Update cache handling

Translations update from Weblate

.dockerignore

@@ -1,3 +1,10 @@
 doc/
 env/
 res/
+local/
+.git/
+pretixeu/
+src/data/
+src/pretix/static.dist/
+src/dist/
+

deployment/docker/nginx.conf

@@ -1,10 +1,13 @@
 user www-data www-data;
-worker_processes 1;
+worker_processes auto;
 pid /var/run/nginx.pid;
 daemon off;
+worker_rlimit_nofile 262144;
 
 events {
-	worker_connections 4096;
+    worker_connections 16384;
+    multi_accept on;
+    use epoll;
 }
 
 http {

deployment/docker/pretix.bash

@@ -3,9 +3,10 @@ cd /pretix/src
 export DJANGO_SETTINGS_MODULE=production_settings
 export DATA_DIR=/data/
 export HOME=/pretix
-export NUM_WORKERS=$((2 * $(nproc --all)))
 
 AUTOMIGRATE=${AUTOMIGRATE:-yes}
+NUM_WORKERS_DEFAULT=$((2 * $(nproc --all)))
+export NUM_WORKERS=${NUM_WORKERS:-$NUM_WORKERS_DEFAULT}
 
 if [ ! -d /data/logs ]; then
     mkdir /data/logs;

doc/admin/config.rst

@@ -105,7 +105,12 @@ Example::
 
 ``csp_log``
     Log violations of the Content Security Policy (CSP). Defaults to ``on``.
-    
+
+``csp_additional_header``
+    Specifies a CSP header that will be **merged** with pretix's default header. For example, if you set this
+    to ``script-src https://mycdn.com``, pretix will add ``https://mycdn.com`` as an **additional** allowed source
+    to all CSP headers. Empty by default.
+
 ``loglevel``
     Set console and file log level (``DEBUG``, ``INFO``, ``WARNING``, ``ERROR`` or ``CRITICAL``). Defaults to ``INFO``.
 

doc/admin/installation/docker_smallscale.rst

@@ -135,7 +135,7 @@ Fill the configuration file ``/etc/pretix/pretix.cfg`` with the following conten
     user=pretix
     ; Replace with the password you chose above
     password=*********
-    ; In most docker setups, 172.17.0.1 is the address of the docker host. Adjuts
+    ; In most docker setups, 172.17.0.1 is the address of the docker host. Adjust
     ; this to wherever your database is running, e.g. the name of a linked container
     ; or of a mounted MySQL socket.
     host=172.17.0.1
@@ -295,7 +295,9 @@ on one machine after each upgrade manually, otherwise multiple containers might
 database schema at the same time.
 
 To run only the ``pretix-web`` component of pretix as well as a nginx server serving static files, you
-can invoke the container with ``docker run … pretix/standalone:stable web`` (instead of ``all``).
+can invoke the container with ``docker run … pretix/standalone:stable web`` (instead of ``all``). You
+can adjust the number of ``gunicorn`` processes with the ``NUM_WORKERS`` environment variable (defaults to
+two times the number of CPUs detected).
 
 To run only ``pretix-worker``, you can run ``docker run … pretix/standalone:stable taskworker``. You can
 also pass arguments to limit the worker to specific queues or to change the number of concurrent task

doc/api/resources/events.rst

@@ -47,6 +47,8 @@ item_meta_properties                  object                     Item-specific m
 valid_keys                            object                     Cryptographic keys for non-default signature schemes.
                                                                  For performance reason, value is omitted in lists and
                                                                  only contained in detail views. Value can be cached.
+sales_channels                        list                       A list of sales channels this event is available for
+                                                                 sale on.
 ===================================== ========================== =======================================================
 
 
@@ -91,6 +93,11 @@ valid_keys                            object                     Cryptographic k
 
    The attribute ``valid_keys`` has been added.
 
+.. versionchanged:: 3.14
+
+    The attribute ``sales_channels`` has been added.
+
+
 Endpoints
 ---------
 
@@ -147,11 +154,16 @@ Endpoints
             "timezone": "Europe/Berlin",
             "item_meta_properties": {},
             "plugins": [
-              "pretix.plugins.banktransfer"
+              "pretix.plugins.banktransfer",
-              "pretix.plugins.stripe"
+              "pretix.plugins.stripe",
-              "pretix.plugins.paypal"
+              "pretix.plugins.paypal",
               "pretix.plugins.ticketoutputpdf"
             ],
+            "sales_channels": [
+              "web",
+              "pretixpos",
+              "resellers"
+            ]
           }
         ]
       }
@@ -170,6 +182,7 @@ Endpoints
         only contain the events matching the set criteria. Providing ``?attr[Format]=Seminar`` would return only those
         events having set their ``Format`` meta data to ``Seminar``, ``?attr[Format]=`` only those, that have no value
         set. Please note that this filter will respect default values set on organizer level.
+   :query sales_channel: If set to a sales channel identifier, only events allowed to be sold on the specified sales channel are returned.
    :param organizer: The ``slug`` field of a valid organizer
    :statuscode 200: no error
    :statuscode 401: Authentication failure
@@ -219,16 +232,21 @@ Endpoints
         "timezone": "Europe/Berlin",
         "item_meta_properties": {},
         "plugins": [
-          "pretix.plugins.banktransfer"
+          "pretix.plugins.banktransfer",
-          "pretix.plugins.stripe"
+          "pretix.plugins.stripe",
-          "pretix.plugins.paypal"
+          "pretix.plugins.paypal",
           "pretix.plugins.ticketoutputpdf"
         ],
         "valid_keys": {
           "pretix_sig1": [
             "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUNvd0JRWURLMlZ3QXlFQTdBRDcvdkZBMzNFc1k0ejJQSHI3aVpQc1o4bjVkaDBhalA4Z3l6Tm1tSXM9Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo="
           ]
-        }
+        },
+        "sales_channels": [
+          "web",
+          "pretixpos",
+          "resellers"
+        ]
       }
 
    :param organizer: The ``slug`` field of the organizer to fetch
@@ -279,6 +297,11 @@ Endpoints
         "plugins": [
           "pretix.plugins.stripe",
           "pretix.plugins.paypal"
+        ],
+        "sales_channels": [
+          "web",
+          "pretixpos",
+          "resellers"
         ]
       }
 
@@ -314,6 +337,11 @@ Endpoints
         "plugins": [
           "pretix.plugins.stripe",
           "pretix.plugins.paypal"
+        ],
+        "sales_channels": [
+          "web",
+          "pretixpos",
+          "resellers"
         ]
       }
 
@@ -369,6 +397,11 @@ Endpoints
         "plugins": [
           "pretix.plugins.stripe",
           "pretix.plugins.paypal"
+        ],
+        "sales_channels": [
+          "web",
+          "pretixpos",
+          "resellers"
         ]
       }
 
@@ -404,6 +437,11 @@ Endpoints
         "plugins": [
           "pretix.plugins.stripe",
           "pretix.plugins.paypal"
+        ],
+        "sales_channels": [
+          "web",
+          "pretixpos",
+          "resellers"
         ]
       }
 
@@ -473,6 +511,11 @@ Endpoints
           "pretix.plugins.stripe",
           "pretix.plugins.paypal",
           "pretix.plugins.pretixdroid"
+        ],
+        "sales_channels": [
+          "web",
+          "pretixpos",
+          "resellers"
         ]
       }
 

doc/api/resources/giftcards.rst

@@ -22,9 +22,28 @@ expires                               datetime                   Expiry date (or
 conditions                            string                     Special terms and conditions for this card (or ``null``)
 ===================================== ========================== =======================================================
 
+The gift card transaction resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal ID of the gift card transaction
+datetime                              datetime                   Creation date of the transaction
+value                                 money (string)             Transaction amount
+event                                 string                     Event slug, if the gift card was used in the web shop (or ``null``)
+order                                 string                     Order code, if the gift card was used in the web shop (or ``null``)
+text                                  string                     Custom text of the transaction (or ``null``)
+===================================== ========================== =======================================================
+
 Endpoints
 ---------
 
+.. versionadded:: 3.14
+
+   The transaction list endpoint was added.
+
 .. http:get:: /api/v1/organizers/(organizer)/giftcards/
 
    Returns a list of all gift cards issued by a given organizer.
@@ -250,3 +269,45 @@ Endpoints
    :statuscode 401: Authentication failure
    :statuscode 403: The requested organizer does not exist **or** you have no permission to change this resource.
    :statuscode 409: There is not sufficient credit on the gift card.
+
+.. http:get:: /api/v1/organizers/(organizer)/giftcards/(id)/transactions/
+
+   List all transactions of a gift card.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/giftcards/1/transactions/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 82,
+            "datetime": "2020-06-22T15:41:42.800534Z",
+            "value": "50.00",
+            "event": "democon",
+            "order": "FXQYW",
+            "text": null
+          }
+        ]
+      }
+
+   :param organizer: The ``slug`` field of the organizer to view
+   :param id: The ``id`` field of the gift card to view
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.

doc/api/resources/orders.rst

@@ -30,6 +30,7 @@ testmode                              boolean                    If ``true``, th
                                                                  test mode. Only orders in test mode can be deleted.
 secret                                string                     The secret contained in the link sent to the customer
 email                                 string                     The customer email address
+phone                                 string                     The customer phone number
 locale                                string                     The locale used for communication with this customer
 sales_channel                         string                     Channel this sale was created through, such as
                                                                  ``"web"``.
@@ -167,6 +168,10 @@ last_modified                         datetime                   Last modificati
 
    The ``subevent_before`` query parameter has been added.
 
+.. versionchanged:: 3.14
+
+   The ``phone`` attribute has been added.
+
 
 .. _order-position-resource:
 
@@ -372,6 +377,7 @@ List of all orders
             "secret": "k24fiuwvu8kxz3y1",
             "url": "https://test.pretix.eu/dummy/dummy/order/ABC12/k24fiuwvu8kxz3y1/",
             "email": "tester@example.org",
+            "phone": "+491234567",
             "locale": "en",
             "sales_channel": "web",
             "datetime": "2017-12-01T10:00:00Z",
@@ -539,6 +545,7 @@ Fetching individual orders
         "secret": "k24fiuwvu8kxz3y1",
         "url": "https://test.pretix.eu/dummy/dummy/order/ABC12/k24fiuwvu8kxz3y1/",
         "email": "tester@example.org",
+        "phone": "+491234567",
         "locale": "en",
         "sales_channel": "web",
         "datetime": "2017-12-01T10:00:00Z",
@@ -705,6 +712,8 @@ Updating order fields
 
    * ``email``
 
+   * ``phone``
+
    * ``checkin_attention``
 
    * ``locale``
@@ -940,9 +949,9 @@ Creating orders
         during order generation and is not respected automatically when the order changes later.)
 
    * ``force`` (optional). If set to ``true``, quotas will be ignored.
-   * ``send_mail`` (optional). If set to ``true``, the same emails will be sent as for a regular order, regardless of
+   * ``send_email`` (optional). If set to ``true``, the same emails will be sent as for a regular order, regardless of
      whether these emails are enabled for certain sales channels. Defaults to
-     ``false``.
+     ``false``. Used to be ``send_mail`` before pretix 3.14.
 
    If you want to use add-on products, you need to set the ``positionid`` fields of all positions manually
    to incrementing integers starting with ``1``. Then, you can reference one of these
@@ -1976,6 +1985,7 @@ Order payment endpoints
         "amount": "23.00",
         "payment_date": "2017-12-04T12:13:12Z",
         "info": {},
+        "send_email": false,
         "provider": "banktransfer"
       }
 

doc/api/resources/organizers.rst

@@ -90,3 +90,120 @@ Endpoints
    :statuscode 200: no error
    :statuscode 401: Authentication failure
    :statuscode 403: The requested organizer does not exist **or** you have no permission to view it.
+
+Organizer settings
+------------------
+
+pretix organizers and events have lots and lots of parameters of different types that are stored in a key-value store on our system.
+Since many of these settings depend on each other in complex ways, we can not give direct access to all of these
+settings through the API. However, we do expose many of the simple and useful flags through the API.
+
+Please note that the available settings flags change between pretix versions, and we do not give a guarantee on backwards-compatibility like with other parts of the API.
+Therefore, we're also not including a list of the options here, but instead recommend to look at the endpoint output
+to see available options. The ``explain=true`` flag enables a verbose mode that provides you with human-readable
+information about the properties.
+
+.. note:: Please note that this is not a complete representation of all organizer settings. You will find more settings
+          in the web interface.
+
+.. warning:: This API is intended for advanced users. Even though we take care to validate your input, you will be
+             able to break your shops using this API by creating situations of conflicting settings. Please take care.
+
+.. versionchanged:: 3.14
+
+   Initial support for settings has been added to the API.
+
+.. http:get:: /api/v1/organizers/(organizer)/settings/
+
+   Get current values of organizer settings.
+
+   Permission required: "Can change organizer settings"
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/settings/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example standard response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "event_list_type": "calendar",
+        …
+      }
+
+   **Example verbose response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "event_list_type":
+          {
+            "value": "calendar",
+            "label": "Default overview style",
+            "help_text": "If your event series has more than 50 dates in the future, only the month or week calendar can be used."
+          }
+        },
+        …
+      }
+
+   :param organizer: The ``slug`` field of the organizer to access
+   :query explain: Set to ``true`` to enable verbose response mode
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+
+.. http:patch:: /api/v1/organizers/(organizer)/settings/
+
+   Updates organizer settings. Note that ``PUT`` is not allowed here, only ``PATCH``.
+
+    .. warning::
+
+       Settings can be stored at different levels in pretix. If a value is not set on organizer level, a default setting
+       from a higher level (global) will be returned. If you explicitly set a setting on organizer level, it
+       will no longer be inherited from the higher levels. Therefore, we recommend you to send only settings that you
+       explicitly want to set on organizer level. To unset a settings, pass ``null``.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      PATCH /api/v1/organizers/bigevents/settings/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+      {
+        "event_list_type": "calendar"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "event_list_type": "calendar",
+        …
+      }
+
+   :param organizer: The ``slug`` field of the organizer to update
+   :statuscode 200: no error
+   :statuscode 400: The organizer could not be updated due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to create this resource.

doc/api/resources/questions.rst

@@ -1,4 +1,7 @@
-.. spelling:: checkin
+.. spelling::
+
+   checkin
+   datetime
 
 .. _rest-questions:
 
@@ -53,6 +56,12 @@ options                               list of objects            In case of ques
 ├ identifier                          string                     An arbitrary string that can be used for matching with
                                                                  other sources.
 └ answer                              multi-lingual string       The displayed value of this option
+valid_number_min                      string                     Minimum value for number questions (optional)
+valid_number_max                      string                     Maximum value for number questions (optional)
+valid_date_min                        date                       Minimum value for date questions (optional)
+valid_date_max                        date                       Maximum value for date questions (optional)
+valid_datetime_min                    datetime                   Minimum value for date and time questions (optional)
+valid_datetime_max                    datetime                   Maximum value for date and time questions (optional)
 dependency_question                   integer                    Internal ID of a different question. The current
                                                                  question will only be shown if the question given in
                                                                  this attribute is set to the value given in
@@ -92,6 +101,10 @@ dependency_value                      string                     An old version
 
   The attribute ``help_text`` has been added.
 
+.. versionchanged:: 3.14
+
+  The attributes ``valid_*`` have been added.
+
 Endpoints
 ---------
 
@@ -137,6 +150,12 @@ Endpoints
             "ask_during_checkin": false,
             "hidden": false,
             "print_on_invoice": false,
+            "valid_number_min": null,
+            "valid_number_max": null,
+            "valid_date_min": null,
+            "valid_date_max": null,
+            "valid_datetime_min": null,
+            "valid_datetime_max": null,
             "dependency_question": null,
             "dependency_value": null,
             "dependency_values": [],
@@ -208,6 +227,12 @@ Endpoints
         "ask_during_checkin": false,
         "hidden": false,
         "print_on_invoice": false,
+        "valid_number_min": null,
+        "valid_number_max": null,
+        "valid_date_min": null,
+        "valid_date_max": null,
+        "valid_datetime_min": null,
+        "valid_datetime_max": null,
         "dependency_question": null,
         "dependency_value": null,
         "dependency_values": [],
@@ -302,6 +327,12 @@ Endpoints
         "dependency_question": null,
         "dependency_value": null,
         "dependency_values": [],
+        "valid_number_min": null,
+        "valid_number_max": null,
+        "valid_date_min": null,
+        "valid_date_max": null,
+        "valid_datetime_min": null,
+        "valid_datetime_max": null,
         "options": [
           {
             "id": 1,
@@ -377,6 +408,12 @@ Endpoints
         "dependency_question": null,
         "dependency_value": null,
         "dependency_values": [],
+        "valid_number_min": null,
+        "valid_number_max": null,
+        "valid_date_min": null,
+        "valid_date_max": null,
+        "valid_datetime_min": null,
+        "valid_datetime_max": null,
         "options": [
           {
             "id": 1,

doc/development/api/customview.rst

@@ -14,7 +14,9 @@ Control panel views
 -------------------
 
 If you want to add a custom view to the control area of an event, just register an URL in your
-``urls.py`` that lives in the ``/control/`` subpath::
+``urls.py`` that lives in the ``/control/`` subpath:
+
+.. code-block:: python
 
     from django.conf.urls import url
 
@@ -44,7 +46,9 @@ If only the ``organizer`` parameter is present, it will be ensured that:
 * The user has permission to access view the current organizer
 
 If you want to require specific permission types, we provide you with a decorator or a mixin for
-your views::
+your views:
+
+.. code-block:: python
 
     from pretix.control.permissions import (
         event_permission_required, EventPermissionRequiredMixin
@@ -61,8 +65,9 @@ your views::
         ...
 
 Similarly, there is ``organizer_permission_required`` and ``OrganizerPermissionRequiredMixin``. In case of
-event-related views, there is also a signal that allows you to add the view to the event navigation like this::
+event-related views, there is also a signal that allows you to add the view to the event navigation like this:
 
+.. code-block:: python
 
     from django.urls import resolve, reverse
     from django.dispatch import receiver
@@ -90,7 +95,9 @@ Event settings view
 -------------------
 
 A special case of a control panel view is a view hooked into the event settings page. For this case, there is a
-special navigation signal::
+special navigation signal:
+
+.. code-block:: python
 
     @receiver(nav_event_settings, dispatch_uid='friends_tickets_nav_settings')
     def navbar_settings(sender, request, **kwargs):
@@ -105,7 +112,9 @@ special navigation signal::
         }]
 
 Also, your view should inherit from ``EventSettingsViewMixin`` and your template from ``pretixcontrol/event/settings_base.html``
-for good integration. If you just want to display a form, you could do it like the following::
+for good integration. If you just want to display a form, you could do it like the following:
+
+.. code-block:: python
 
     class MySettingsView(EventSettingsViewMixin, EventSettingsFormView):
         model = Event
@@ -147,7 +156,9 @@ Including a custom view into the participant-facing frontend is a little bit dif
 no path prefix like ``control/``.
 
 First, define your URL in your ``urls.py``, but this time in the ``event_patterns`` section and wrapped by
-``event_url``::
+``event_url``:
+
+.. code-block:: python
 
     from pretix.multidomain import event_url
 
@@ -182,8 +193,9 @@ standard Django request handling: There are `ViewSets`_ to group related views i
 automatically build URL configurations from them.
 
 To integrate a custom viewset with pretix' REST API, you can just register with one of our routers within the
-``urls.py`` module of your plugin::
+``urls.py`` module of your plugin:
 
+.. code-block:: python
 
     from pretix.api.urls import event_router, router, orga_router
 
@@ -200,7 +212,9 @@ in the control panel. However, you need to make sure on your own only to return
 .event`` and ``request.organizer`` are available as usual.
 
