                choices.append((str(i.pk), '%s (%s %s)' % (pname, p, order.event.currency)))
         self.fields['itemvar'].choices = choices
         if ItemAddOn.objects.filter(base_item__event=order.event).exists():
             self.fields['addon_to'].queryset = order.positions.filter(addon_to__isnull=True).select_related(
@@ -150,6 +176,12 @@ class OrderPositionChangeForm(forms.Form):
     def __init__(self, *args, **kwargs):
         instance = kwargs.pop('instance')
         initial = kwargs.get('initial', {})
+
+        try:
+            ia = instance.order.invoice_address
+        except InvoiceAddress.DoesNotExist:
+            ia = None
+
         if instance:
             try:
                 if instance.variation:
@@ -159,7 +191,10 @@ class OrderPositionChangeForm(forms.Form):
             except Item.DoesNotExist:
                 pass
 
-            initial['price'] = instance.price
+            if instance.item.tax_rule and not instance.item.tax_rule.price_includes_tax:
+                initial['price'] = instance.price - instance.tax_value
+            else:
+                initial['price'] = instance.price
         initial['subevent'] = instance.subevent
 
         kwargs['initial'] = initial
@@ -169,20 +204,24 @@ class OrderPositionChangeForm(forms.Form):
             self.fields['subevent'].queryset = instance.order.event.subevents.all()
         else:
             del self.fields['subevent']
+
         choices = []
         for i in instance.order.event.items.prefetch_related('variations').all():
             pname = str(i.name)
             if not i.is_available():
                 pname += ' ({})'.format(_('inactive'))
             variations = list(i.variations.all())
+
             if variations:
                 for v in variations:
-                    p = get_price(i, v, voucher=instance.voucher, subevent=instance.subevent)
+                    p = get_price(i, v, voucher=instance.voucher, subevent=instance.subevent,
+                                  invoice_address=ia)
                     choices.append(('%d-%d' % (i.pk, v.pk),
                                     '%s – %s (%s %s)' % (pname, v.value, localize(p),
                                                          instance.order.event.currency)))
             else:
-                p = get_price(i, None, voucher=instance.voucher, subevent=instance.subevent)
+                p = get_price(i, None, voucher=instance.voucher, subevent=instance.subevent,
+                              invoice_address=ia)
                 choices.append((str(i.pk), '%s (%s %s)' % (pname, localize(p),
                                                            instance.order.event.currency)))
         self.fields['itemvar'].choices = choices
@@ -232,13 +271,9 @@ class OrderMailForm(forms.Form):
             initial=order.email
         )
         self.fields['sendto'].widget.attrs['readonly'] = 'readonly'
-        self.fields['message'] = forms.CharField(
+        self.fields['message'] = mail_text_order_custom_mail.formfield(
             label=_("Message"),
             required=True,
             widget=forms.Textarea,
             initial=order.event.settings.mail_text_order_custom_mail.localize(order.locale),
-            help_text=_("Available placeholders: {expire_date}, {event}, {code}, {date}, {url}, "
-                        "{invoice_name}, {invoice_company}"),
-            validators=[PlaceholderValidator(['{expire_date}', '{event}', '{code}', '{date}', '{url}',
-                                              '{invoice_name}', '{invoice_company}'])]
         )

src/pretix/control/forms/organizer.py

@@ -71,6 +71,14 @@ class OrganizerUpdateForm(OrganizerForm):
         return instance
 
 
+class EventMetaPropertyForm(forms.ModelForm):
+    class Meta:
+        fields = ['name', 'default']
+        widgets = {
+            'default': forms.TextInput()
+        }
+
+
 class TeamForm(forms.ModelForm):
 
     def __init__(self, *args, **kwargs):
@@ -128,14 +136,14 @@ class OrganizerSettingsForm(SettingsForm):
 
     organizer_logo_image = ExtFileField(
         label=_('Logo image'),
-        ext_whitelist=(".png", ".jpg", ".svg", ".gif", ".jpeg"),
+        ext_whitelist=(".png", ".jpg", ".gif", ".jpeg"),
         required=False,
         help_text=_('If you provide a logo image, we will by default not show your organization name '
                     'in the page header. We will show your logo with a maximal height of 120 pixels.')
     )
 
     event_list_type = forms.ChoiceField(
-        label=_('Event overview stile'),
+        label=_('Default overview style'),
         choices=(
             ('list', _('List')),
             ('calendar', _('Calendar'))

src/pretix/control/forms/subevents.py

@@ -3,7 +3,7 @@ from django.utils.functional import cached_property
 from i18nfield.forms import I18nInlineFormSet
 
 from pretix.base.forms import I18nModelForm
-from pretix.base.models.event import SubEvent
+from pretix.base.models.event import SubEvent, SubEventMetaValue
 from pretix.base.models.items import SubEventItem
 
 
@@ -99,3 +99,20 @@ class QuotaFormSet(I18nInlineFormSet):
         )
         self.add_fields(form, None)
         return form
+
+
+class SubEventMetaValueForm(forms.ModelForm):
+
+    def __init__(self, *args, **kwargs):
+        self.property = kwargs.pop('property')
+        self.default = kwargs.pop('default', None)
+        super().__init__(*args, **kwargs)
+        self.fields['value'].required = False
+        self.fields['value'].widget.attrs['placeholder'] = self.default or self.property.default
+
+    class Meta:
+        model = SubEventMetaValue
+        fields = ['value']
+        widgets = {
+            'value': forms.TextInput
+        }

src/pretix/control/forms/vouchers.py

@@ -8,6 +8,7 @@ from django.utils.translation import pgettext_lazy, ugettext_lazy as _
 
 from pretix.base.forms import I18nModelForm
 from pretix.base.models import Item, ItemVariation, Quota, Voucher
+from pretix.control.signals import voucher_form_validation
 
 
 class VoucherForm(I18nModelForm):
@@ -121,6 +122,8 @@ class VoucherForm(I18nModelForm):
         if 'code' in data and Voucher.objects.filter(Q(code=data['code']) & Q(event=self.instance.event) & ~Q(pk=self.instance.pk)).exists():
             raise ValidationError(_('A voucher with this code already exists.'))
 