 To require a special permission like ``can_view_orders``, you do not need to inherit from a special ViewSet base
-class, you can just set the ``permission`` attribute on your viewset::
+class, you can just set the ``permission`` attribute on your viewset:
+
+.. code-block:: python
 
     class MyViewSet(ModelViewSet):
         permission = 'can_view_orders'
@@ -208,8 +222,9 @@ class, you can just set the ``permission`` attribute on your viewset::
 
 If you want to check the permission only for some methods of your viewset, you have to do it yourself. Note here that
 API authentications can be done via user sessions or API tokens and you should therefore check something like the
-following::
+following:
 
+.. code-block:: python
 
     perm_holder = (request.auth if isinstance(request.auth, TeamAPIToken) else request.user)
     if perm_holder.has_event_permission(request.event.organizer, request.event, 'can_view_orders'):

doc/development/api/email.rst

@@ -15,7 +15,9 @@ Output registration
 The email HTML renderer API does not make a lot of usage from signals, however, it
 does use a signal to get a list of all available email renderers. Your plugin
 should listen for this signal and return the subclass of ``pretix.base.email.BaseHTMLMailRenderer``
-that we'll provide in this plugin::
+that we'll provide in this plugin:
+
+.. code-block:: python
 
     from django.dispatch import receiver
 
@@ -72,7 +74,9 @@ class ``TemplateBasedMailRenderer`` that you can re-use to perform the following
 * Call `inlinestyler`_ to convert all ``<style>`` style sheets to inline ``style=""``
   attributes for better compatibility
 
-To use it, you just need to implement some variables::
+To use it, you just need to implement some variables:
+
+.. code-block:: python
 
     class ClassicMailRenderer(TemplateBasedMailRenderer):
         verbose_name = _('pretix default')

doc/development/api/exporter.rst

@@ -17,7 +17,9 @@ Exporter registration
 The exporter API does not make a lot of usage from signals, however, it does use a signal to get a list of
 all available exporters. Your plugin should listen for this signal and return the subclass of
 ``pretix.base.exporter.BaseExporter``
-that we'll provide in this plugin::
+that we'll provide in this plugin:
+
+.. code-block:: python
 
     from django.dispatch import receiver
 
@@ -31,7 +33,9 @@ that we'll provide in this plugin::
 
 Some exporters might also prove to be useful, when provided on an organizer-level. In order to declare your
 exporter as capable of providing exports spanning multiple events, your plugin should listen for this signal
-and return the subclass of ``pretix.base.exporter.BaseExporter`` that we'll provide in this plugin::
+and return the subclass of ``pretix.base.exporter.BaseExporter`` that we'll provide in this plugin:
+
+.. code-block:: python
 
     from django.dispatch import receiver
 

doc/development/api/invoice.rst

@@ -15,7 +15,9 @@ Output registration
 The invoice renderer API does not make a lot of usage from signals, however, it
 does use a signal to get a list of all available invoice renderers. Your plugin
 should listen for this signal and return the subclass of ``pretix.base.invoice.BaseInvoiceRenderer``
-that we'll provide in this plugin::
+that we'll provide in this plugin:
+
+.. code-block:: python
 
     from django.dispatch import receiver
 

doc/development/api/payment.rst

@@ -19,7 +19,9 @@ Provider registration
 The payment provider API does not make a lot of usage from signals, however, it
 does use a signal to get a list of all available payment providers. Your plugin
 should listen for this signal and return the subclass of ``pretix.base.payment.BasePaymentProvider``
-that the plugin will provide::
+that the plugin will provide:
+
+.. code-block:: python
 
     from django.dispatch import receiver
 
@@ -140,7 +142,9 @@ it is necessary to introduce additional views. One example is the PayPal
 provider. It redirects the user to a PayPal website in the
 :py:meth:`BasePaymentProvider.checkout_prepare` step of the checkout process
 and provides PayPal with a URL to redirect back to. This URL points to a
-view which looks roughly like this::
+view which looks roughly like this:
+
+.. code-block:: python
 
     @login_required
     def success(request):

doc/development/api/placeholder.rst

@@ -13,7 +13,9 @@ Placeholder registration
 
 The placeholder API does not make a lot of usage from signals, however, it
 does use a signal to get a list of all available email placeholders. Your plugin
-should listen for this signal and return an instance of a subclass of ``pretix.base.email.BaseMailTextPlaceholder``::
+should listen for this signal and return an instance of a subclass of ``pretix.base.email.BaseMailTextPlaceholder``:
+
+.. code-block:: python
 
     from django.dispatch import receiver
 
@@ -71,7 +73,9 @@ Helper class for simple placeholders
 ------------------------------------
 
 pretix ships with a helper class that makes it easy to provide placeholders based on simple
-functions::
+functions:
+
+.. code-block:: python
 
      placeholder = SimpleFunctionalMailTextPlaceholder(
          'code', ['order'], lambda order: order.code, sample='F8VVL'

doc/development/api/plugins.rst

@@ -55,7 +55,9 @@ restricted         boolean (optional)   ``False`` by default, restricts a plugin
 compatibility      string               Specifier for compatible pretix versions.
 ================== ==================== ===========================================================
 
-A working example would be::
+A working example would be:
+
+.. code-block:: python
 
     try:
         from pretix.base.plugins import PluginConfig
@@ -81,7 +83,7 @@ A working example would be::
 
     default_app_config = 'pretix_paypal.PaypalApp'
 
-The ``AppConfig`` class may implement a property ``compatiblity_errors``, that checks
+The ``AppConfig`` class may implement a property ``compatibility_errors``, that checks
 whether the pretix installation meets all requirements of the plugin. If so,
 it should contain ``None`` or an empty list, otherwise a list of strings containing
 human-readable error messages. We recommend using the ``django.utils.functional.cached_property``
@@ -96,7 +98,9 @@ Plugin registration
 
 Somehow, pretix needs to know that your plugin exists at all. For this purpose, we
 make use of the `entry point`_ feature of setuptools. To register a plugin that lives
-in a separate python package, your ``setup.py`` should contain something like this::
+in a separate python package, your ``setup.py`` should contain something like this:
+
+.. code-block:: python
 
     setup(
         args...,
@@ -118,7 +122,9 @@ The various components of pretix define a number of signals which your plugin ca
 listen for. We will go into the details of the different signals in the following
 pages. We suggest that you put your signal receivers into a ``signals`` submodule
 of your plugin. You should extend your ``AppConfig`` (see above) by the following
-method to make your receivers available::
+method to make your receivers available:
+
+.. code-block:: python
 
     class PaypalApp(AppConfig):
         …
@@ -127,7 +133,9 @@ method to make your receivers available::
             from . import signals  # NOQA
 
 You can optionally specify code that is executed when your plugin is activated for an event
-in the ``installed`` method::
+in the ``installed`` method:
+
+.. code-block:: python
 
     class PaypalApp(AppConfig):
         …

doc/development/api/shredder.rst

@@ -74,7 +74,7 @@ looks like this:
 
         def generate_files(self) -> List[Tuple[str, str, str]]:
             yield 'invoice-addresses.json', 'application/json', json.dumps({
-                ia.order.code: InvoiceAdddressSerializer(ia).data
+                ia.order.code: InvoiceAddressSerializer(ia).data
                 for ia in InvoiceAddress.objects.filter(order__event=self.event)
             }, indent=4)
 

doc/development/api/ticketoutput.rst

@@ -17,7 +17,9 @@ Output registration
 The ticket output API does not make a lot of usage from signals, however, it
 does use a signal to get a list of all available ticket outputs. Your plugin
 should listen for this signal and return the subclass of ``pretix.base.ticketoutput.BaseTicketOutput``
-that we'll provide in this plugin::
+that we'll provide in this plugin:
+
+.. code-block:: python
 
     from django.dispatch import receiver
 

doc/development/implementation/background.rst

@@ -12,7 +12,9 @@ Implementing a task
 -------------------
 
 A common pattern for implementing asynchronous tasks can be seen a lot in ``pretix.base.services``
-and looks like this::
+and looks like this:
+
+.. code-block:: python
 
     from pretix.celery_app import app
 
@@ -34,13 +36,15 @@ If your user needs to wait for the response of the asynchronous task, there are
 that will probably move to ``pretix.base`` at some point. They consist of the view mixin ``AsyncAction`` that allows
 you to easily write a view that kicks off and waits for an asynchronous task. ``AsyncAction`` will determine whether
 to run the task asynchronously or not and will do some magic to look nice for users with and without JavaScript support.
-A usage example taken directly from the code is::
+A usage example taken directly from the code is:
+
+.. code-block:: python
 
     class OrderCancelDo(EventViewMixin, OrderDetailMixin, AsyncAction, View):
         """
         A view that executes a task asynchronously. A POST request will kick off the
         task into the background or run it in the foreground if celery is not installed.
-        In the former case, subsequent GET calls can be used to determinine the current
+        In the former case, subsequent GET calls can be used to determine the current
         status of the task.
         """
 
@@ -79,7 +83,9 @@ A usage example taken directly from the code is::
             return super().get_error_message(exception)
 
 On the client side, this can be used by simply adding a ``data-asynctask`` attribute to an HTML form. This will enable
-AJAX sending of the form and display a loading indicator::
+AJAX sending of the form and display a loading indicator:
+
+.. code-block:: html
 
     <form method="post" data-asynctask
           action="{% eventurl request.event "presale:event.order.cancel.do" … %}">

doc/development/implementation/i18n.rst

@@ -27,7 +27,9 @@ numbers and dates, ``LazyDate`` and ``LazyNumber``. There also is a ``LazyLocale
 exceptions with gettext-localized exception messages.
 
 Last, but definitely not least, we have the ``language`` context manager (``pretix.base.i18n.language``) that allows
-you to execute a piece of code with a different locale::
+you to execute a piece of code with a different locale:
+
+.. code-block:: python
 
     with language('de'):
         render_mail_template()

doc/development/implementation/logging.rst

@@ -16,7 +16,9 @@ We recommend all relevant models to inherit from ``LoggedModel`` as it simplifie
 .. autoclass:: pretix.base.models.LoggedModel
    :members: log_action, all_logentries
 
-To actually log an action, you can just call the ``log_action`` method on your object::
+To actually log an action, you can just call the ``log_action`` method on your object:
+
+.. code-block:: python
 
    order.log_action('pretix.event.order.canceled', user=user, data={})
 
@@ -29,7 +31,9 @@ Logging form actions
 """"""""""""""""""""
 
 A very common use case is to log the changes to a model that have been done in a ``ModelForm``. In this case,
-we generally use a custom ``form_valid`` method on our ``FormView`` that looks like this::
+we generally use a custom ``form_valid`` method on our ``FormView`` that looks like this:
+
+.. code-block:: python
 
     @transaction.atomic
     def form_valid(self, form):
@@ -40,7 +44,9 @@ we generally use a custom ``form_valid`` method on our ``FormView`` that looks l
         messages.success(self.request, _('Your changes have been saved.'))
         return super().form_valid(form)
 
-It gets a little bit more complicated if your form allows file uploads::
+It gets a little bit more complicated if your form allows file uploads:
+
+.. code-block:: python
 
     @transaction.atomic
     def form_valid(self, form):
@@ -67,7 +73,9 @@ following ready-to-include template::
 
 We now need a way to translate the action codes like ``pretix.event.changed`` into human-readable
 strings. The :py:attr:`pretix.base.signals.logentry_display` signals allows you to do so. A simple
-implementation could look like::
+implementation could look like:
+
+.. code-block:: python
 
     from django.utils.translation import gettext as _
     from pretix.base.signals import logentry_display
@@ -88,7 +96,9 @@ Sending notifications
 
 If you think that the logged information might be important or urgent enough to send out a notification to interested
 organizers. In this case, you should listen for the :py:attr:`pretix.base.signals.register_notification_types` signal
-to register a notification type::
+to register a notification type:
+
+.. code-block:: python
 
     @receiver(register_notification_types)
     def register_my_notification_types(sender, **kwargs):
@@ -103,7 +113,9 @@ You should subclass the base ``NotificationType`` class and implement all its me
 .. autoclass:: pretix.base.notifications.NotificationType
    :members: action_type, verbose_name, required_permission, build_notification
 
-A simple implementation could look like this::
+A simple implementation could look like this:
+
+.. code-block:: python
 
     class MyNotificationType(NotificationType):
         required_permission = "can_view_orders"
@@ -143,7 +155,9 @@ Logging technical information
 -----------------------------
 
 If you just want to log technical information to a log file on disk that does not need to be parsed
-and displayed later, you can just use Python's ``logging`` module::
+and displayed later, you can just use Python's ``logging`` module:
+
+.. code-block:: python
 
    import logging
 
@@ -151,7 +165,9 @@ and displayed later, you can just use Python's ``logging`` module::
 
    logger.info('Startup complete.')
 
-This is also very useful to provide debugging information when an exception occurs::
+This is also very useful to provide debugging information when an exception occurs:
+
+.. code-block:: python
 
    try:
       foo()

doc/development/implementation/permissions.rst

@@ -15,7 +15,9 @@ Requiring permissions for a view
 --------------------------------
 
 pretix provides a number of useful mixins and decorators that allow you to specify that a user needs a certain
-permission level to access a view::
+permission level to access a view:
+
+.. code-block:: python
 
     from pretix.control.permissions import (
         OrganizerPermissionRequiredMixin, organizer_permission_required
@@ -44,7 +46,9 @@ permission level to access a view::
         # Only users with *any* permission on this organizer can access this
 
 
-Of course, the same is available on event level::
+Of course, the same is available on event level:
+
+.. code-block:: python
 
     from pretix.control.permissions import (
         EventPermissionRequiredMixin, event_permission_required
@@ -73,7 +77,9 @@ Of course, the same is available on event level::
         # Only users with *any* permission on this event can access this
 
 You can also require that this view is only accessible by system administrators with an active "admin session"
-(see below for what this means)::
+(see below for what this means):
+
+.. code-block:: python
 
     from pretix.control.permissions import (
         AdministratorPermissionRequiredMixin, administrator_permission_required
@@ -89,7 +95,9 @@ You can also require that this view is only accessible by system administrators
         # ...
 
 In rare cases it might also be useful to expose a feature only to people who have a staff account but do not
-necessarily have an active admin session::
+necessarily have an active admin session:
+
+.. code-block:: python
 
     from pretix.control.permissions import (
         StaffMemberRequiredMixin, staff_member_required

doc/development/implementation/settings.rst

@@ -39,7 +39,9 @@ subclass that also adds support for internationalized fields:
 
 .. autoclass:: pretix.base.forms.SettingsForm
 
-You can simply use it like this::
+You can simply use it like this:
+
+.. code-block:: python
 
    class EventSettingsForm(SettingsForm):
        show_date_to = forms.BooleanField(
@@ -56,7 +58,9 @@ You can simply use it like this::
 Defaults in plugins
 -------------------
 
-Plugins can add custom hardcoded defaults in the following way::
+Plugins can add custom hardcoded defaults in the following way:
+
+.. code-block:: python
 
     from pretix.base.settings import settings_hierarkey
 

src/Makefile

@@ -7,7 +7,7 @@ localecompile:
 
 localegen:
 	./manage.py makemessages --keep-pot --ignore "pretix/helpers/*" $(LNGS)
-	./manage.py makemessages --keep-pot -d djangojs --ignore "pretix/helpers/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static.dist/*" --ignore "data/*" --ignore "build/*" $(LNGS)
+	./manage.py makemessages --keep-pot -d djangojs --ignore "pretix/helpers/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static.dist/*" --ignore "data/*" --ignore "pretix/static/rrule/*" --ignore "build/*" $(LNGS)
 
 staticfiles: jsi18n
 	./manage.py collectstatic --noinput

src/pretix/__init__.py

@@ -1 +1 @@
-__version__ = "3.13.0"
+__version__ = "3.15.0.dev0"

src/pretix/api/auth/devicesecurity.py

@@ -102,6 +102,7 @@ class PretixPosSecurityProfile(AllowListSecurityProfile):
         ('DELETE', 'api-v1:cartposition-detail'),
         ('GET', 'api-v1:giftcard-list'),
         ('POST', 'api-v1:giftcard-transact'),
+        ('GET', 'plugins:pretix_posbackend:posclosing-list'),
         ('POST', 'plugins:pretix_posbackend:posreceipt-list'),
         ('POST', 'plugins:pretix_posbackend:posclosing-list'),
         ('POST', 'plugins:pretix_posbackend:posdebugdump-list'),

src/pretix/api/serializers/cart.py

@@ -87,7 +87,10 @@ class CartPositionCreateSerializer(I18nAwareModelSerializer):
                     raise ValidationError('The specified seat ID is not unique.')
                 else:
                     validated_data['seat'] = seat
-                    if not seat.is_available(sales_channel=validated_data.get('sales_channel', 'web')):
+                    if not seat.is_available(
+                        sales_channel=validated_data.get('sales_channel', 'web'),
+                        distance_ignore_cart_id=validated_data['cart_id'],
+                    ):
                         raise ValidationError(gettext_lazy('The selected seat "{seat}" is not available.').format(seat=seat.name))
             elif seated:
                 raise ValidationError('The specified product requires to choose a seat.')
@@ -104,6 +107,7 @@ class CartPositionCreateSerializer(I18nAwareModelSerializer):
     def validate_cart_id(self, cid):
         if cid and not cid.endswith('@api'):
             raise ValidationError('Cart ID should end in @api or be empty.')
+        return cid
 
     def validate_item(self, item):
         if item.event != self.context['event']:

src/pretix/api/serializers/event.py

@@ -17,7 +17,7 @@ from pretix.base.models.items import SubEventItem, SubEventItemVariation
 from pretix.base.services.seating import (
     SeatProtected, generate_seats, validate_plan_change,
 )
-from pretix.base.settings import DEFAULTS, validate_settings
+from pretix.base.settings import DEFAULTS, validate_event_settings
 from pretix.base.signals import api_event_settings_fields
 
 
@@ -124,7 +124,8 @@ class EventSerializer(I18nAwareModelSerializer):
         fields = ('name', 'slug', 'live', 'testmode', 'currency', 'date_from',
                   'date_to', 'date_admission', 'is_public', 'presale_start',
                   'presale_end', 'location', 'geo_lat', 'geo_lon', 'has_subevents', 'meta_data', 'seating_plan',
-                  'plugins', 'seat_category_mapping', 'timezone', 'item_meta_properties', 'valid_keys')
+                  'plugins', 'seat_category_mapping', 'timezone', 'item_meta_properties', 'valid_keys',
+                  'sales_channels')
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -573,6 +574,7 @@ class EventSettingsSerializer(serializers.Serializer):
         'presale_start_show_date',
         'locales',
         'locale',
+        'region',
         'last_order_modification_date',
         'show_quota_left',
         'waiting_list_enabled',
@@ -596,8 +598,12 @@ class EventSettingsSerializer(serializers.Serializer):
         'attendee_addresses_required',
         'attendee_company_asked',
         'attendee_company_required',
+        'attendee_data_explanation_text',
         'confirm_texts',
         'order_email_asked_twice',
+        'order_phone_asked',
+        'order_phone_required',
+        'checkout_phone_helptext',
         'payment_term_mode',
         'payment_term_days',
         'payment_term_weekdays',
@@ -606,6 +612,7 @@ class EventSettingsSerializer(serializers.Serializer):
         'payment_term_expire_automatically',
         'payment_term_accept_late',
         'payment_explanation',
+        'payment_pending_hidden',
         'ticket_download',
         'ticket_download_date',
         'ticket_download_addons',
@@ -661,10 +668,17 @@ class EventSettingsSerializer(serializers.Serializer):
         'change_allow_user_variation',
         'change_allow_user_until',
         'change_allow_user_price',
+        'primary_color',
+        'theme_color_success',
+        'theme_color_danger',
+        'theme_color_background',
+        'theme_round_borders',
+        'primary_font',
     ]
 
     def __init__(self, *args, **kwargs):
         self.event = kwargs.pop('event')
+        self.changed_data = []
         super().__init__(*args, **kwargs)
         for fname in self.default_fields:
             kwargs = DEFAULTS[fname].get('serializer_kwargs', {})
@@ -693,15 +707,17 @@ class EventSettingsSerializer(serializers.Serializer):
         for attr, value in validated_data.items():
             if value is None:
                 instance.delete(attr)
+                self.changed_data.append(attr)
             elif instance.get(attr, as_type=type(value)) != value:
                 instance.set(attr, value)
+                self.changed_data.append(attr)
         return instance
 
     def validate(self, data):
         data = super().validate(data)
         settings_dict = self.instance.freeze()
         settings_dict.update(data)
-        validate_settings(self.event, settings_dict)
+        validate_event_settings(self.event, settings_dict)
         return data
 
 

src/pretix/api/serializers/item.py

@@ -277,7 +277,9 @@ class QuestionSerializer(I18nAwareModelSerializer):
         model = Question
         fields = ('id', 'question', 'type', 'required', 'items', 'options', 'position',
                   'ask_during_checkin', 'identifier', 'dependency_question', 'dependency_values',
-                  'hidden', 'dependency_value', 'print_on_invoice', 'help_text')
+                  'hidden', 'dependency_value', 'print_on_invoice', 'help_text', 'valid_number_min',
+                  'valid_number_max', 'valid_date_min', 'valid_date_max', 'valid_datetime_min', 'valid_datetime_max'
+                  )
 
     def validate_identifier(self, value):
         Question._clean_identifier(self.context['event'], value, self.instance)

src/pretix/api/serializers/order.py

@@ -180,7 +180,7 @@ class PdfDataSerializer(serializers.Field):
         res = {}
 
         ev = instance.subevent or instance.order.event
-        with language(instance.order.locale):
+        with language(instance.order.locale, instance.order.event.settings.region):
             # This needs to have some extra performance improvements to avoid creating hundreds of queries when
             # we serialize a list.
 
@@ -361,7 +361,7 @@ class OrderSerializer(I18nAwareModelSerializer):
     class Meta:
         model = Order
         fields = (
-            'code', 'status', 'testmode', 'secret', 'email', 'locale', 'datetime', 'expires', 'payment_date',
+            'code', 'status', 'testmode', 'secret', 'email', 'phone', 'locale', 'datetime', 'expires', 'payment_date',
             'payment_provider', 'fees', 'total', 'comment', 'invoice_address', 'positions', 'downloads',
             'checkin_attention', 'last_modified', 'payments', 'refunds', 'require_approval', 'sales_channel',
             'url'
@@ -393,7 +393,7 @@ class OrderSerializer(I18nAwareModelSerializer):
     def update(self, instance, validated_data):
         # Even though all fields that shouldn't be edited are marked as read_only in the serializer
         # (hopefully), we'll be extra careful here and be explicit about the model fields we update.
-        update_fields = ['comment', 'checkin_attention', 'email', 'locale']
+        update_fields = ['comment', 'checkin_attention', 'email', 'locale', 'phone']
 
         if 'invoice_address' in validated_data:
             iadata = validated_data.pop('invoice_address')
@@ -682,7 +682,7 @@ class OrderCreateSerializer(I18nAwareModelSerializer):
     consume_carts = serializers.ListField(child=serializers.CharField(), required=False)
     force = serializers.BooleanField(default=False, required=False)
     payment_date = serializers.DateTimeField(required=False, allow_null=True)
-    send_mail = serializers.BooleanField(default=False, required=False)
+    send_email = serializers.BooleanField(default=False, required=False)
     simulate = serializers.BooleanField(default=False, required=False)
 
     def __init__(self, *args, **kwargs):
@@ -691,9 +691,9 @@ class OrderCreateSerializer(I18nAwareModelSerializer):
 
     class Meta:
         model = Order
-        fields = ('code', 'status', 'testmode', 'email', 'locale', 'payment_provider', 'fees', 'comment', 'sales_channel',
+        fields = ('code', 'status', 'testmode', 'email', 'phone', 'locale', 'payment_provider', 'fees', 'comment', 'sales_channel',
                   'invoice_address', 'positions', 'checkin_attention', 'payment_info', 'payment_date', 'consume_carts',
-                  'force', 'send_mail', 'simulate')
+                  'force', 'send_email', 'simulate')
 
     def validate_payment_provider(self, pp):
         if pp is None:
@@ -786,7 +786,7 @@ class OrderCreateSerializer(I18nAwareModelSerializer):
         payment_date = validated_data.pop('payment_date', now())
         force = validated_data.pop('force', False)
         simulate = validated_data.pop('simulate', False)
-        self._send_mail = validated_data.pop('send_mail', False)
+        self._send_mail = validated_data.pop('send_email', False)
 
         if 'invoice_address' in validated_data:
             iadata = validated_data.pop('invoice_address')

src/pretix/api/serializers/organizer.py

@@ -1,19 +1,22 @@
 from decimal import Decimal
 
 from django.db.models import Q
-from django.utils.translation import get_language, gettext_lazy as _
+from django.utils.translation import gettext_lazy as _
+from hierarkey.proxy import HierarkeyProxy
 from rest_framework import serializers
 from rest_framework.exceptions import ValidationError
 
 from pretix.api.serializers.i18n import I18nAwareModelSerializer
 from pretix.api.serializers.order import CompatibleJSONField
 from pretix.base.auth import get_auth_backends
+from pretix.base.i18n import get_language_without_region
 from pretix.base.models import (
-    Device, GiftCard, Organizer, SeatingPlan, Team, TeamAPIToken, TeamInvite,
+    Device, GiftCard, GiftCardTransaction, Organizer, SeatingPlan, Team,
-    User,
+    TeamAPIToken, TeamInvite, User,
 )
 from pretix.base.models.seating import SeatingPlanLayoutValidator
 from pretix.base.services.mail import SendMailException, mail
+from pretix.base.settings import DEFAULTS, validate_organizer_settings
 from pretix.helpers.urls import build_absolute_uri
 
 
@@ -59,6 +62,21 @@ class GiftCardSerializer(I18nAwareModelSerializer):
         fields = ('id', 'secret', 'issuance', 'value', 'currency', 'testmode', 'expires', 'conditions')
 
 
+class OrderEventSlugField(serializers.RelatedField):
+
+    def to_representation(self, obj):
+        return obj.event.slug
+
+
+class GiftCardTransactionSerializer(I18nAwareModelSerializer):
+    order = serializers.SlugRelatedField(slug_field='code', read_only=True)
+    event = OrderEventSlugField(source='order', read_only=True)
+
+    class Meta:
+        model = GiftCardTransaction
+        fields = ('id', 'datetime', 'value', 'event', 'order', 'text')
+
+
 class EventSlugField(serializers.SlugRelatedField):
     def get_queryset(self):
         return self.context['organizer'].events.all()
@@ -128,7 +146,7 @@ class TeamInviteSerializer(serializers.ModelSerializer):
                     })
                 },
                 event=None,
-                locale=get_language()  # TODO: expose?
+                locale=get_language_without_region()  # TODO: expose?
             )
         except SendMailException:
             pass  # Already logged
@@ -187,3 +205,64 @@ class TeamMemberSerializer(serializers.ModelSerializer):
         fields = (
             'id', 'email', 'fullname', 'require_2fa'
         )
+
+
+class OrganizerSettingsSerializer(serializers.Serializer):
+    default_fields = [
+        'organizer_info_text',
+        'event_list_type',
+        'event_list_availability',
+        'organizer_homepage_text',
+        'organizer_link_back',
+        'organizer_logo_image_large',
+        'giftcard_length',
+        'giftcard_expiry_years',
+        'locales',
+        'region',
+        'event_team_provisioning',
+        'primary_color',
+        'theme_color_success',
+        'theme_color_danger',
+        'theme_color_background',
+        'theme_round_borders',
+        'primary_font'
+    ]
+
+    def __init__(self, *args, **kwargs):
+        self.organizer = kwargs.pop('organizer')
+        self.changed_data = []
+        super().__init__(*args, **kwargs)
+        for fname in self.default_fields:
+            kwargs = DEFAULTS[fname].get('serializer_kwargs', {})
+            if callable(kwargs):
+                kwargs = kwargs()
+            kwargs.setdefault('required', False)
+            kwargs.setdefault('allow_null', True)
+            form_kwargs = DEFAULTS[fname].get('form_kwargs', {})
+            if callable(form_kwargs):
+                form_kwargs = form_kwargs()
+            if 'serializer_class' not in DEFAULTS[fname]:
+                raise ValidationError('{} has no serializer class'.format(fname))
+            f = DEFAULTS[fname]['serializer_class'](
+                **kwargs
+            )
+            f._label = form_kwargs.get('label', fname)
+            f._help_text = form_kwargs.get('help_text')
+            self.fields[fname] = f
+
+    def update(self, instance: HierarkeyProxy, validated_data):
+        for attr, value in validated_data.items():
+            if value is None:
+                instance.delete(attr)
+                self.changed_data.append(attr)
+            elif instance.get(attr, as_type=type(value)) != value:
+                instance.set(attr, value)
+                self.changed_data.append(attr)
+        return instance
+
+    def validate(self, data):
+        data = super().validate(data)
+        settings_dict = self.instance.freeze()
+        settings_dict.update(data)
+        validate_organizer_settings(self.organizer, settings_dict)
+        return data

src/pretix/api/urls.py

@@ -62,6 +62,9 @@ order_router = routers.DefaultRouter()
 order_router.register(r'payments', order.PaymentViewSet)
 order_router.register(r'refunds', order.RefundViewSet)
 
+giftcard_router = routers.DefaultRouter()
+giftcard_router.register(r'transactions', organizer.GiftCardTransactionViewSet)
+
 # Force import of all plugins to give them a chance to register URLs with the router
 for app in apps.get_app_configs():
     if hasattr(app, 'PretixPluginMeta'):
@@ -71,6 +74,9 @@ for app in apps.get_app_configs():
 urlpatterns = [
     url(r'^', include(router.urls)),
     url(r'^organizers/(?P<organizer>[^/]+)/', include(orga_router.urls)),
+    url(r'^organizers/(?P<organizer>[^/]+)/settings/$', organizer.OrganizerSettingsView.as_view(),
+        name="organizer.settings"),
+    url(r'^organizers/(?P<organizer>[^/]+)/giftcards/(?P<giftcard>[^/]+)/', include(giftcard_router.urls)),
     url(r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/settings/$', event.EventSettingsView.as_view(),
         name="event.settings"),
     url(r'^organizers/(?P<organizer>[^/]+)/events/(?P<event>[^/]+)/', include(event_router.urls)),

src/pretix/api/views/device.py

@@ -131,7 +131,7 @@ class EventSelectionView(APIView):
 
     @property
     def base_event_qs(self):
-        qs = self.request.auth.organizer.events.annotate(
+        qs = self.request.auth.get_events_with_any_permission().annotate(
             first_date=Coalesce('date_admission', 'date_from'),
             last_date=Coalesce('date_to', 'date_from'),
         ).filter(
@@ -154,6 +154,7 @@ class EventSelectionView(APIView):
         ).filter(
             event__organizer=self.request.auth.organizer,
             event__live=True,
+            event__in=self.request.auth.get_events_with_any_permission(),
             active=True,
         ).select_related('event').order_by('first_date')
         if self.request.auth.gate:

src/pretix/api/views/event.py

@@ -18,7 +18,9 @@ from pretix.base.models import (
     CartPosition, Device, Event, TaxRule, TeamAPIToken,
 )
 from pretix.base.models.event import SubEvent
+from pretix.base.settings import SETTINGS_AFFECTING_CSS
 from pretix.helpers.dicts import merge_dicts
+from pretix.presale.style import regenerate_css
 from pretix.presale.views.organizer import filter_qs_by_attr
 
 with scopes_disabled():
@@ -26,6 +28,7 @@ with scopes_disabled():
         is_past = django_filters.rest_framework.BooleanFilter(method='is_past_qs')
         is_future = django_filters.rest_framework.BooleanFilter(method='is_future_qs')
         ends_after = django_filters.rest_framework.IsoDateTimeFilter(method='ends_after_qs')
+        sales_channel = django_filters.rest_framework.CharFilter(method='sales_channel_qs')
 
         class Meta:
             model = Event
@@ -67,6 +70,9 @@ with scopes_disabled():
             else:
                 return queryset.exclude(expr)
 
+        def sales_channel_qs(self, queryset, name, value):
+            return queryset.filter(sales_channels__contains=value)
+
 
 class EventViewSet(viewsets.ModelViewSet):
     serializer_class = EventSerializer
@@ -385,5 +391,7 @@ class EventSettingsView(views.APIView):
                     k: v for k, v in s.validated_data.items()
                 }
             )
+        if any(p in s.changed_data for p in SETTINGS_AFFECTING_CSS):
+            regenerate_css.apply_async(args=(request.organizer.pk,))
         s = EventSettingsSerializer(instance=request.event.settings, event=request.event)
         return Response(s.data)

src/pretix/api/views/exporters.py

@@ -81,9 +81,9 @@ class ExportersMixin:
         serializer = JobRunSerializer(exporter=instance, data=self.request.data, **self.get_serializer_kwargs())
         serializer.is_valid(raise_exception=True)
 
-        cf = CachedFile()
+        cf = CachedFile(web_download=False)
         cf.date = now()
-        cf.expires = now() + timedelta(days=3)
+        cf.expires = now() + timedelta(hours=24)
         cf.save()
         d = serializer.data
         for k, v in d.items():

src/pretix/api/views/order.py

@@ -558,6 +558,8 @@ class OrderViewSet(viewsets.ModelViewSet):
             )
 
     def create(self, request, *args, **kwargs):
+        if 'send_mail' in request.data and 'send_email' not in request.data:
+            request.data['send_email'] = request.data['send_mail']
         serializer = OrderCreateSerializer(data=request.data, context=self.get_serializer_context())
         serializer.is_valid(raise_exception=True)
         with transaction.atomic():
@@ -580,7 +582,7 @@ class OrderViewSet(viewsets.ModelViewSet):
                 auth=request.auth,
             )
 
-        with language(order.locale):
+        with language(order.locale, self.request.event.settings.region):
             order_placed.send(self.request.event, order=order)
             if order.status == Order.STATUS_PAID:
                 order_paid.send(self.request.event, order=order)
@@ -672,6 +674,17 @@ class OrderViewSet(viewsets.ModelViewSet):
                     }
                 )
 
+            if 'phone' in self.request.data and serializer.instance.phone != self.request.data.get('phone'):
+                serializer.instance.log_action(
+                    'pretix.event.order.phone.changed',
+                    user=self.request.user,
+                    auth=self.request.auth,
+                    data={
+                        'old_phone': serializer.instance.phone,
+                        'new_phone': self.request.data.get('phone'),
+                    }
+                )
+
             if 'locale' in self.request.data and serializer.instance.locale != self.request.data.get('locale'):
                 serializer.instance.log_action(
                     'pretix.event.order.locale.changed',
@@ -884,7 +897,7 @@ class OrderPositionViewSet(mixins.DestroyModelMixin, viewsets.ReadOnlyModelViewS
 
         price = get_price(**kwargs)
         tr = kwargs.get('tax_rule', kwargs.get('item').tax_rule)
-        with language(data.get('locale') or self.request.event.settings.locale):
+        with language(data.get('locale') or self.request.event.settings.locale, self.request.event.settings.region):
             return Response({
                 'gross': price.gross,
                 'gross_formatted': money_filter(price.gross, self.request.event.currency, hide_currency=True),
@@ -949,6 +962,7 @@ class PaymentViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
     def get_serializer_context(self):
         ctx = super().get_serializer_context()
         ctx['order'] = get_object_or_404(Order, code=self.kwargs['order'], event=self.request.event)
+        ctx['event'] = self.request.event
         return ctx
 
     def get_queryset(self):
@@ -956,6 +970,7 @@ class PaymentViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
         return order.payments.all()
 
     def create(self, request, *args, **kwargs):
+        send_mail = request.data.get('send_email', True)
         serializer = OrderPaymentCreateSerializer(data=request.data, context=self.get_serializer_context())
         serializer.is_valid(raise_exception=True)
         with transaction.atomic():
@@ -971,7 +986,8 @@ class PaymentViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
                         user=self.request.user if self.request.user.is_authenticated else None,
                         auth=self.request.auth,
                         count_waitinglist=False,
-                        force=request.data.get('force', False)
+                        force=request.data.get('force', False),
+                        send_mail=send_mail,
                     )
                 except Quota.QuotaExceededException:
                     pass

src/pretix/api/views/organizer.py

@@ -6,7 +6,9 @@ from django.shortcuts import get_object_or_404
 from django.utils.functional import cached_property
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
-from rest_framework import filters, mixins, serializers, status, viewsets
+from rest_framework import (
+    filters, mixins, serializers, status, views, viewsets,
+)
 from rest_framework.decorators import action
 from rest_framework.exceptions import MethodNotAllowed, PermissionDenied
 from rest_framework.mixins import CreateModelMixin, DestroyModelMixin
@@ -15,15 +17,18 @@ from rest_framework.viewsets import GenericViewSet
 
 from pretix.api.models import OAuthAccessToken
 from pretix.api.serializers.organizer import (
-    DeviceSerializer, GiftCardSerializer, OrganizerSerializer,
+    DeviceSerializer, GiftCardSerializer, GiftCardTransactionSerializer,
-    SeatingPlanSerializer, TeamAPITokenSerializer, TeamInviteSerializer,
+    OrganizerSerializer, OrganizerSettingsSerializer, SeatingPlanSerializer,
-    TeamMemberSerializer, TeamSerializer,
+    TeamAPITokenSerializer, TeamInviteSerializer, TeamMemberSerializer,
+    TeamSerializer,
 )
 from pretix.base.models import (
-    Device, GiftCard, Organizer, SeatingPlan, Team, TeamAPIToken, TeamInvite,
+    Device, GiftCard, GiftCardTransaction, Organizer, SeatingPlan, Team,
-    User,
+    TeamAPIToken, TeamInvite, User,
 )
+from pretix.base.settings import SETTINGS_AFFECTING_CSS
 from pretix.helpers.dicts import merge_dicts
+from pretix.presale.style import regenerate_organizer_css
 
 
 class OrganizerViewSet(viewsets.ReadOnlyModelViewSet):
@@ -191,6 +196,24 @@ class GiftCardViewSet(viewsets.ModelViewSet):
         raise MethodNotAllowed("Gift cards cannot be deleted.")
 