+        voucher_form_validation.send(sender=self.instance.event, form=self, data=data)
+
         return data
 
     def _clean_quota_needs_checking(self, data):
@@ -178,7 +181,7 @@ class VoucherForm(I18nModelForm):
                 return
             else:
                 avail = self.instance.quota.availability()
-        elif self.instance.item.has_variations and not self.instance.variation:
+        elif self.instance.item and self.instance.item.has_variations and not self.instance.variation:
             raise ValidationError(_('You can only block quota if you specify a specific product variation. '
                                     'Otherwise it might be unclear which quotas to block.'))
         elif self.instance.item and self.instance.variation:

src/pretix/control/logdisplay.py

@@ -146,6 +146,9 @@ def pretixcontrol_logentry_display(sender: Event, logentry: LogEntry, **kwargs):
         'pretix.event.question.added': _('The question has been added.'),
         'pretix.event.question.deleted': _('The question has been deleted.'),
         'pretix.event.question.changed': _('The question has been modified.'),
+        'pretix.event.taxrule.added': _('The tax rule has been added.'),
+        'pretix.event.taxrule.deleted': _('The tax rule has been deleted.'),
+        'pretix.event.taxrule.changed': _('The tax rule has been changed.'),
         'pretix.event.settings': _('The event settings have been changed.'),
         'pretix.event.tickets.settings': _('The ticket download settings have been changed.'),
         'pretix.event.plugins.enabled': _('A plugin has been enabled.'),

src/pretix/control/middleware.py

@@ -1,8 +1,9 @@
-from urllib.parse import urljoin, urlparse
+import time
+from urllib.parse import quote, urljoin, urlparse
 
 from django.conf import settings
-from django.contrib.auth import REDIRECT_FIELD_NAME
-from django.core.urlresolvers import get_script_prefix, resolve
+from django.contrib.auth import REDIRECT_FIELD_NAME, logout
+from django.core.urlresolvers import get_script_prefix, resolve, reverse
 from django.http import Http404
 from django.shortcuts import redirect, resolve_url
 from django.utils.deprecation import MiddlewareMixin
@@ -28,6 +29,24 @@ class PermissionMiddleware(MiddlewareMixin):
         "auth.invite",
     )
 
+    def _login_redirect(self, request):
+        # Taken from django/contrib/auth/decorators.py
+        path = request.build_absolute_uri()
+        # urlparse chokes on lazy objects in Python 3, force to str
+        resolved_login_url = force_str(
+            resolve_url(settings.LOGIN_URL_CONTROL))
+        # If the login url is the same scheme and net location then just
+        # use the path as the "next" url.
+        login_scheme, login_netloc = urlparse(resolved_login_url)[:2]
+        current_scheme, current_netloc = urlparse(path)[:2]
+        if ((not login_scheme or login_scheme == current_scheme) and
+                (not login_netloc or login_netloc == current_netloc)):
+            path = request.get_full_path()
+        from django.contrib.auth.views import redirect_to_login
+
+        return redirect_to_login(
+            path, resolved_login_url, REDIRECT_FIELD_NAME)
+
     def process_request(self, request):
         url = resolve(request.path_info)
         url_name = url.url_name
@@ -42,22 +61,18 @@ class PermissionMiddleware(MiddlewareMixin):
         if url_name in self.EXCEPTIONS:
             return
         if not request.user.is_authenticated:
-            # Taken from django/contrib/auth/decorators.py
-            path = request.build_absolute_uri()
-            # urlparse chokes on lazy objects in Python 3, force to str
-            resolved_login_url = force_str(
-                resolve_url(settings.LOGIN_URL_CONTROL))
-            # If the login url is the same scheme and net location then just
-            # use the path as the "next" url.
-            login_scheme, login_netloc = urlparse(resolved_login_url)[:2]
-            current_scheme, current_netloc = urlparse(path)[:2]
-            if ((not login_scheme or login_scheme == current_scheme) and
-                    (not login_netloc or login_netloc == current_netloc)):
-                path = request.get_full_path()
-            from django.contrib.auth.views import redirect_to_login
+            return self._login_redirect(request)
 
-            return redirect_to_login(
-                path, resolved_login_url, REDIRECT_FIELD_NAME)
+        if not settings.PRETIX_LONG_SESSIONS or not request.session.get('pretix_auth_long_session', False):
+            last_used = request.session.get('pretix_auth_last_used', time.time())
+            if time.time() - request.session.get('pretix_auth_login_time', time.time()) > settings.PRETIX_SESSION_TIMEOUT_ABSOLUTE:
+                logout(request)
+                request.session['pretix_auth_login_time'] = 0
+                return self._login_redirect(request)
+            if time.time() - last_used > settings.PRETIX_SESSION_TIMEOUT_RELATIVE and url_name != 'user.reauth':
+                return redirect(reverse('control:user.reauth') + '?next=' + quote(request.get_full_path()))
+
+            request.session['pretix_auth_last_used'] = int(time.time())
 
         if 'event' in url.kwargs and 'organizer' in url.kwargs:
             request.event = Event.objects.filter(