 
+class GiftCardTransactionViewSet(viewsets.ReadOnlyModelViewSet):
+    serializer_class = GiftCardTransactionSerializer
+    queryset = GiftCardTransaction.objects.none()
+    permission = 'can_manage_gift_cards'
+    write_permission = 'can_manage_gift_cards'
+
+    @cached_property
+    def giftcard(self):
+        if self.request.GET.get('include_accepted') == 'true':
+            qs = self.request.organizer.accepted_gift_cards
+        else:
+            qs = self.request.organizer.issued_gift_cards.all()
+        return get_object_or_404(qs, pk=self.kwargs.get('giftcard'))
+
+    def get_queryset(self):
+        return self.giftcard.transactions.select_related('order', 'order__event')
+
+
 class TeamViewSet(viewsets.ModelViewSet):
     serializer_class = TeamSerializer
     queryset = Team.objects.none()
@@ -396,3 +419,37 @@ class DeviceViewSet(mixins.CreateModelMixin,
             data=self.request.data
         )
         return inst
+
+
+class OrganizerSettingsView(views.APIView):
+    permission = 'can_change_organizer_settings'
+
+    def get(self, request, *args, **kwargs):
+        s = OrganizerSettingsSerializer(instance=request.organizer.settings, organizer=request.organizer)
+        if 'explain' in request.GET:
+            return Response({
+                fname: {
+                    'value': s.data[fname],
+                    'label': getattr(field, '_label', fname),
+                    'help_text': getattr(field, '_help_text', None)
+                } for fname, field in s.fields.items()
+            })
+        return Response(s.data)
+
+    def patch(self, request, *wargs, **kwargs):
+        s = OrganizerSettingsSerializer(
+            instance=request.organizer.settings, data=request.data, partial=True,
+            organizer=request.organizer
+        )
+        s.is_valid(raise_exception=True)
+        with transaction.atomic():
+            s.save()
+            self.request.organizer.log_action(
+                'pretix.organizer.settings', user=self.request.user, auth=self.request.auth, data={
+                    k: v for k, v in s.validated_data.items()
+                }
+            )
+        if any(p in s.changed_data for p in SETTINGS_AFFECTING_CSS):
+            regenerate_organizer_css.apply_async(args=(request.organizer.pk,))
+        s = OrganizerSettingsSerializer(instance=request.organizer.settings, organizer=request.organizer)
+        return Response(s.data)

src/pretix/base/email.py

@@ -115,7 +115,7 @@ class TemplateBasedMailRenderer(BaseHTMLMailRenderer):
             'body': body_md,
             'subject': str(subject),
             'color': settings.PRETIX_PRIMARY_COLOR,
-            'rtl': get_language() in settings.LANGUAGES_RTL
+            'rtl': get_language() in settings.LANGUAGES_RTL or get_language().split('-')[0] in settings.LANGUAGES_RTL,
         }
         if self.event:
             htmlctx['event'] = self.event

src/pretix/base/exporters/__init__.py

@@ -4,3 +4,4 @@ from .invoices import *  # noqa
 from .json import *  # noqa
 from .mail import *  # noqa
 from .orderlist import *  # noqa
+from .waitinglist import *  # noqa

src/pretix/base/exporters/orderlist.py

@@ -139,7 +139,7 @@ class OrderListExporter(MultiSheetListExporter):
         tax_rates = self._get_all_tax_rates(qs)
 
         headers = [
-            _('Event slug'), _('Order code'), _('Order total'), _('Status'), _('Email'), _('Order date'),
+            _('Event slug'), _('Order code'), _('Order total'), _('Status'), _('Email'), _('Phone number'), _('Order date'),
             _('Order time'), _('Company'), _('Name'),
         ]
         name_scheme = PERSON_NAME_SCHEMES[self.event.settings.name_scheme] if not self.is_multievent else None
@@ -147,8 +147,8 @@ class OrderListExporter(MultiSheetListExporter):
             for k, label, w in name_scheme['fields']:
                 headers.append(label)
         headers += [
-            _('Address'), _('ZIP code'), _('City'), _('Country'), pgettext('address', 'State'), _('VAT ID'),
+            _('Address'), _('ZIP code'), _('City'), _('Country'), pgettext('address', 'State'),
-            _('Date of last payment'), _('Fees'), _('Order locale')
+            _('Custom address field'), _('VAT ID'), _('Date of last payment'), _('Fees'), _('Order locale')
         ]
 
         for tr in tax_rates:
@@ -215,6 +215,7 @@ class OrderListExporter(MultiSheetListExporter):
                 order.total,
                 order.get_status_display(),
                 order.email,
+                str(order.phone) if order.phone else '',
                 order.datetime.astimezone(tz).strftime('%Y-%m-%d'),
                 order.datetime.astimezone(tz).strftime('%H:%M:%S'),
             ]
@@ -235,10 +236,11 @@ class OrderListExporter(MultiSheetListExporter):
                     order.invoice_address.country if order.invoice_address.country else
                     order.invoice_address.country_old,
                     order.invoice_address.state,
+                    order.invoice_address.custom_field,
                     order.invoice_address.vat_id,
                 ]
             except InvoiceAddress.DoesNotExist:
-                row += [''] * (8 + (len(name_scheme['fields']) if name_scheme and len(name_scheme['fields']) > 1 else 0))
+                row += [''] * (9 + (len(name_scheme['fields']) if name_scheme and len(name_scheme['fields']) > 1 else 0))
 
             row += [
                 order.payment_date.astimezone(tz).strftime('%Y-%m-%d') if order.payment_date else '',
@@ -302,6 +304,7 @@ class OrderListExporter(MultiSheetListExporter):
             _('Order code'),
             _('Status'),
             _('Email'),
+            _('Phone number'),
             _('Order date'),
             _('Order time'),
             _('Fee type'),
@@ -333,6 +336,7 @@ class OrderListExporter(MultiSheetListExporter):
                 order.code,
                 order.get_status_display(),
                 order.email,
+                str(order.phone) if order.phone else '',
                 order.datetime.astimezone(tz).strftime('%Y-%m-%d'),
                 order.datetime.astimezone(tz).strftime('%H:%M:%S'),
                 op.get_fee_type_display(),
@@ -401,6 +405,7 @@ class OrderListExporter(MultiSheetListExporter):
             _('Position ID'),
             _('Status'),
             _('Email'),
+            _('Phone number'),
             _('Order date'),
             _('Order time'),
         ]
@@ -480,6 +485,7 @@ class OrderListExporter(MultiSheetListExporter):
                     op.positionid,
                     order.get_status_display(),
                     order.email,
+                    str(order.phone) if order.phone else '',
                     order.datetime.astimezone(tz).strftime('%Y-%m-%d'),
                     order.datetime.astimezone(tz).strftime('%H:%M:%S'),
                 ]

src/pretix/base/exporters/waitinglist.py

@@ -0,0 +1,165 @@
+from collections import OrderedDict
+
+import pytz
+from django import forms
+from django.db.models import F, Q
+from django.dispatch import receiver
+from django.utils.timezone import now
+from django.utils.translation import gettext_lazy as _, pgettext_lazy
+
+from pretix.base.models.waitinglist import WaitingListEntry
+
+from ..exporter import ListExporter
+from ..signals import (
+    register_data_exporters, register_multievent_data_exporters,
+)
+
+
+class WaitingListExporter(ListExporter):
+    identifier = 'waitinglist'
+    verbose_name = _('Waiting list')
+
+    # map selected status to label and queryset-filter
+    status_filters = [
+        (
+            '',
+            _('All entries'),
+            lambda qs: qs
+        ),
+        (
+            'awaiting-voucher',
+            _('Waiting for a voucher'),
+            lambda qs: qs.filter(voucher__isnull=True)
+        ),
+        (
+            'voucher-assigned',
+            _('Voucher assigned'),
+            lambda qs: qs.filter(voucher__isnull=False)
+        ),
+        (
+            'awaiting-redemption',
+            _('Waiting for redemption'),
+            lambda qs: qs.filter(
+                voucher__isnull=False,
+                voucher__redeemed__lt=F('voucher__max_usages'),
+            ).filter(Q(voucher__valid_until__isnull=True) | Q(voucher__valid_until__gt=now()))
+        ),
+        (
+            'voucher-redeemed',
+            _('Voucher redeemed'),
+            lambda qs: qs.filter(
+                voucher__isnull=False,
+                voucher__redeemed__gte=F('voucher__max_usages'),
+            )
+        ),
+        (
+            'voucher-expired',
+            _('Voucher expired'),
+            lambda qs: qs.filter(
+                voucher__isnull=False,
+                voucher__redeemed__lt=F('voucher__max_usages'),
+                voucher__valid_until__isnull=False,
+                voucher__valid_until__lte=now()
+            )
+        ),
+    ]
+
+    def iterate_list(self, form_data):
+        # create dicts for easier access by key, which is passed by form_data[status]
+        status_labels = {k: v for k, v, c in self.status_filters}
+        queryset_mutators = {k: c for k, v, c in self.status_filters}
+
+        entries = WaitingListEntry.objects.filter(
+            event__in=self.events,
+        ).select_related(
+            'item', 'variation', 'voucher', 'subevent'
+        ).order_by('created')
+
+        # apply filter to queryset/entries according to status
+        # if unknown status-filter is given, django will handle the error
+        status_filter = form_data.get("status", "")
+        entries = queryset_mutators[status_filter](entries)
+
+        headers = [
+            _('Date'),
+            _('Email'),
+            _('Product name'),
+            _('Variation'),
+            _('Event slug'),
+            _('Event name'),
+            pgettext_lazy('subevents', 'Date'),  # Name of subevent
+            _('Start date'),  # Start date of subevent or event
+            _('End date'),  # End date of subevent or event
+            _('Language'),
+            _('Priority'),
+            _('Status'),
+            _('Voucher code'),
+        ]
+
+        yield headers
+        yield self.ProgressSetTotal(total=len(entries))
+
+        for entry in entries:
+            if entry.voucher:
+                if entry.voucher.redeemed >= entry.voucher.max_usages:
+                    status_label = status_labels['voucher-redeemed']
+                elif not entry.voucher.is_active():
+                    status_label = status_labels['voucher-expired']
+                else:
+                    status_label = status_labels['voucher-assigned']
+            else:
+                status_label = status_labels['awaiting-voucher']
+
+            # which event should be used to output dates in columns "Start date" and "End date"
+            event_for_date_columns = entry.subevent if entry.subevent else entry.event
+            tz = pytz.timezone(entry.event.settings.timezone)
+            datetime_format = '%Y-%m-%d %H:%M:%S'
+
+            row = [
+                entry.created.astimezone(tz).strftime(datetime_format),  # alternative: .isoformat(),
+                entry.email,
+                str(entry.item) if entry.item else "",
+                str(entry.variation) if entry.variation else "",
+                entry.event.slug,
+                entry.event.name,
+                entry.subevent.name if entry.subevent else "",
+                event_for_date_columns.date_from.astimezone(tz).strftime(datetime_format),
+                event_for_date_columns.date_to.astimezone(tz).strftime(datetime_format) if event_for_date_columns.date_to else "",
+                entry.locale,
+                str(entry.priority),
+                status_label,
+                entry.voucher.code if entry.voucher else '',
+            ]
+            yield row
+
+    @property
+    def additional_form_fields(self):
+        return OrderedDict(
+            [
+                ('status',
+                 forms.ChoiceField(
+                     label=_('Status'),
+                     initial=['awaiting-voucher'],
+                     required=False,
+                     choices=[(k, v) for (k, v, c) in self.status_filters]
+                 )),
+            ]
+        )
+
+    def get_filename(self):
+        if self.is_multievent:
+            event = self.events.first()
+            slug = event.organizer.slug if len(self.events) > 1 else event.slug
+        else:
+            slug = self.event.slug
+        return '{}_waitinglist'.format(slug)
+
+
+@receiver(register_data_exporters, dispatch_uid="exporter_waitinglist")
+def register_waitinglist_exporter(sender, **kwargs):
+    return WaitingListExporter
+
+
+@receiver(register_multievent_data_exporters, dispatch_uid="multiexporter_waitinglist")
+def register_multievent_i_waitinglist_exporter(sender, **kwargs):
+    return WaitingListExporter

src/pretix/base/forms/auth.py

@@ -1,12 +1,17 @@
+import hashlib
+import ipaddress
+
 from django import forms
 from django.conf import settings
 from django.contrib.auth.password_validation import (
     password_validators_help_texts, validate_password,
 )
+from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 
 from pretix.base.models import User
 from pretix.helpers.dicts import move_to_end
+from pretix.helpers.http import get_client_ip
 
 
 class LoginForm(forms.Form):
@@ -18,6 +23,7 @@ class LoginForm(forms.Form):
 
     error_messages = {
         'invalid_login': _("This combination of credentials is not known to our system."),
+        'rate_limit': _("For security reasons, please wait 5 minutes before you try again."),
         'inactive': _("This account is inactive.")
     }
 
@@ -39,10 +45,36 @@ class LoginForm(forms.Form):
         else:
             move_to_end(self.fields, 'keep_logged_in')
 
+    @cached_property
+    def ratelimit_key(self):
+        if not settings.HAS_REDIS:
+            return None
+        client_ip = get_client_ip(self.request)
+        if not client_ip:
+            return None
+        try:
+            client_ip = ipaddress.ip_address(client_ip)
+        except ValueError:
+            # Web server not set up correctly
+            return None
+        if client_ip.is_private:
+            # This is the private IP of the server, web server not set up correctly
+            return None
+        return 'pretix_login_{}'.format(hashlib.sha1(str(client_ip).encode()).hexdigest())
+
     def clean(self):
         if all(k in self.cleaned_data for k, f in self.fields.items() if f.required):
+            if self.ratelimit_key:
+                from django_redis import get_redis_connection
+                rc = get_redis_connection("redis")
+                cnt = rc.get(self.ratelimit_key)
+                if cnt and int(cnt) > 10:
+                    raise forms.ValidationError(self.error_messages['rate_limit'], code='rate_limit')
             self.user_cache = self.backend.form_authenticate(self.request, self.cleaned_data)
             if self.user_cache is None:
+                if self.ratelimit_key:
+                    rc.incr(self.ratelimit_key)
+                    rc.expire(self.ratelimit_key, 300)
                 raise forms.ValidationError(
                     self.error_messages['invalid_login'],
                     code='invalid_login'

src/pretix/base/forms/questions.py

@@ -9,30 +9,34 @@ import pycountry
 import pytz
 import vat_moss.errors
 import vat_moss.id
-from babel import localedata
 from django import forms
 from django.contrib import messages
 from django.core.exceptions import ValidationError
+from django.core.validators import MaxValueValidator, MinValueValidator
 from django.db.models import QuerySet
 from django.forms import Select
+from django.utils.formats import date_format
 from django.utils.html import escape
 from django.utils.safestring import mark_safe
-from django.utils.translation import (
+from django.utils.timezone import get_current_timezone
-    get_language, gettext_lazy as _, pgettext_lazy,
+from django.utils.translation import gettext_lazy as _, pgettext_lazy
-)
 from django_countries import countries
 from django_countries.fields import Country, CountryField
 from phonenumber_field.formfields import PhoneNumberField
 from phonenumber_field.phonenumber import PhoneNumber
-from phonenumber_field.widgets import PhoneNumberPrefixWidget
+from phonenumber_field.widgets import (
-from phonenumbers import NumberParseException
+    PhoneNumberPrefixWidget, PhonePrefixSelect,
+)
+from phonenumbers import NumberParseException, national_significant_number
 from phonenumbers.data import _COUNTRY_CODE_TO_REGION_CODE
 
 from pretix.base.forms.widgets import (
     BusinessBooleanRadio, DatePickerWidget, SplitDateTimePickerWidget,
     TimePickerWidget, UploadedFileWidget,
 )
-from pretix.base.i18n import language
+from pretix.base.i18n import (
+    get_babel_locale, get_language_without_region, language,
+)
 from pretix.base.models import InvoiceAddress, Question, QuestionOption
 from pretix.base.models.tax import (
     EU_COUNTRIES, cc_to_vat_prefix, is_eu_country,
@@ -201,7 +205,18 @@ class NamePartsFormField(forms.MultiValueField):
         return value
 
 
+class WrappedPhonePrefixSelect(PhonePrefixSelect):
+    def __init__(self, *args, **kwargs):
+        with language(get_babel_locale()):
+            super().__init__(*args, **kwargs)
+
+
 class WrappedPhoneNumberPrefixWidget(PhoneNumberPrefixWidget):
+
+    def __init__(self, attrs=None, initial=None):
+        widgets = (WrappedPhonePrefixSelect(initial), forms.TextInput())
+        super(PhoneNumberPrefixWidget, self).__init__(widgets, attrs)
+
     def render(self, name, value, attrs=None, renderer=None):
         output = super().render(name, value, attrs, renderer)
         return mark_safe(self.format_output(output))
@@ -209,12 +224,44 @@ class WrappedPhoneNumberPrefixWidget(PhoneNumberPrefixWidget):
     def format_output(self, rendered_widgets) -> str:
         return '<div class="nameparts-form-group">%s</div>' % ''.join(rendered_widgets)
 
+    def decompress(self, value):
+        """
+        If an incomplete phone number (e.g. without country prefix) is currently entered,
+        the default implementation just discards the value and shows nothing at all.
+        Let's rather show something invalid, so the user is prompted to fix it, instead of
+        silently deleting data.
+        """
+        if value:
+            if type(value) == PhoneNumber:
+                if value.country_code and value.national_number:
+                    return [
+                        "+%d" % value.country_code,
+                        national_significant_number(value),
+                    ]
+                return [
+                    None,
+                    str(value)
+                ]
+            elif "." in value:
+                return value.split(".")
+            else:
+                return [None, value]
+        return [None, ""]
+
+    def value_from_datadict(self, data, files, name):
+        # In contrast to defualt implementation, do not silently fail if a number without
+        # country prefix is entered
+        values = super(PhoneNumberPrefixWidget, self).value_from_datadict(data, files, name)
+        if values[1]:
+            return "%s.%s" % tuple(values)
+        return ""
+
 
 def guess_country(event):
     # Try to guess the initial country from either the country of the merchant
     # or the locale. This will hopefully save at least some users some scrolling :)
-    locale = get_language()
+    locale = get_language_without_region()
-    country = event.settings.invoice_address_from_country
+    country = event.settings.region or event.settings.invoice_address_from_country
     if not country:
         valid_countries = countries.countries
         if '-' in locale:
@@ -234,6 +281,43 @@ class QuestionCheckboxSelectMultiple(forms.CheckboxSelectMultiple):
     option_template_name = 'pretixbase/forms/widgets/checkbox_option_with_links.html'
 
 
+class MinDateValidator(MinValueValidator):
+    def __call__(self, value):
+        try:
+            return super().__call__(value)
+        except ValidationError as e:
+            e.params['limit_value'] = date_format(e.params['limit_value'], 'SHORT_DATE_FORMAT')
+            raise e
+
+
+class MinDateTimeValidator(MinValueValidator):
+    def __call__(self, value):
+        try:
+            return super().__call__(value)
+        except ValidationError as e:
+            e.params['limit_value'] = date_format(e.params['limit_value'].astimezone(get_current_timezone()), 'SHORT_DATETIME_FORMAT')
+            raise e
+
+
+class MaxDateValidator(MaxValueValidator):
+
+    def __call__(self, value):
+        try:
+            return super().__call__(value)
+        except ValidationError as e:
+            e.params['limit_value'] = date_format(e.params['limit_value'], 'SHORT_DATE_FORMAT')
+            raise e
+
+
+class MaxDateTimeValidator(MaxValueValidator):
+    def __call__(self, value):
+        try:
+            return super().__call__(value)
+        except ValidationError as e:
+            e.params['limit_value'] = date_format(e.params['limit_value'].astimezone(get_current_timezone()), 'SHORT_DATETIME_FORMAT')
+            raise e
+
+
 class BaseQuestionsForm(forms.Form):
     """
     This form class is responsible for asking order-related questions. This includes
@@ -392,9 +476,10 @@ class BaseQuestionsForm(forms.Form):
             elif q.type == Question.TYPE_NUMBER:
                 field = forms.DecimalField(
                     label=label, required=required,
+                    min_value=q.valid_number_min or Decimal('0.00'),
+                    max_value=q.valid_number_max,
                     help_text=q.help_text,
                     initial=initial.answer if initial else None,
-                    min_value=Decimal('0.00'),
                 )
             elif q.type == Question.TYPE_STRING:
                 field = forms.CharField(
@@ -453,12 +538,21 @@ class BaseQuestionsForm(forms.Form):
                     max_size=10 * 1024 * 1024,
                 )
             elif q.type == Question.TYPE_DATE:
+                attrs = {}
+                if q.valid_date_min:
+                    attrs['data-min'] = q.valid_date_min.isoformat()
+                if q.valid_date_max:
+                    attrs['data-max'] = q.valid_date_max.isoformat()
                 field = forms.DateField(
                     label=label, required=required,
                     help_text=help_text,
                     initial=dateutil.parser.parse(initial.answer).date() if initial and initial.answer else None,
-                    widget=DatePickerWidget(),
+                    widget=DatePickerWidget(attrs),
                 )
+                if q.valid_date_min:
+                    field.validators.append(MinDateValidator(q.valid_date_min))
+                if q.valid_date_max:
+                    field.validators.append(MaxDateValidator(q.valid_date_max))
             elif q.type == Question.TYPE_TIME:
                 field = forms.TimeField(
                     label=label, required=required,
@@ -471,16 +565,18 @@ class BaseQuestionsForm(forms.Form):
                     label=label, required=required,
                     help_text=help_text,
                     initial=dateutil.parser.parse(initial.answer).astimezone(tz) if initial and initial.answer else None,
-                    widget=SplitDateTimePickerWidget(time_format=get_format_without_seconds('TIME_INPUT_FORMATS')),
+                    widget=SplitDateTimePickerWidget(
+                        time_format=get_format_without_seconds('TIME_INPUT_FORMATS'),
+                        min_date=q.valid_datetime_min,
+                        max_date=q.valid_datetime_max
+                    ),
                 )
+                if q.valid_datetime_min:
+                    field.validators.append(MinDateTimeValidator(q.valid_datetime_min))
+                if q.valid_datetime_max:
+                    field.validators.append(MaxDateTimeValidator(q.valid_datetime_max))
             elif q.type == Question.TYPE_PHONENUMBER:
-                babel_locale = 'en'
+                with language(get_babel_locale()):
-                # Babel, and therefore django-phonenumberfield, do not support our custom locales such das de_Informal
-                if localedata.exists(get_language()):
-                    babel_locale = get_language()
-                elif localedata.exists(get_language()[:2]):
-                    babel_locale = get_language()[:2]
-                with language(babel_locale):
                     default_country = guess_country(event)
                     default_prefix = None
                     for prefix, values in _COUNTRY_CODE_TO_REGION_CODE.items():

src/pretix/base/forms/user.py

@@ -1,4 +1,5 @@
 from django import forms
+from django.conf import settings
 from django.contrib.auth.hashers import check_password
 from django.contrib.auth.password_validation import (
     password_validators_help_texts, validate_password,
@@ -19,6 +20,7 @@ class UserSettingsForm(forms.ModelForm):
                         "address or password."),
         'pw_current_wrong': _("The current password you entered was not correct."),
         'pw_mismatch': _("Please enter the same password twice"),
+        'rate_limit': _("For security reasons, please wait 5 minutes before you try again."),
     }
 
     old_pw = forms.CharField(max_length=255,
@@ -64,6 +66,18 @@ class UserSettingsForm(forms.ModelForm):
 
     def clean_old_pw(self):
         old_pw = self.cleaned_data.get('old_pw')
+
+        if old_pw and settings.HAS_REDIS:
+            from django_redis import get_redis_connection
+            rc = get_redis_connection("redis")
+            cnt = rc.incr('pretix_pwchange_%s' % self.user.pk)
+            rc.expire('pretix_pwchange_%s' % self.user.pk, 300)
+            if cnt > 10:
+                raise forms.ValidationError(
+                    self.error_messages['rate_limit'],
+                    code='rate_limit',
+                )
+
         if old_pw and not check_password(old_pw, self.user.password):
             raise forms.ValidationError(
                 self.error_messages['pw_current_wrong'],

src/pretix/base/forms/widgets.py

@@ -1,9 +1,10 @@
 import os
+from datetime import date
 
 from django import forms
 from django.utils.formats import get_format
 from django.utils.functional import lazy
-from django.utils.timezone import now
+from django.utils.timezone import get_current_timezone, now
 from django.utils.translation import gettext_lazy as _
 
 
@@ -92,7 +93,7 @@ class UploadedFileWidget(forms.ClearableFileInput):
 class SplitDateTimePickerWidget(forms.SplitDateTimeWidget):
     template_name = 'pretixbase/forms/widgets/splitdatetime.html'
 
-    def __init__(self, attrs=None, date_format=None, time_format=None):
+    def __init__(self, attrs=None, date_format=None, time_format=None, min_date=None, max_date=None):
         attrs = attrs or {}
         if 'placeholder' in attrs:
             del attrs['placeholder']
@@ -106,6 +107,14 @@ class SplitDateTimePickerWidget(forms.SplitDateTimeWidget):
         time_attrs['class'] += ' timepickerfield'
         date_attrs['autocomplete'] = 'date-picker-do-not-autofill'
         time_attrs['autocomplete'] = 'time-picker-do-not-autofill'
+        if min_date:
+            date_attrs['data-min'] = (
+                min_date if isinstance(min_date, date) else min_date.astimezone(get_current_timezone()).date()
+            ).isoformat()
+        if max_date:
+            date_attrs['data-max'] = (
+                max_date if isinstance(max_date, date) else max_date.astimezone(get_current_timezone()).date()
+            ).isoformat()
 
         def date_placeholder():
             df = date_format or get_format('DATE_INPUT_FORMATS')[0]

src/pretix/base/i18n.py

@@ -1,5 +1,6 @@
 from contextlib import contextmanager
 
+from babel import localedata
 from django.conf import settings
 from django.utils import translation
 from django.utils.formats import date_format, number_format
@@ -66,10 +67,52 @@ class LazyNumber:
         return number_format(self.value, decimal_pos=self.decimal_pos)
 
 
+ALLOWED_LANGUAGES = dict(settings.LANGUAGES)
+
+
+def get_babel_locale():
+    babel_locale = 'en'
+    # Babel, and therefore django-phonenumberfield, do not support our custom locales such das de_Informal
+    if localedata.exists(translation.get_language()):
+        babel_locale = translation.get_language()
+    elif localedata.exists(translation.get_language()[:2]):
+        babel_locale = translation.get_language()[:2]
+    return babel_locale
+
+
+def get_language_without_region(lng=None):
+    """
+    Returns the currently active language, but strips what pretix calls a ``region``. For example,
+    if the currently active language is ``en-us``, you will be returned ``en`` since pretix does not
+    ship with separate language files for ``en-us``. If the currently active language is ``pt-br``,
+    you will be returned ``pt-br`` since there are separate language files for ``pt-br``.
+
+    tl;dr: You will be always passed a language that is defined in settings.LANGUAGES.
+    """
+    lng = lng or translation.get_language() or settings.LANGUAGE_CODE
+    if lng not in ALLOWED_LANGUAGES:
+        lng = lng.split('-')[0]
+    if lng not in ALLOWED_LANGUAGES:
+        lng = settings.LANGUAGE_CODE
+    return lng
+
+
 @contextmanager
-def language(lng):
+def language(lng, region=None):
+    """
+    Temporarily change the active language to ``lng``. Will automatically be rolled back when the
+    context manager returns.
+
+    You can optionally pass a "region". For example, if you pass ``en`` as ``lng`` and ``US`` as
+    ``region``, the active language will be ``en-us``, which will mostly affect date/time
+    formatting. If you pass a ``lng`` that already contains a region, e.g. ``pt-br``, the ``region``
+    attribute will be ignored.
+    """
     _lng = translation.get_language()
-    translation.activate(lng or settings.LANGUAGE_CODE)
+    lng = lng or settings.LANGUAGE_CODE
+    if '-' not in lng and region:
+        lng += '-' + region.lower()
+    translation.activate(lng)
     try:
         yield
     finally:

src/pretix/base/invoice.py

@@ -144,7 +144,7 @@ class BaseReportlabInvoiceRenderer(BaseInvoiceRenderer):
 
     def _upper(self, val):
         # We uppercase labels, but not in every language
-        if get_language() == 'el':
+        if get_language().startswith('el'):
             return val
         return val.upper()
 

src/pretix/base/middleware.py

@@ -15,7 +15,8 @@ from django.utils.translation.trans_real import (
     parse_accept_lang_header,
 )
 
-from pretix.base.settings import GlobalSettingsObject
+from pretix.base.i18n import get_language_without_region
+from pretix.base.settings import global_settings_object
 from pretix.multidomain.urlreverse import (
     get_event_domain, get_organizer_domain,
 )
@@ -35,19 +36,30 @@ class LocaleMiddleware(MiddlewareMixin):
         # Normally, this middleware runs *before* the event is set. However, on event frontend pages it
         # might be run a second time by pretix.presale.EventMiddleware and in this case the event is already
         # set and can be taken into account for the decision.
-        if hasattr(request, 'event') and not request.path.startswith(get_script_prefix() + 'control'):
+        if not request.path.startswith(get_script_prefix() + 'control'):
-            if language not in request.event.settings.locales:
+            if hasattr(request, 'event'):
-                firstpart = language.split('-')[0]
+                if language not in request.event.settings.locales:
-                if firstpart in request.event.settings.locales:
+                    firstpart = language.split('-')[0]
-                    language = firstpart
+                    if firstpart in request.event.settings.locales:
-                else:
+                        language = firstpart
-                    language = request.event.settings.locale
+                    else:
-                    for lang in request.event.settings.locales:
+                        language = request.event.settings.locale
-                        if lang.startswith(firstpart + '-'):
+                        for lang in request.event.settings.locales:
-                            language = lang
+                            if lang.startswith(firstpart + '-'):
-                            break
+                                language = lang
+                                break
+                if '-' not in language and request.event.settings.region:
+                    language += '-' + request.event.settings.region
+            elif hasattr(request, 'organizer'):
+                if '-' not in language and request.organizer.settings.region:
+                    language += '-' + request.organizer.settings.region
+        else:
+            gs = global_settings_object(request)
+            if '-' not in language and gs.settings.region:
+                language += '-' + gs.settings.region
+
         translation.activate(language)
-        request.LANGUAGE_CODE = translation.get_language()
+        request.LANGUAGE_CODE = get_language_without_region()
 
         tzname = None
         if hasattr(request, 'event'):
@@ -192,7 +204,7 @@ class SecurityMiddleware(MiddlewareMixin):
         resp['P3P'] = 'CP=\"ALL DSP COR CUR ADM TAI OUR IND COM NAV INT\"'
 
         img_src = []
-        gs = GlobalSettingsObject()
+        gs = global_settings_object(request)
         if gs.settings.leaflet_tiles:
             img_src.append(gs.settings.leaflet_tiles[:gs.settings.leaflet_tiles.index("/", 10)].replace("{s}", "*"))
 
@@ -216,6 +228,8 @@ class SecurityMiddleware(MiddlewareMixin):
             h['report-uri'] = ["/csp_report/"]
         if 'Content-Security-Policy' in resp:
             _merge_csp(h, _parse_csp(resp['Content-Security-Policy']))
+        if settings.CSP_ADDITIONAL_HEADER:
+            _merge_csp(h, _parse_csp(settings.CSP_ADDITIONAL_HEADER))
 
         staticdomain = "'self'"
         dynamicdomain = "'self'"

src/pretix/base/migrations/0162b_auto_20201218_1810.py

@@ -0,0 +1,23 @@
+# Generated by Django 3.0.11 on 2020-12-18 18:10
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0162_remove_seat_name'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='cachedfile',
+            name='session_key',
+            field=models.TextField(null=True),
+        ),
+        migrations.AddField(
+            model_name='cachedfile',
+            name='web_download',
+            field=models.BooleanField(default=True),
+        ),
+    ]

src/pretix/base/migrations/0171_auto_20201126_1635.py

@@ -0,0 +1,49 @@
+# Generated by Django 3.0.11 on 2020-11-26 16:35
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0170_remove_hidden_urls'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='question',
+            name='valid_date_max',
+            field=models.DateField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='question',
+            name='valid_date_min',
+            field=models.DateField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='question',
+            name='valid_datetime_max',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='question',
+            name='valid_datetime_min',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AddField(
+            model_name='question',
+            name='valid_number_max',
+            field=models.DecimalField(decimal_places=6, max_digits=16, null=True),
+        ),
+        migrations.AddField(
+            model_name='question',
+            name='valid_number_min',
+            field=models.DecimalField(decimal_places=6, max_digits=16, null=True),
+        ),
+        migrations.AlterField(
+            model_name='seat',
+            name='product',
+            field=models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='seats', to='pretixbase.Item'),
+        ),
+    ]

src/pretix/base/migrations/0172_event_sales_channels.py

@@ -0,0 +1,20 @@
+# Generated by Django 3.0.9 on 2020-12-02 12:37
+
+from django.db import migrations
+
+import pretix.base.models.fields
+from pretix.base.channels import get_all_sales_channels
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('pretixbase', '0171_auto_20201126_1635'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='event',
+            name='sales_channels',
+            field=pretix.base.models.fields.MultiStringField(default=list(get_all_sales_channels().keys())),
+        ),
+    ]

src/pretix/base/migrations/0173_auto_20201211_1648.py

@@ -0,0 +1,51 @@
+# Generated by Django 3.0.11 on 2020-12-11 16:48
+import json
+
+import phonenumber_field.modelfields
+from django.db import migrations
+
+import pretix.base.models.fields
+
+
+def migrate_settings(apps, schema_editor):
+    Order = apps.get_model('pretixbase', 'Order')
+    Event = apps.get_model('pretixbase', 'Event')
+    Event_SettingsStore = apps.get_model('pretixbase', 'Event_SettingsStore')
+    Event_SettingsStore.objects.filter(key='telephone_field_required').update(key='order_phone_required')
+    Event_SettingsStore.objects.filter(key='telephone_field_help_text').update(key='checkout_phone_helptext')
+    for e in Event.objects.filter(plugins__icontains="pretix_telephone"):
+        plugins = e.plugins.split(",")
+        plugins.remove("pretix_telephone")
+        e.plugins = ",".join(plugins)
+        e.save()
+        Event_SettingsStore.objects.create(object=e, key='order_phone_asked', value='True')
+    for o in Order.objects.filter(meta_info__icontains='"telephone"'):
+        mi = json.loads(o.meta_info)
+        if 'telephone' in mi.get('contact_form_data', {}):
+            mi['phone'] = mi['contact_form_data'].pop('telephone')
+            o.phone = mi['phone']
+            o.meta_info = json.dumps(mi)
+            o.save(update_fields=['meta_info', 'phone'])
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0172_event_sales_channels'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='order',
+            name='phone',
+            field=phonenumber_field.modelfields.PhoneNumberField(max_length=128, null=True, region=None),
+        ),
+        migrations.AlterField(
+            model_name='event',
+            name='sales_channels',
+            field=pretix.base.models.fields.MultiStringField(default=['web']),
+        ),
+        migrations.RunPython(
+            migrate_settings, migrations.RunPython.noop,
+        )
+    ]

src/pretix/base/migrations/0174_merge_20201222_1031.py

@@ -0,0 +1,14 @@
+# Generated by Django 3.0.11 on 2020-12-22 10:31
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0173_auto_20201211_1648'),
+        ('pretixbase', '0162b_auto_20201218_1810'),
+    ]
+
+    operations = [
+    ]

src/pretix/base/models/base.py

@@ -28,6 +28,8 @@ class CachedFile(models.Model):
     filename = models.CharField(max_length=255)
     type = models.CharField(max_length=255)
     file = models.FileField(null=True, blank=True, upload_to=cachedfile_name, max_length=255)
+    web_download = models.BooleanField(default=True)  # allow web download, True for backwards compatibility in plugins
+    session_key = models.TextField(null=True, blank=True)  # only allow download in this session
 
 
 @receiver(post_delete, sender=CachedFile)

src/pretix/base/models/checkin.py

@@ -20,7 +20,7 @@ class CheckinList(LoggedModel):
     include_pending = models.BooleanField(verbose_name=pgettext_lazy('checkin', 'Include pending orders'),
                                           default=False,
                                           help_text=_('With this option, people will be able to check in even if the '
-                                                      'order have not been paid.'))
+                                                      'order has not been paid.'))
     gates = models.ManyToManyField(
         'Gate', verbose_name=_("Gates"), blank=True,
         help_text=_("Does not have any effect for the validation of tickets, only for the automatic configuration of "

src/pretix/base/models/event.py

@@ -23,6 +23,7 @@ from django_scopes import ScopedManager, scopes_disabled
 from i18nfield.fields import I18nCharField, I18nTextField
 
 from pretix.base.models.base import LoggedModel
+from pretix.base.models.fields import MultiStringField
 from pretix.base.reldate import RelativeDateWrapper
 from pretix.base.validators import EventSlugBanlistValidator
 from pretix.helpers.database import GroupConcat
@@ -331,6 +332,8 @@ class Event(EventMixin, LoggedModel):
     :type plugins: str
     :param has_subevents: Enable event series functionality
     :type has_subevents: bool
+    :param sales_channels: A list of sales channel identifiers, that this event is available for sale on
+    :type sales_channels: list
     """
 
     settings_namespace = 'event'
@@ -409,7 +412,11 @@ class Event(EventMixin, LoggedModel):
     )
     seating_plan = models.ForeignKey('SeatingPlan', on_delete=models.PROTECT, null=True, blank=True,
                                      related_name='events')
-
+    sales_channels = MultiStringField(
+        verbose_name=_('Restrict to specific sales channels'),
+        help_text=_('Only sell tickets for this event on the following sales channels.'),
+        default=['web'],
+    )
     objects = ScopedManager(organizer='organizer')
 
     class Meta:
@@ -521,7 +528,7 @@ class Event(EventMixin, LoggedModel):
 
         return locking.LockManager(self)
 
-    def get_mail_backend(self, force_custom=False):
+    def get_mail_backend(self, timeout=None, force_custom=False):
         """
         Returns an email server connection, either by using the system-wide connection
         or by returning a custom one based on the event's settings.
@@ -535,7 +542,7 @@ class Event(EventMixin, LoggedModel):
                                      password=self.settings.smtp_password,
                                      use_tls=self.settings.smtp_use_tls,
                                      use_ssl=self.settings.smtp_use_ssl,
-                                     fail_silently=False)
+                                     fail_silently=False, timeout=timeout)
         else:
             return get_connection(fail_silently=False)
 

src/pretix/base/models/items.py

@@ -1084,6 +1084,18 @@ class Question(LoggedModel):
         'Question', null=True, blank=True, on_delete=models.SET_NULL, related_name='dependent_questions'
     )
     dependency_values = MultiStringField(default=[])
+    valid_number_min = models.DecimalField(decimal_places=6, max_digits=16, null=True, blank=True,
+                                           verbose_name=_('Minimum value'), help_text=_('Currently not supported in our apps'))
+    valid_number_max = models.DecimalField(decimal_places=6, max_digits=16, null=True, blank=True,
+                                           verbose_name=_('Maximum value'), help_text=_('Currently not supported in our apps'))
+    valid_date_min = models.DateField(null=True, blank=True,
+                                      verbose_name=_('Minimum value'), help_text=_('Currently not supported in our apps'))
+    valid_date_max = models.DateField(null=True, blank=True,
+                                      verbose_name=_('Maximum value'), help_text=_('Currently not supported in our apps'))
+    valid_datetime_min = models.DateTimeField(null=True, blank=True,
+                                              verbose_name=_('Minimum value'), help_text=_('Currently not supported in our apps'))
+    valid_datetime_max = models.DateTimeField(null=True, blank=True,
+                                              verbose_name=_('Maximum value'), help_text=_('Currently not supported in our apps'))
 
     objects = ScopedManager(organizer='event__organizer')
 
@@ -1173,14 +1185,24 @@ class Question(LoggedModel):
             answer = formats.sanitize_separators(answer)
             answer = str(answer).strip()
             try:
-                return Decimal(answer)
+                v = Decimal(answer)
+                if self.valid_number_min is not None and v < self.valid_number_min:
+                    raise ValidationError(_('The number is to low.'))
+                if self.valid_number_max is not None and v > self.valid_number_max:
+                    raise ValidationError(_('The number is to high.'))
+                return v
             except DecimalException:
                 raise ValidationError(_('Invalid number input.'))
         elif self.type == Question.TYPE_DATE:
             if isinstance(answer, date):
                 return answer
             try:
-                return dateutil.parser.parse(answer).date()
+                dt = dateutil.parser.parse(answer).date()
+                if self.valid_date_min is not None and dt < self.valid_date_min:
+                    raise ValidationError(_('Please choose a later date.'))
+                if self.valid_date_max is not None and dt > self.valid_date_max:
+                    raise ValidationError(_('Please choose an earlier date.'))
+                return dt
             except:
                 raise ValidationError(_('Invalid date input.'))
         elif self.type == Question.TYPE_TIME:
@@ -1197,9 +1219,14 @@ class Question(LoggedModel):
                 dt = dateutil.parser.parse(answer)
                 if is_naive(dt):
                     dt = make_aware(dt, pytz.timezone(self.event.settings.timezone))
-                return dt
             except:
                 raise ValidationError(_('Invalid datetime input.'))
+            else:
+                if self.valid_datetime_min is not None and dt < self.valid_datetime_min:
+                    raise ValidationError(_('Please choose a later date.'))
+                if self.valid_datetime_max is not None and dt > self.valid_datetime_max:
+                    raise ValidationError(_('Please choose an earlier date.'))
+                return dt
         elif self.type == Question.TYPE_COUNTRYCODE and answer:
             c = Country(answer.upper())
             if c.name:

src/pretix/base/models/orders.py

@@ -31,6 +31,7 @@ from django_countries.fields import Country
 from django_scopes import ScopedManager, scopes_disabled
 from i18nfield.strings import LazyI18nString
 from jsonfallback.fields import FallbackJSONField
+from phonenumber_field.modelfields import PhoneNumberField
 from phonenumber_field.phonenumber import PhoneNumber
 from phonenumbers import NumberParseException
 
@@ -86,6 +87,8 @@ class Order(LockModel, LoggedModel):
     :type event: Event
     :param email: The email of the person who ordered this
     :type email: str
+    :param phone: The phone number of the person who ordered this
+    :type phone: str
     :param testmode: Whether this is a test mode order
     :type testmode: bool
     :param locale: The locale of this order
@@ -144,6 +147,10 @@ class Order(LockModel, LoggedModel):
         null=True, blank=True,
         verbose_name=_('E-mail')
     )
+    phone = PhoneNumberField(
+        null=True, blank=True,
+        verbose_name=_('Phone number'),
+    )
     locale = models.CharField(
         null=True, blank=True, max_length=32,
         verbose_name=_('Locale')
@@ -326,6 +333,9 @@ class Order(LockModel, LoggedModel):
                 payment_sum=payment_sum_sq,
                 refund_sum=refund_sum_sq,
             )
+            qs = qs.annotate(
+                computed_payment_refund_sum=Coalesce(payment_sum_sq, 0) - Coalesce(refund_sum_sq, 0),
+            )
 
         qs = qs.annotate(
             pending_sum_t=F('total') - Coalesce(payment_sum_sq, 0) + Coalesce(refund_sum_sq, 0),
@@ -639,7 +649,7 @@ class Order(LockModel, LoggedModel):
                 return
 
             if iteration > 20:
-                # Safeguard: If we don't find an unused and non-blacklisted code within 20 iterations, we increase
+                # Safeguard: If we don't find an unused and non-banlisted code within 20 iterations, we increase
                 # the length.
                 length += 1
                 iteration = 0
@@ -857,7 +867,7 @@ class Order(LockModel, LoggedModel):
         for k, v in self.event.meta_data.items():
             context['meta_' + k] = v
 
-        with language(self.locale):
+        with language(self.locale, self.event.settings.region):
             recipient = self.email
             if position and position.attendee_email:
                 recipient = position.attendee_email
@@ -890,7 +900,7 @@ class Order(LockModel, LoggedModel):
                 )
 
     def resend_link(self, user=None, auth=None):
-        with language(self.locale):
+        with language(self.locale, self.event.settings.region):
             email_template = self.event.settings.mail_text_resend_link
             email_context = get_email_context(event=self.event, order=self)
             email_subject = _('Your order: %(code)s') % {'code': self.code}
@@ -902,7 +912,7 @@ class Order(LockModel, LoggedModel):
 
     @property
     def positions_with_tickets(self):
-        for op in self.positions.all():
+        for op in self.positions.select_related('item'):
             if not op.generate_ticket:
                 continue
             yield op
@@ -1155,7 +1165,7 @@ class AbstractPosition(models.Model):
         (2) questions: a list of Question objects, extended by an 'answer' property
         """
         self.answ = {}
-        for a in self.answers.all():
+        for a in getattr(self, 'answerlist', self.answers.all()):  # use prefetch_related cache from get_cart
             self.answ[a.question_id] = a
 
         # We need to clone our question objects, otherwise we will override the cached
@@ -1514,7 +1524,7 @@ class OrderPayment(models.Model):
     def _send_paid_mail_attendee(self, position, user):
         from pretix.base.services.mail import SendMailException
 
-        with language(self.order.locale):
+        with language(self.order.locale, self.order.event.settings.region):
             email_template = self.order.event.settings.mail_text_order_paid_attendee
             email_context = get_email_context(event=self.order.event, order=self.order, position=position)
             email_subject = _('Event registration confirmed: %(code)s') % {'code': self.order.code}
@@ -1532,7 +1542,7 @@ class OrderPayment(models.Model):
     def _send_paid_mail(self, invoice, user, mail_text):
         from pretix.base.services.mail import SendMailException
 
-        with language(self.order.locale):
+        with language(self.order.locale, self.order.event.settings.region):
             email_template = self.order.event.settings.mail_text_order_paid
             email_context = get_email_context(event=self.order.event, order=self.order, payment_info=mail_text)
             email_subject = _('Payment received for your order: %(code)s') % {'code': self.order.code}
@@ -1874,7 +1884,7 @@ class OrderFee(models.Model):
             self.tax_rule = self.order.event.settings.tax_rate_default
 
         if self.tax_rule:
-            tax = self.tax_rule.tax(self.value, base_price_is='gross', invoice_address=ia)
+            tax = self.tax_rule.tax(self.value, base_price_is='gross', invoice_address=ia, force_fixed_gross_price=True)
             self.tax_rate = tax.rate
             self.tax_value = tax.tax
         else:
@@ -2026,9 +2036,11 @@ class OrderPosition(AbstractPosition):
         except InvoiceAddress.DoesNotExist:
             ia = None
         if self.tax_rule:
-            tax = self.tax_rule.tax(self.price, invoice_address=ia, base_price_is='gross')
+            tax = self.tax_rule.tax(self.price, invoice_address=ia, base_price_is='gross', force_fixed_gross_price=True)
             self.tax_rate = tax.rate
             self.tax_value = tax.tax
+            if tax.gross != self.price:
+                raise ValueError('Invalid tax calculation')
         else:
             self.tax_value = Decimal('0.00')
             self.tax_rate = Decimal('0.00')
@@ -2038,6 +2050,7 @@ class OrderPosition(AbstractPosition):
 
         if self.tax_rate is None:
             self._calculate_tax()
+
         self.order.touch()
         if not self.pk:
             while not self.secret or OrderPosition.all.filter(
@@ -2101,7 +2114,7 @@ class OrderPosition(AbstractPosition):
         for k, v in self.event.meta_data.items():
             context['meta_' + k] = v
 
-        with language(self.order.locale):
+        with language(self.order.locale, self.order.event.settings.region):
             recipient = self.attendee_email
             try:
                 email_content = render_mail(template, context)
@@ -2129,7 +2142,7 @@ class OrderPosition(AbstractPosition):
 
     def resend_link(self, user=None, auth=None):
 
-        with language(self.order.locale):
+        with language(self.order.locale, self.order.event.settings.region):
             email_template = self.event.settings.mail_text_resend_link
             email_context = get_email_context(event=self.order.event, order=self.order, position=self)
             email_subject = _('Your event registration: %(code)s') % {'code': self.order.code}

src/pretix/base/models/tax.py

@@ -5,8 +5,9 @@ from django.core.exceptions import ValidationError
 from django.db import models
 from django.utils.formats import localize
 from django.utils.timezone import get_current_timezone, now
-from django.utils.translation import gettext_lazy as _
+from django.utils.translation import gettext_lazy as _, pgettext
 from i18nfield.fields import I18nCharField
+from i18nfield.strings import LazyI18nString
 
 from pretix.base.decimal import round_decimal
 from pretix.base.models.base import LoggedModel
@@ -188,7 +189,7 @@ class TaxRule(LoggedModel):
         return Decimal(self.rate)
 
     def tax(self, base_price, base_price_is='auto', currency=None, override_tax_rate=None, invoice_address=None,
-            subtract_from_gross=Decimal('0.00'), gross_price_is_tax_rate: Decimal = None):
+            subtract_from_gross=Decimal('0.00'), gross_price_is_tax_rate: Decimal = None, force_fixed_gross_price=False):
         from .event import Event
         try:
             currency = currency or self.event.currency
@@ -200,7 +201,7 @@ class TaxRule(LoggedModel):
             rate = override_tax_rate
         elif invoice_address:
             adjust_rate = self.tax_rate_for(invoice_address)
-            if adjust_rate == gross_price_is_tax_rate and base_price_is == 'gross':
+            if (adjust_rate == gross_price_is_tax_rate or force_fixed_gross_price) and base_price_is == 'gross':
                 rate = adjust_rate
             elif adjust_rate != rate:
                 normal_price = self.tax(base_price, base_price_is, currency, subtract_from_gross=subtract_from_gross)
@@ -268,6 +269,25 @@ class TaxRule(LoggedModel):
                 return r
         return {'action': 'vat'}
 
+    def invoice_text(self, invoice_address):
+        if self._custom_rules:
+            rule = self.get_matching_rule(invoice_address)
+            t = rule.get('invoice_text', {})
+            if t and any(l for l in t.values()):
+                return str(LazyI18nString(t))
+        if self.is_reverse_charge(invoice_address):
+            if is_eu_country(invoice_address.country):
+                return pgettext(
+                    "invoice",
+                    "Reverse Charge: According to Article 194, 196 of Council Directive 2006/112/EEC, VAT liability "
+                    "rests with the service recipient."
+                )
+            else:
+                return pgettext(
+                    "invoice",
+                    "VAT liability rests with the service recipient."
+                )
+
     def is_reverse_charge(self, invoice_address):
         if self._custom_rules:
             rule = self.get_matching_rule(invoice_address)

src/pretix/base/models/waitinglist.py

@@ -125,7 +125,7 @@ class WaitingListEntry(LoggedModel):
             self.voucher = v
             self.save()
 
-        with language(self.locale):
+        with language(self.locale, self.event.settings.region):
             mail(
                 self.email,
                 _('You have been selected from the waitinglist for {event}').format(event=str(self.event)),

src/pretix/base/pdf.py

@@ -39,6 +39,7 @@ from pretix.base.models import Order, OrderPosition
 from pretix.base.settings import PERSON_NAME_SCHEMES
 from pretix.base.signals import layout_text_variables
 from pretix.base.templatetags.money import money_filter
+from pretix.base.templatetags.phone_format import phone_format
 from pretix.presale.style import get_fonts
 
 logger = logging.getLogger(__name__)
@@ -121,6 +122,26 @@ DEFAULT_VARIABLES = OrderedDict((
         'editor_sample': _('John Doe\nSample company\nSesame Street 42\n12345 Any City\nAtlantis'),
         'evaluate': lambda op, order, event: op.address_format()
     }),
+    ("attendee_street", {
+        "label": _("Attendee street"),
+        "editor_sample": 'Sesame Street 42',
+        "evaluate": lambda op, order, ev: op.street or (op.addon_to.street if op.addon_to else '')
+    }),
+    ("attendee_zipcode", {
+        "label": _("Attendee ZIP code"),
+        "editor_sample": '12345',
+        "evaluate": lambda op, order, ev: op.zipcode or (op.addon_to.zipcode if op.addon_to else '')
+    }),
+    ("attendee_city", {
+        "label": _("Attendee city"),
+        "editor_sample": 'Any City',
+        "evaluate": lambda op, order, ev: op.city or (op.addon_to.city if op.addon_to else '')
+    }),
+    ("attendee_state", {
+        "label": _("Attendee state"),
+        "editor_sample": 'Sample State',
+        "evaluate": lambda op, order, ev: op.state or (op.addon_to.state if op.addon_to else '')
+    }),
     ("attendee_country", {
         "label": _("Attendee country"),
         "editor_sample": 'Atlantis',
@@ -209,6 +230,11 @@ DEFAULT_VARIABLES = OrderedDict((
         "editor_sample": _("Random City"),
         "evaluate": lambda op, order, ev: str(ev.location)
     }),
+    ("telephone", {
+        "label": _("Phone number"),
+        "editor_sample": "+01 1234 567890",
+        "evaluate": lambda op, order, ev: phone_format(order.phone)
+    }),
     ("invoice_name", {
         "label": _("Invoice address name"),
         "editor_sample": _("John Doe"),
@@ -219,11 +245,31 @@ DEFAULT_VARIABLES = OrderedDict((
         "editor_sample": _("Sample company"),
         "evaluate": lambda op, order, ev: order.invoice_address.company if getattr(order, 'invoice_address', None) else ''
     }),
+    ("invoice_street", {
+        "label": _("Invoice address street"),
+        "editor_sample": _("Sesame Street 42"),
+        "evaluate": lambda op, order, ev: order.invoice_address.street if getattr(order, 'invoice_address', None) else ''
+    }),
+    ("invoice_zipcode", {
+        "label": _("Invoice address ZIP code"),
+        "editor_sample": _("12345"),
+        "evaluate": lambda op, order, ev: order.invoice_address.zipcode if getattr(order, 'invoice_address', None) else ''
+    }),
     ("invoice_city", {
         "label": _("Invoice address city"),
         "editor_sample": _("Sample city"),
         "evaluate": lambda op, order, ev: order.invoice_address.city if getattr(order, 'invoice_address', None) else ''
     }),
+    ("invoice_state", {
+        "label": _("Invoice address state"),
+        "editor_sample": _("Sample State"),
+        "evaluate": lambda op, order, ev: order.invoice_address.state if getattr(order, 'invoice_address', None) else ''
+    }),
+    ("invoice_country", {
+        "label": _("Invoice address country"),
+        "editor_sample": _("Atlantis"),
+        "evaluate": lambda op, order, ev: str(getattr(order.invoice_address.country, 'name', '')) if getattr(order, 'invoice_address', None) else ''
+    }),
     ("addons", {
         "label": _("List of Add-Ons"),
         "editor_sample": _("Add-on 1\nAdd-on 2"),
@@ -381,6 +427,7 @@ class Renderer:
         self.layout = layout
         self.background_file = background_file
         self.variables = get_variables(event)
+        self.event = event
         if self.background_file:
             self.bg_bytes = self.background_file.read()
             self.bg_pdf = PdfFileReader(BytesIO(self.bg_bytes), strict=False)
@@ -447,7 +494,7 @@ class Renderer:
 
     def _get_text_content(self, op: OrderPosition, order: Order, o: dict, inner=False):
         if o.get('locale', None) and not inner:
-            with language(o['locale']):
+            with language(o['locale'], self.event.settings.region):
                 return self._get_text_content(op, order, o, True)
 
         ev = self._get_ev(op, order)

src/pretix/base/services/cancelevent.py

@@ -24,7 +24,7 @@ logger = logging.getLogger(__name__)
 
 
 def _send_wle_mail(wle: WaitingListEntry, subject: LazyI18nString, message: LazyI18nString, subevent: SubEvent):
-    with language(wle.locale):
+    with language(wle.locale, wle.event.settings.region):
         email_context = get_email_context(event_or_subevent=subevent or wle.event, event=wle.event)
         try:
             mail(
@@ -41,7 +41,7 @@ def _send_wle_mail(wle: WaitingListEntry, subject: LazyI18nString, message: Lazy
 
 def _send_mail(order: Order, subject: LazyI18nString, message: LazyI18nString, subevent: SubEvent,
                refund_amount: Decimal, user: User, positions: list):
-    with language(order.locale):
+    with language(order.locale, order.event.settings.region):
         try:
             ia = order.invoice_address
         except InvoiceAddress.DoesNotExist:

src/pretix/base/services/export.py

@@ -32,7 +32,7 @@ def export(self, event: Event, fileid: str, provider: str, form_data: Dict[str,
             )
 
     file = CachedFile.objects.get(id=fileid)
-    with language(event.settings.locale), override(event.settings.timezone):
+    with language(event.settings.locale, event.settings.region), override(event.settings.timezone):
         responses = register_data_exporters.send(event)
         for receiver, response in responses:
             ex = response(event, set_progress)
@@ -67,15 +67,18 @@ def multiexport(self, organizer: Organizer, user: User, device: int, token: int,
     if user:
         locale = user.locale
         timezone = user.timezone
+        region = None  # todo: add to user?
     else:
         e = allowed_events.first()
         if e:
             locale = e.settings.locale
             timezone = e.settings.timezone
+            region = e.settings.region
         else:
             locale = settings.LANGUAGE_CODE
             timezone = settings.TIME_ZONE
-    with language(locale), override(timezone):
+            region = None
+    with language(locale, region), override(timezone):
         if isinstance(form_data['events'][0], str):
             events = allowed_events.filter(slug__in=form_data.get('events'), organizer=organizer)
         else:

src/pretix/base/services/invoices.py

@@ -24,7 +24,7 @@ from pretix.base.i18n import language
 from pretix.base.models import (
     Invoice, InvoiceAddress, InvoiceLine, Order, OrderFee,
 )
-from pretix.base.models.tax import EU_CURRENCIES, is_eu_country
+from pretix.base.models.tax import EU_CURRENCIES
 from pretix.base.services.tasks import TransactionAwareTask
 from pretix.base.settings import GlobalSettingsObject
 from pretix.base.signals import invoice_line_text, periodic_task
@@ -43,7 +43,7 @@ def build_invoice(invoice: Invoice) -> Invoice:
 
     lp = invoice.order.payments.last()
 
-    with language(invoice.locale):
+    with language(invoice.locale, invoice.event.settings.region):
         invoice.invoice_from = invoice.event.settings.get('invoice_address_from')
         invoice.invoice_from_name = invoice.event.settings.get('invoice_address_from_name')
         invoice.invoice_from_zipcode = invoice.event.settings.get('invoice_address_from_zipcode')
@@ -142,6 +142,8 @@ def build_invoice(invoice: Invoice) -> Invoice:
         reverse_charge = False
 
         positions.sort(key=lambda p: p.sort_key)
+
+        tax_texts = []
         for i, p in enumerate(positions):
             if not invoice.event.settings.invoice_include_free and p.price == Decimal('0.00') and not p.addon_c:
                 continue
@@ -178,22 +180,10 @@ def build_invoice(invoice: Invoice) -> Invoice:
             if p.tax_rule and p.tax_rule.is_reverse_charge(ia) and p.price and not p.tax_value:
                 reverse_charge = True
 
-        if reverse_charge:
+            if p.tax_rule:
-            if invoice.additional_text:
+                tax_text = p.tax_rule.invoice_text(ia)
-                invoice.additional_text += "<br /><br />"
+                if tax_text and tax_text not in tax_texts:
-            if is_eu_country(invoice.invoice_to_country):
+                    tax_texts.append(tax_text)
-                invoice.additional_text += pgettext(
-                    "invoice",
-                    "Reverse Charge: According to Article 194, 196 of Council Directive 2006/112/EEC, VAT liability "
-                    "rests with the service recipient."
-                )
-            else:
-                invoice.additional_text += pgettext(
-                    "invoice",
-                    "VAT liability rests with the service recipient."
-                )
-            invoice.reverse_charge = True
-            invoice.save()
 
         offset = len(positions)
         for i, fee in enumerate(invoice.order.fees.all()):
@@ -213,6 +203,20 @@ def build_invoice(invoice: Invoice) -> Invoice:
                 tax_name=fee.tax_rule.name if fee.tax_rule else ''
             )
 
+            if fee.tax_rule and fee.tax_rule.is_reverse_charge(ia) and fee.value and not fee.tax_value:
+                reverse_charge = True
+
+            if fee.tax_rule:
+                tax_text = fee.tax_rule.invoice_text(ia)
+                if tax_text and tax_text not in tax_texts:
+                    tax_texts.append(tax_text)
+
+        if tax_texts:
+            invoice.additional_text += "<br /><br />"
+            invoice.additional_text += "<br />".join(tax_texts)
+        invoice.reverse_charge = reverse_charge
+        invoice.save()
+
         return invoice
 
 
@@ -240,7 +244,7 @@ def generate_cancellation(invoice: Invoice, trigger_pdf=True):
     cancellation.date = timezone.now().date()
     cancellation.payment_provider_text = ''
     cancellation.file = None
-    with language(invoice.locale):
+    with language(invoice.locale, invoice.event.settings.region):
         cancellation.invoice_from = invoice.event.settings.get('invoice_address_from')
         cancellation.invoice_from_name = invoice.event.settings.get('invoice_address_from_name')
         cancellation.invoice_from_zipcode = invoice.event.settings.get('invoice_address_from_zipcode')
@@ -293,7 +297,7 @@ def invoice_pdf_task(invoice: int):
             return None
         if i.file:
             i.file.delete()
-        with language(i.locale):
+        with language(i.locale, i.event.settings.region):
             fname, ftype, fcontent = i.event.invoice_renderer.generate(i)
             i.file.save(fname, ContentFile(fcontent))
             i.save()
@@ -324,7 +328,7 @@ def build_preview_invoice_pdf(event):
     if not locale or locale == '__user__':
         locale = event.settings.locale
 
-    with rolledback_transaction(), language(locale):
+    with rolledback_transaction(), language(locale, event.settings.region):
         order = event.orders.create(status=Order.STATUS_PENDING, datetime=timezone.now(),
                                     expires=timezone.now(), code="PREVIEW", total=100 * event.tax_rules.count())
         invoice = Invoice(

src/pretix/base/services/mail.py

@@ -290,7 +290,7 @@ def mail_send_task(self, *args, to: List[str], subject: str, body: str, html: st
                 except Order.DoesNotExist:
                     order = None
                 else:
-                    with language(order.locale):
+                    with language(order.locale, event.settings.region):
                         if position:
                             try:
                                 position = order.positions.get(pk=position)

src/pretix/base/services/orderimport.py

@@ -65,7 +65,7 @@ def import_orders(event: Event, fileid: str, settings: dict, locale: str, user)
     # TODO: quotacheck?
     cf = CachedFile.objects.get(id=fileid)
     user = User.objects.get(pk=user)
-    with language(locale):
+    with language(locale, event.settings.region):
         cols = get_all_columns(event)
         parsed = parse_csv(cf.file)
         orders = []
@@ -163,7 +163,7 @@ def import_orders(event: Event, fileid: str, settings: dict, locale: str, user)
                     )
 
             for o in orders:
-                with language(o.locale):
+                with language(o.locale, event.settings.region):
                     order_placed.send(event, order=o)
                     if o.status == Order.STATUS_PAID:
                         order_paid.send(event, order=o)

src/pretix/base/services/orders.py

@@ -23,7 +23,9 @@ from django_scopes import scopes_disabled
 from pretix.api.models import OAuthApplication
 from pretix.base.channels import get_all_sales_channels
 from pretix.base.email import get_email_context
-from pretix.base.i18n import LazyLocaleException, language
+from pretix.base.i18n import (
+    LazyLocaleException, get_language_without_region, language,
+)
 from pretix.base.models import (
     CartPosition, Device, Event, GiftCard, Item, ItemVariation, Order,
     OrderPayment, OrderPosition, Quota, Seat, SeatCategoryMapping, User,
@@ -260,7 +262,7 @@ def approve_order(order, user=None, send_mail: bool=True, auth=None, force=False
             # send_mail will trigger PDF generation later
 
     if send_mail:
-        with language(order.locale):
+        with language(order.locale, order.event.settings.region):
             if order.total == Decimal('0.00'):
                 email_template = order.event.settings.mail_text_order_approved_free
                 email_subject = _('Order approved and confirmed: %(code)s') % {'code': order.code}
@@ -311,7 +313,7 @@ def deny_order(order, comment='', user=None, send_mail: bool=True, auth=None):
     if send_mail:
         email_template = order.event.settings.mail_text_order_denied
         email_context = get_email_context(event=order.event, order=order, comment=comment)
-        with language(order.locale):
+        with language(order.locale, order.event.settings.region):
             email_subject = _('Order denied: %(code)s') % {'code': order.code}
             try:
                 order.send_mail(
@@ -422,7 +424,7 @@ def _cancel_order(order, user=None, send_mail: bool=True, api_token=None, device
 
         if send_mail:
             email_template = order.event.settings.mail_text_order_canceled
-            with language(order.locale):
+            with language(order.locale, order.event.settings.region):
                 email_context = get_email_context(event=order.event, order=order)
                 email_subject = _('Order canceled: %(code)s') % {'code': order.code}
                 try:
@@ -776,8 +778,9 @@ def _create_order(event: Event, email: str, positions: List[CartPosition], now_d
             status=Order.STATUS_PENDING,
             event=event,
             email=email,
+            phone=(meta_info or {}).get('contact_form_data', {}).get('phone'),
             datetime=now_dt,
-            locale=locale,
+            locale=get_language_without_region(locale),
             total=total,
             testmode=True if sales_channel.testmode_supported and event.testmode else False,
             meta_info=json.dumps(meta_info or {}),
@@ -1033,7 +1036,7 @@ def send_expiry_warnings(sender, **kwargs):
                     # Race condition
                     continue
 
-                with language(o.locale):
+                with language(o.locale, settings.region):
                     o.expiry_reminder_sent = True
                     o.save(update_fields=['expiry_reminder_sent'])
                     email_template = settings.mail_text_order_expire_warning
@@ -1110,7 +1113,7 @@ def send_download_reminders(sender, **kwargs):
             if not send:
                 continue
 
-            with language(o.locale):
+            with language(o.locale, o.event.settings.region):
                 o.download_reminder_sent = True
                 o.save(update_fields=['download_reminder_sent'])
                 email_template = event.settings.mail_text_download_reminder
@@ -1150,7 +1153,7 @@ def send_download_reminders(sender, **kwargs):
 
 
 def notify_user_changed_order(order, user=None, auth=None, invoices=[]):
-    with language(order.locale):
+    with language(order.locale, order.event.settings.region):
         email_template = order.event.settings.mail_text_order_changed
         email_context = get_email_context(event=order.event, order=order)
         email_subject = _('Your order has been changed: %(code)s') % {'code': order.code}

src/pretix/base/services/quotas.py

@@ -113,10 +113,11 @@ class QuotaAvailability:
                 raise e
 
     def _write_cache(self, quotas, now_dt):
-        events = {q.event for q in quotas}
+        # We used to also delete item_quota_cache:* from the event cache here, but as the cache
+        # gets more complex, this does not seem worth it. The cache is only present for up to
+        # 5 seconds to prevent high peaks, and a 5-second delay in availability is usually
+        # tolerable
         update = []
-        for e in events:
-            e.cache.delete('item_quota_cache')
         for q in quotas:
             rewrite_cache = self._count_waitinglist and (
                 not q.cache_is_hot(now_dt) or self.results[q][0] > q.cached_availability_state

src/pretix/base/services/shredder.py

@@ -17,7 +17,7 @@ from pretix.celery_app import app
 
 
 @app.task(base=ProfiledEventTask)
-def export(event: Event, shredders: List[str]) -> None:
+def export(event: Event, shredders: List[str], session_key=None) -> None:
     known_shredders = event.get_data_shredders()
 
     with NamedTemporaryFile() as rawfile:
@@ -55,6 +55,8 @@ def export(event: Event, shredders: List[str]) -> None:
         cf.date = now()
         cf.filename = event.slug + '.zip'
         cf.type = 'application/zip'
+        cf.session_key = session_key
+        cf.web_download = True
         cf.expires = now() + timedelta(hours=1)
         cf.save()
         cf.file.save(cachedfile_name(cf, cf.filename), rawfile)

src/pretix/base/services/tickets.py

@@ -23,7 +23,7 @@ logger = logging.getLogger(__name__)
 def generate_orderposition(order_position: int, provider: str):
     order_position = OrderPosition.objects.select_related('order', 'order__event').get(id=order_position)
 
-    with language(order_position.order.locale):
+    with language(order_position.order.locale, order_position.order.event.settings.region):
         responses = register_ticket_outputs.send(order_position.order.event)
         for receiver, response in responses:
             prov = response(order_position.order.event)
@@ -41,7 +41,7 @@ def generate_orderposition(order_position: int, provider: str):
 def generate_order(order: int, provider: str):
     order = Order.objects.select_related('event').get(id=order)
 
-    with language(order.locale):
+    with language(order.locale, order.event.settings.region):
         responses = register_ticket_outputs.send(order.event)
         for receiver, response in responses:
             prov = response(order.event)
@@ -75,7 +75,7 @@ class DummyRollbackException(Exception):
 def preview(event: int, provider: str):
     event = Event.objects.get(id=event)
 
-    with rolledback_transaction(), language(event.settings.locale):
+    with rolledback_transaction(), language(event.settings.locale, event.settings.region):
         item = event.items.create(name=_("Sample product"), default_price=42.23,
                                   description=_("Sample product description"))
         item2 = event.items.create(name=_("Sample workshop"), default_price=23.40)

src/pretix/base/settings.py

@@ -9,7 +9,9 @@ from django import forms
 from django.conf import settings
 from django.core.exceptions import ValidationError
 from django.core.files import File
-from django.core.validators import MaxValueValidator, MinValueValidator
+from django.core.validators import (
+    MaxValueValidator, MinValueValidator, RegexValidator,
+)
 from django.db.models import Model
 from django.utils.translation import (
     gettext_lazy as _, gettext_noop, pgettext, pgettext_lazy,
@@ -26,7 +28,9 @@ from pretix.base.reldate import (
     RelativeDateField, RelativeDateTimeField, RelativeDateWrapper,
     SerializerRelativeDateField, SerializerRelativeDateTimeField,
 )
-from pretix.control.forms import MultipleLanguagesWidget, SingleLanguageWidget
+from pretix.control.forms import (
+    FontSelect, MultipleLanguagesWidget, SingleLanguageWidget,
+)
 from pretix.helpers.countries import CachedCountries
 
 
@@ -38,6 +42,18 @@ def country_choice_kwargs():
     }
 
 
+def primary_font_kwargs():
+    from pretix.presale.style import get_fonts
+
+    choices = [('Open Sans', 'Open Sans')]
+    choices += [
+        (a, {"title": a, "data": v}) for a, v in get_fonts().items()
+    ]
+    return {
+        'choices': choices,
+    }
+
+
 class LazyI18nStringList(UserList):
     def __init__(self, init_list=None):
         super().__init__()
@@ -177,6 +193,25 @@ DEFAULTS = {
             help_text=_("Require customers to fill in the primary email address twice to avoid errors."),
         )
     },
+    'order_phone_asked': {
+        'default': 'False',
+        'type': bool,
+        'form_class': forms.BooleanField,
+        'serializer_class': serializers.BooleanField,
+        'form_kwargs': dict(
+            label=_("Ask for a phone number per order"),
+        )
+    },
+    'order_phone_required': {
+        'default': 'False',
+        'type': bool,
+        'form_class': forms.BooleanField,
+        'serializer_class': serializers.BooleanField,
+        'form_kwargs': dict(
+            label=_("Require a phone number per order"),
+            widget=forms.CheckboxInput(attrs={'data-checkbox-dependency': '#id_settings-order_phone_asked'}),
+        )
+    },
     'invoice_address_asked': {
         'default': 'True',
         'type': bool,
@@ -252,7 +287,6 @@ DEFAULTS = {
         'form_kwargs': dict(
             label=_("Ask for beneficiary"),
             widget=forms.CheckboxInput(attrs={'data-checkbox-dependency': '#id_invoice_address_asked'}),
-            required=False
         )
     },
     'invoice_address_custom_field': {
@@ -421,7 +455,6 @@ DEFAULTS = {
             widget_kwargs={'attrs': {
                 'rows': 3,
             }},
-            required=False,
             label=_("Guidance text"),
             help_text=_("This text will be shown above the payment options. You can explain the choices to the user here, "
                         "if you want.")
@@ -441,7 +474,6 @@ DEFAULTS = {
         'form_kwargs': dict(
             label=_("Set payment term"),
             widget=forms.RadioSelect,
-            required=True,
             choices=(
                 ('days', _("in days")),
                 ('minutes', _("in minutes"))
@@ -488,7 +520,6 @@ DEFAULTS = {
             widget=forms.CheckboxInput(
                 attrs={
                     'data-display-dependency': '#id_payment_term_mode_0',
-                    'data-required-if': '#id_payment_term_mode_0'
                 },
             ),
         )
@@ -541,6 +572,18 @@ DEFAULTS = {
                         "the pool and can be ordered by other people."),
         )
     },
+    'payment_pending_hidden': {
+        'default': 'False',
+        'type': bool,
+        'form_class': forms.BooleanField,
+        'serializer_class': serializers.BooleanField,
+        'form_kwargs': dict(
+            label=_('Hide "payment pending" state on customer-facing pages'),
+            help_text=_("The payment instructions panel will still be shown to the primary customer, but no indication "
+                        "of missing payment will be visible on the ticket pages of attendees who did not buy the ticket "
+                        "themselves.")
+        )
+    },
     'payment_giftcard__enabled': {
         'default': 'True',
         'type': bool
@@ -808,6 +851,20 @@ DEFAULTS = {
             label=_("Default language"),
         )
     },
+    'region': {
+        'default': None,
+        'type': str,
+        'form_class': forms.ChoiceField,
+        'serializer_class': serializers.ChoiceField,
+        'serializer_kwargs': lambda: dict(**country_choice_kwargs()),
+        'form_kwargs': lambda: dict(
+            label=_('Region'),
+            help_text=_('Will be used to determine date and time formatting as well as default country for customer '
+                        'addresses and phone numbers. For formatting, this takes less priority than the language and '
+                        'is therefore mostly relevant for languages used in different regions globally (like English).'),
+            **country_choice_kwargs()
+        ),
+    },
     'show_dates_on_frontpage': {
         'default': 'True',
         'type': bool,
@@ -990,7 +1047,16 @@ DEFAULTS = {
     },
     'event_list_availability': {
         'default': 'True',
-        'type': bool
+        'type': bool,
+        'serializer_class': serializers.BooleanField,
+        'form_class': forms.BooleanField,
+        'form_kwargs': dict(
+            label=_('Show availability in event overviews'),
+            help_text=_('If checked, the list of events will show if events are sold out. This might '
+                        'make for longer page loading times if you have lots of events and the shown status might be out '
+                        'of date for up to two minutes.'),
+            required=False
+        )
     },
     'event_list_type': {
         'default': 'list',
@@ -1599,26 +1665,106 @@ Your {event} team"""))
     'primary_color': {
         'default': settings.PRETIX_PRIMARY_COLOR,
         'type': str,
+        'form_class': forms.CharField,
+        'serializer_class': serializers.CharField,
+        'serializer_kwargs': dict(
+            validators=[
+                RegexValidator(regex='^#[0-9a-fA-F]{6}$',
+                               message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
+            ],
+        ),
+        'form_kwargs': dict(
+            label=_("Primary color"),
+            validators=[
+                RegexValidator(regex='^#[0-9a-fA-F]{6}$',
+                               message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
+            ],
+            widget=forms.TextInput(attrs={'class': 'colorpickerfield'})
+        ),
     },
     'theme_color_success': {
         'default': '#50A167',
-        'type': str
+        'type': str,
+        'form_class': forms.CharField,
+        'serializer_class': serializers.CharField,
+        'serializer_kwargs': dict(
+            validators=[
+                RegexValidator(regex='^#[0-9a-fA-F]{6}$',
+                               message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
+            ],
+        ),
+        'form_kwargs': dict(
+            label=_("Accent color for success"),
+            help_text=_("We strongly suggest to use a shade of green."),
+            validators=[
+                RegexValidator(regex='^#[0-9a-fA-F]{6}$',
+                               message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
+            ],
+            widget=forms.TextInput(attrs={'class': 'colorpickerfield'})
+        ),
     },
     'theme_color_danger': {
         'default': '#D36060',
-        'type': str
+        'type': str,
+        'form_class': forms.CharField,
+        'serializer_class': serializers.CharField,
+        'serializer_kwargs': dict(
+            validators=[
+                RegexValidator(regex='^#[0-9a-fA-F]{6}$',
+                               message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
+            ],
+        ),
+        'form_kwargs': dict(
+            label=_("Accent color for errors"),
+            help_text=_("We strongly suggest to use a shade of red."),
+            validators=[
+                RegexValidator(regex='^#[0-9a-fA-F]{6}$',
+                               message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
+            ],
+            widget=forms.TextInput(attrs={'class': 'colorpickerfield'})
+        ),
     },
     'theme_color_background': {
         'default': '#FFFFFF',
-        'type': str
+        'type': str,
+        'form_class': forms.CharField,
+        'serializer_class': serializers.CharField,
+        'serializer_kwargs': dict(
+            validators=[
+                RegexValidator(regex='^#[0-9a-fA-F]{6}$',
+                               message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
+            ],
+        ),
+        'form_kwargs': dict(
+            label=_("Page background color"),
+            validators=[
+                RegexValidator(regex='^#[0-9a-fA-F]{6}$',
+                               message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
+            ],
+            widget=forms.TextInput(attrs={'class': 'colorpickerfield no-contrast'})
+        ),
     },
     'theme_round_borders': {
         'default': 'True',
-        'type': bool
+        'type': bool,
+        'form_class': forms.BooleanField,
+        'serializer_class': serializers.BooleanField,
+        'form_kwargs': dict(
+            label=_("Use round edges"),
+        )
     },
     'primary_font': {
         'default': 'Open Sans',
-        'type': str
+        'type': str,
+        'form_class': forms.ChoiceField,
+        'serializer_class': serializers.ChoiceField,
+        'serializer_kwargs': lambda: dict(**primary_font_kwargs()),
+        'form_kwargs': lambda: dict(
+            label=_('Font'),
+            help_text=_('Only respected by modern browsers.'),
+            widget=FontSelect,
+            **primary_font_kwargs()
+        ),
     },
     'presale_css_file': {
         'default': None,
@@ -1654,7 +1800,13 @@ Your {event} team"""))
     },
     'organizer_logo_image_large': {
         'default': 'False',
-        'type': bool
+        'type': bool,
+        'form_class': forms.BooleanField,
+        'serializer_class': serializers.BooleanField,
+        'form_kwargs': dict(
+            label=_('Use header image in its full size'),
+            help_text=_('We recommend to upload a picture at least 1170 pixels wide.'),
+        )
     },
     'og_image': {
         'default': None,
@@ -1713,6 +1865,30 @@ Your {event} team"""))
                         "how to obtain a voucher code.")
         )
     },
+    'attendee_data_explanation_text': {
+        'default': '',
+        'type': LazyI18nString,
+        'serializer_class': I18nField,
+        'form_class': I18nFormField,
+        'form_kwargs': dict(
+            label=_("Attendee data explanation"),
+            widget=I18nTextarea,
+            widget_kwargs={'attrs': {'rows': '2'}},
+            help_text=_("This text will be shown above the questions asked for every admission product. You can use it e.g. to explain "
+                        "why you need information from them.")
+        )
+    },
+    'checkout_phone_helptext': {
+        'default': '',
+        'type': LazyI18nString,
+        'serializer_class': I18nField,
+        'form_class': I18nFormField,
+        'form_kwargs': dict(
+            label=_("Help text of the phone number field"),
+            widget_kwargs={'attrs': {'rows': '2'}},
+            widget=I18nTextarea
+        )
+    },
     'checkout_email_helptext': {
         'default': LazyI18nString.from_gettext(gettext_noop(
             'Make sure to enter a valid email address. We will send you an order '
@@ -1733,11 +1909,26 @@ Your {event} team"""))
     },
     'organizer_info_text': {
         'default': '',
-        'type': LazyI18nString
+        'type': LazyI18nString,
+        'serializer_class': I18nField,
+        'form_class': I18nFormField,
+        'form_kwargs': dict(
+            label=_('Info text'),
+            widget=I18nTextarea,
+            help_text=_('Not displayed anywhere by default, but if you want to, you can use this e.g. in ticket templates.')
+        )
     },
     'event_team_provisioning': {
         'default': 'True',
-        'type': bool
+        'type': bool,
+        'form_class': forms.BooleanField,
+        'serializer_class': serializers.BooleanField,
+        'form_kwargs': dict(
+            label=_('Allow creating a new team during event creation'),
+            help_text=_('Users that do not have access to all events under this organizer, must select one of their teams '
+                        'to have access to the created event. This setting allows users to create an event-specified team'
+                        ' on-the-fly, even when they do not have \"Can change teams and permissions\" permission.'),
+        )
     },
     'update_check_ack': {
         'default': 'False',
@@ -1779,6 +1970,10 @@ Your {event} team"""))
         'default': None,
         'type': str
     },
+    'mapquest_apikey': {
+        'default': None,
+        'type': str
+    },
     'leaflet_tiles': {
         'default': None,
         'type': str
@@ -1811,13 +2006,51 @@ Your {event} team"""))
             # When adding a new ordering, remember to also define it in the event model
         )
     },
+    'organizer_link_back': {
+        'default': 'False',
+        'type': bool,
+        'form_class': forms.BooleanField,
+        'serializer_class': serializers.BooleanField,
+        'form_kwargs': dict(
+            label=_('Link back to organizer overview on all event pages'),
+        )
+    },
+    'organizer_homepage_text': {
+        'default': '',
+        'type': LazyI18nString,
+        'serializer_class': I18nField,
+        'form_class': I18nFormField,
+        'form_kwargs': dict(
+            label=_('Homepage text'),
+            widget=I18nTextarea,
+            help_text=_('This will be displayed on the organizer homepage.')
+        )
+    },
     'name_scheme': {
         'default': 'full',
         'type': str
     },
     'giftcard_length': {
         'default': settings.ENTROPY['giftcard_secret'],
-        'type': int
+        'type': int,
+        'form_class': forms.IntegerField,
+        'serializer_class': serializers.IntegerField,
+        'form_kwargs': dict(
+            label=_('Length of gift card codes'),
+            help_text=_('The system generates by default {}-character long gift card codes. However, if a different length '
+                        'is required, it can be set here.'.format(settings.ENTROPY['giftcard_secret'])),
+        )
+    },
+    'giftcard_expiry_years': {
+        'default': None,
+        'type': int,
+        'form_class': forms.IntegerField,
+        'serializer_class': serializers.IntegerField,
+        'form_kwargs': dict(
+            label=_('Validity of gift card codes in years'),
+            help_text=_('If you set a number here, gift cards will by default expire at the end of the year after this '
+                        'many years. If you keep it empty, gift cards do not have an explicit expiry date.'),
+        )
     },
     'seating_choice': {
         'default': 'True',
@@ -1853,6 +2086,10 @@ Your {event} team"""))
         ),
     }
 }
+SETTINGS_AFFECTING_CSS = {
+    'primary_color', 'theme_color_success', 'theme_color_danger', 'primary_font',
+    'theme_color_background', 'theme_round_borders'
+}
 PERSON_NAME_TITLE_GROUPS = OrderedDict([
     ('english_common', (_('Most common English titles'), (
         'Mr',
@@ -2052,6 +2289,30 @@ PERSON_NAME_SCHEMES = OrderedDict([
             '_scheme': 'salutation_title_given_family',
         },
     }),
+    ('salutation_title_given_family_degree', {
+        'fields': (
+            ('salutation', pgettext_lazy('person_name', 'Salutation'), 1),
+            ('title', pgettext_lazy('person_name', 'Title'), 1),
+            ('given_name', _('Given name'), 2),
+            ('family_name', _('Family name'), 2),
+            ('degree', pgettext_lazy('person_name', 'Degree (after name)'), 2),
+        ),
+        'concatenation': lambda d: (
+            ' '.join(
+                str(p) for p in (d.get(key, '') for key in ["title", "given_name", "family_name"]) if p
+            ) +
+            str((', ' if d.get('degree') else '')) +
+            str(d.get('degree', ''))
+        ),
+        'sample': {
+            'salutation': pgettext_lazy('person_name_sample', 'Mr'),
+            'title': pgettext_lazy('person_name_sample', 'Dr'),
+            'given_name': pgettext_lazy('person_name_sample', 'John'),
+            'family_name': pgettext_lazy('person_name_sample', 'Doe'),
+            'degree': pgettext_lazy('person_name_sample', 'MA'),
+            '_scheme': 'salutation_title_given_family_degree',
+        },
+    }),
 ])
 COUNTRIES_WITH_STATE_IN_ADDRESS = {
     # Source: http://www.bitboost.com/ref/international-address-formats.html
@@ -2143,7 +2404,8 @@ class SettingsSandbox:
         self._event.settings.set(self._convert_key(key), value)
 
 
-def validate_settings(event, settings_dict):
+def validate_event_settings(event, settings_dict):
+    from pretix.base.models import Event
     from pretix.base.signals import validate_event_settings
 
     if 'locales' in settings_dict and settings_dict['locale'] not in settings_dict['locales']:
@@ -2174,4 +2436,20 @@ def validate_settings(event, settings_dict):
                 'payment_term_last': _('The last payment date cannot be before the end of presale.')
             })
 
-    validate_event_settings.send(sender=event, settings_dict=settings_dict)
+    if isinstance(event, Event):
+        validate_event_settings.send(sender=event, settings_dict=settings_dict)
+
+
+def validate_organizer_settings(organizer, settings_dict):
+    # This is not doing anything for the time being.
+    # But earlier we called validate_event_settings for the organizer, too - and that didn't do anything for
+    # organizer-settings either.
+    #
+    # N.B.: When actually fleshing out this stub, adding it to the OrganizerUpdateForm should be considered.
+    pass
+
+
+def global_settings_object(holder):
+    if not hasattr(holder, '_global_settings_object'):
+        holder._global_settings_object = GlobalSettingsObject()
+    return holder._global_settings_object

src/pretix/base/shredder.py

@@ -20,6 +20,7 @@ from pretix.base.models import (
 )
 from pretix.base.services.invoices import invoice_pdf_task
 from pretix.base.signals import register_data_shredders
+from pretix.helpers.json import CustomJSONEncoder
 
 
 class ShredError(LazyLocaleException):
@@ -121,6 +122,31 @@ def shred_log_fields(logentry, banlist=None, whitelist=None):
     logentry.save(update_fields=['data', 'shredded'])
 
 
+class PhoneNumberShredder(BaseDataShredder):
+    verbose_name = _('Phone numbers')
+    identifier = 'phone_numbers'
+    description = _('This will remove all phone numbers from orders.')
+
+    def generate_files(self) -> List[Tuple[str, str, str]]:
+        yield 'phone-by-order.json', 'application/json', json.dumps({
+            o.code: o.phone for o in self.event.orders.filter(phone__isnull=False)
+        }, cls=CustomJSONEncoder, indent=4)
+
+    @transaction.atomic
+    def shred_data(self):
+        for o in self.event.orders.all():
+            o.phone = None
+            d = o.meta_info_data
+            if d:
+                if 'contact_form_data' in d and 'phone' in d['contact_form_data']:
+                    del d['contact_form_data']['phone']
+                o.meta_info = json.dumps(d)
+            o.save(update_fields=['meta_info', 'phone'])
+
+        for le in self.event.logentry_set.filter(action_type="pretix.event.order.phone.changed"):
+            shred_log_fields(le, banlist=['old_phone', 'new_phone'])
+
+
 class EmailAddressShredder(BaseDataShredder):
     verbose_name = _('E-mails')
     identifier = 'order_emails'
@@ -372,9 +398,10 @@ class PaymentInfoShredder(BaseDataShredder):
 
 
 @receiver(register_data_shredders, dispatch_uid="shredders_builtin")
-def register_payment_provider(sender, **kwargs):
+def register_core_shredders(sender, **kwargs):
     return [
         EmailAddressShredder,
+        PhoneNumberShredder,
         AttendeeInfoShredder,
         InvoiceAddressShredder,
         QuestionAnswerShredder,

src/pretix/base/templatetags/phone_format.py

@@ -0,0 +1,22 @@
+from django import template
+from phonenumber_field.phonenumber import PhoneNumber
+from phonenumbers import NumberParseException
+
+register = template.Library()
+
+
+@register.filter("phone_format")
+def phone_format(value: str):
+    if not value:
+        return ""
+
+    if isinstance(value, str):
+        try:
+            return PhoneNumber.from_string(value).as_international
+        except NumberParseException:
+            return value
+
+    if isinstance(value, PhoneNumber) and value.national_number:
+        return value.as_international
+
+    return str(value)

src/pretix/base/templatetags/rich_text.py

@@ -1,3 +1,4 @@
+import re
 import urllib.parse
 
 import bleach
@@ -71,6 +72,10 @@ EMAIL_RE = build_email_re(tlds=sorted(tld_set, key=len, reverse=True))
 
 
 def safelink_callback(attrs, new=False):
+    """
+    Makes sure that all links to a different domain are passed through a redirection handler
+    to ensure there's no passing of referers with secrets inside them.
+    """
     url = attrs.get((None, 'href'), '/')
     if not url_has_allowed_host_and_scheme(url, allowed_hosts=None) and not url.startswith('mailto:') and not url.startswith('tel:'):
         signer = signing.Signer(salt='safe-redirect')
@@ -80,7 +85,42 @@ def safelink_callback(attrs, new=False):
     return attrs
 
 
+def truelink_callback(attrs, new=False):
+    """
+    Tries to prevent "phishing" attacks in which a link looks like it points to a safe place but instead
+    points somewhere else, e.g.
+
+        <a href="https://evilsite.com">https://google.com</a>
+
+    At the same time, custom texts are still allowed:
+
+        <a href="https://maps.google.com">Get to the event</a>
+
+    Suffixes are also allowed:
+
+        <a href="https://maps.google.com/location/foo">https://maps.google.com</a>
+    """
+    text = re.sub('[^a-zA-Z0-9.-/_]', '', attrs.get('_text'))  # clean up link text
+    if URL_RE.match(text):
+        # link text looks like a url
+        if text.startswith('//'):
+            text = 'https:' + text
+        elif not text.startswith('http'):
+            text = 'https://' + text
+
+        text_url = urllib.parse.urlparse(text)
+        href_url = urllib.parse.urlparse(attrs[None, 'href'])
+        if text_url.netloc != href_url.netloc or not href_url.path.startswith(href_url.path):
+            # link text contains an URL that has a different base than the actual URL
+            attrs['_text'] = attrs[None, 'href']
+    return attrs
+
+
 def abslink_callback(attrs, new=False):
+    """
+    Makes sure that all links will be absolute links and will be opened in a new page with no
+    window.opener attribute.
+    """
     url = attrs.get((None, 'href'), '/')
     if not url.startswith('mailto:') and not url.startswith('tel:'):
         attrs[None, 'href'] = urllib.parse.urljoin(settings.SITE_URL, url)
@@ -93,6 +133,7 @@ def markdown_compile_email(source):
     linker = bleach.Linker(
         url_re=URL_RE,
         email_re=EMAIL_RE,
+        callbacks=DEFAULT_CALLBACKS + [truelink_callback, abslink_callback],
         parse_email=True
     )
     return linker.linkify(bleach.clean(
@@ -145,7 +186,7 @@ def rich_text(text: str, **kwargs):
     linker = bleach.Linker(
         url_re=URL_RE,
         email_re=EMAIL_RE,
-        callbacks=DEFAULT_CALLBACKS + ([safelink_callback] if kwargs.get('safelinks', True) else [abslink_callback]),
+        callbacks=DEFAULT_CALLBACKS + ([truelink_callback, safelink_callback] if kwargs.get('safelinks', True) else [truelink_callback, abslink_callback]),
         parse_email=True
     )
     body_md = linker.linkify(markdown_compile(text))
@@ -161,7 +202,7 @@ def rich_text_snippet(text: str, **kwargs):
     linker = bleach.Linker(
         url_re=URL_RE,
         email_re=EMAIL_RE,
-        callbacks=DEFAULT_CALLBACKS + ([safelink_callback] if kwargs.get('safelinks', True) else [abslink_callback]),
+        callbacks=DEFAULT_CALLBACKS + ([truelink_callback, safelink_callback] if kwargs.get('safelinks', True) else [truelink_callback, abslink_callback]),
         parse_email=True
     )
     body_md = linker.linkify(markdown_compile(text, snippet=True))

src/pretix/base/views/cachedfiles.py

@@ -13,7 +13,11 @@ class DownloadView(TemplateView):
     @cached_property
     def object(self) -> CachedFile:
         try:
-            return get_object_or_404(CachedFile, id=self.kwargs['id'])
+            o = get_object_or_404(CachedFile, id=self.kwargs['id'], web_download=True)
+            if o.session_key:
+                if o.session_key != self.request.session.session_key:
+                    raise Http404()
+            return o
         except ValueError:   # Invalid URLs
             raise Http404()
 

src/pretix/control/forms/__init__.py

@@ -203,6 +203,7 @@ class CachedFileField(ExtFileField):
             cf = CachedFile.objects.create(
                 expires=now() + datetime.timedelta(days=1),
                 date=now(),
+                web_download=True,
                 filename=data.name,
                 type=data.content_type,
             )
@@ -218,6 +219,7 @@ class CachedFileField(ExtFileField):
         if isinstance(data, File):
             cf = CachedFile.objects.create(
                 expires=now() + datetime.timedelta(days=1),
+                web_download=True,
                 date=now(),
                 filename=data.name,
                 type=data.content_type,

src/pretix/control/forms/event.py

@@ -3,15 +3,14 @@ from urllib.parse import urlencode, urlparse
 from django import forms
 from django.conf import settings
 from django.core.exceptions import ValidationError
-from django.core.validators import RegexValidator, validate_email
+from django.core.validators import validate_email
 from django.db.models import Q
-from django.forms import formset_factory
+from django.forms import CheckboxSelectMultiple, formset_factory
 from django.urls import reverse
 from django.utils.html import escape
 from django.utils.safestring import mark_safe
 from django.utils.timezone import get_current_timezone_name
 from django.utils.translation import gettext, gettext_lazy as _, pgettext_lazy
-from django_countries import Countries
 from django_countries.fields import LazyTypedChoiceField
 from i18nfield.forms import (
     I18nForm, I18nFormField, I18nFormSetMixin, I18nTextarea, I18nTextInput,
@@ -25,13 +24,14 @@ from pretix.base.models import Event, Organizer, TaxRule, Team
 from pretix.base.models.event import EventMetaValue, SubEvent
 from pretix.base.reldate import RelativeDateField, RelativeDateTimeField
 from pretix.base.settings import (
-    PERSON_NAME_SCHEMES, PERSON_NAME_TITLE_GROUPS, validate_settings,
+    PERSON_NAME_SCHEMES, PERSON_NAME_TITLE_GROUPS, validate_event_settings,
 )
 from pretix.control.forms import (
-    ExtFileField, FontSelect, MultipleLanguagesWidget, SlugWidget,
+    ExtFileField, MultipleLanguagesWidget, SlugWidget, SplitDateTimeField,
-    SplitDateTimeField, SplitDateTimePickerWidget,
+    SplitDateTimePickerWidget,
 )
 from pretix.control.forms.widgets import Select2
+from pretix.helpers.countries import CachedCountries
 from pretix.multidomain.models import KnownDomain
 from pretix.multidomain.urlreverse import build_absolute_uri
 from pretix.plugins.banktransfer.payment import BankTransfer
@@ -311,6 +311,16 @@ class EventUpdateForm(I18nModelForm):
                 required=False,
                 help_text=_('You need to configure the custom domain in the webserver beforehand.')
             )
+        self.fields['sales_channels'] = forms.MultipleChoiceField(
+            label=self.fields['sales_channels'].label,
+            help_text=self.fields['sales_channels'].help_text,
+            required=self.fields['sales_channels'].required,
+            initial=self.fields['sales_channels'].initial,
+            choices=(
+                (c.identifier, c.verbose_name) for c in get_all_sales_channels().values()
+            ),
+            widget=forms.CheckboxSelectMultiple
+        )
 
     def clean_domain(self):
         d = self.cleaned_data['domain']
@@ -367,6 +377,7 @@ class EventUpdateForm(I18nModelForm):
             'location',
             'geo_lat',
             'geo_lon',
+            'sales_channels'
         ]
         field_classes = {
             'date_from': SplitDateTimeField,
@@ -381,6 +392,7 @@ class EventUpdateForm(I18nModelForm):
             'date_admission': SplitDateTimePickerWidget(attrs={'data-date-default': '#id_date_from_0'}),
             'presale_start': SplitDateTimePickerWidget(),
             'presale_end': SplitDateTimePickerWidget(attrs={'data-date-after': '#id_presale_start_0'}),
+            'sales_channels': CheckboxSelectMultiple()
         }
 
 
@@ -431,57 +443,6 @@ class EventSettingsForm(SettingsForm):
                     'WhatsApp and Reddit only show a square preview, so we recommend to make sure it still looks good '
                     'only the center square is shown. If you do not fill this, we will use the logo given above.')
     )
-    primary_color = forms.CharField(
-        label=_("Primary color"),
-        required=False,
-        validators=[
-            RegexValidator(regex='^#[0-9a-fA-F]{6}$',
-                           message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
-        ],
-        widget=forms.TextInput(attrs={'class': 'colorpickerfield'})
-    )
-    theme_color_success = forms.CharField(
-        label=_("Accent color for success"),
-        help_text=_("We strongly suggest to use a shade of green."),
-        required=False,
-        validators=[
-            RegexValidator(regex='^#[0-9a-fA-F]{6}$',
-                           message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
-        ],
-        widget=forms.TextInput(attrs={'class': 'colorpickerfield'})
-    )
-    theme_color_danger = forms.CharField(
-        label=_("Accent color for errors"),
-        help_text=_("We strongly suggest to use a dark shade of red."),
-        required=False,
-        validators=[
-            RegexValidator(regex='^#[0-9a-fA-F]{6}$',
-                           message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
-        ],
-        widget=forms.TextInput(attrs={'class': 'colorpickerfield'})
-    )
-    theme_color_background = forms.CharField(
-        label=_("Page background color"),
-        required=False,
-        validators=[
-            RegexValidator(regex='^#[0-9a-fA-F]{6}$',
-                           message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
-
-        ],
-        widget=forms.TextInput(attrs={'class': 'colorpickerfield no-contrast'})
-    )
-    theme_round_borders = forms.BooleanField(
-        label=_("Use round edges"),
-        required=False,
-    )
-    primary_font = forms.ChoiceField(
-        label=_('Font'),
-        choices=[
-            ('Open Sans', 'Open Sans')
-        ],
-        widget=FontSelect,
-        help_text=_('Only respected by modern browsers.')
-    )
 
     auto_fields = [
         'imprint_url',
@@ -496,6 +457,7 @@ class EventSettingsForm(SettingsForm):
         'presale_start_show_date',
         'locales',
         'locale',
+        'region',
         'show_quota_left',
         'waiting_list_enabled',
         'waiting_list_hours',
@@ -518,18 +480,53 @@ class EventSettingsForm(SettingsForm):
         'attendee_company_required',
         'attendee_addresses_asked',
         'attendee_addresses_required',
+        'attendee_data_explanation_text',
+        'order_phone_asked',
+        'order_phone_required',
+        'checkout_phone_helptext',
         'banner_text',
         'banner_text_bottom',
         'order_email_asked_twice',
         'last_order_modification_date',
         'checkout_show_copy_answers_button',
+        'primary_color',
+        'theme_color_success',
+        'theme_color_danger',
+        'theme_color_background',
+        'theme_round_borders',
+        'primary_font',
     ]
 
     def clean(self):
         data = super().clean()
         settings_dict = self.event.settings.freeze()
         settings_dict.update(data)
-        validate_settings(self.event, data)
+
+        # set all dependants of virtual_keys and
+        # delete all virtual_fields to prevent them from being saved
+        for virtual_key in self.virtual_keys:
+            if virtual_key not in data:
+                continue
+            base_key = virtual_key.rsplit('_', 2)[0]
+            asked_key = base_key + '_asked'
+            required_key = base_key + '_required'
+
+            if data[virtual_key] == 'optional':
+                data[asked_key] = True
+                data[required_key] = False
+            elif data[virtual_key] == 'required':
+                data[asked_key] = True
+                data[required_key] = True
+            # Explicitly check for 'do_not_ask'.
+            # Do not overwrite as default-behaviour when no value for virtual field is transmitted!
+            elif data[virtual_key] == 'do_not_ask':
+                data[asked_key] = False
+                data[required_key] = False
+
+            # hierarkey.forms cannot handle non-existent keys in cleaned_data => do not delete, but set to None
+            data[virtual_key] = None
+
+        validate_event_settings(self.event, data)
         return data
 
     def __init__(self, *args, **kwargs):
@@ -556,6 +553,39 @@ class EventSettingsForm(SettingsForm):
             (a, {"title": a, "data": v}) for a, v in get_fonts().items()
         ]
 
+        # create "virtual" fields for better UX when editing <name>_asked and <name>_required fields
+        self.virtual_keys = []
+        for asked_key in [key for key in self.fields.keys() if key.endswith('_asked')]:
+            required_key = asked_key.rsplit('_', 1)[0] + '_required'
+            virtual_key = asked_key + '_required'
+            if required_key not in self.fields or virtual_key in self.fields:
+                # either no matching required key or
+                # there already is a field with virtual_key defined manually, so do not overwrite
+                continue
+
+            asked_field = self.fields[asked_key]
+
+            self.fields[virtual_key] = forms.ChoiceField(
+                label=asked_field.label,
+                help_text=asked_field.help_text,
+                required=True,
+                widget=forms.RadioSelect,
+                choices=[
+                    # default key needs a value other than '' because with '' it would also overwrite even if combi-field is not transmitted
+                    ('do_not_ask', _('Do not ask')),
+                    ('optional', _('Ask, but do not require input')),
+                    ('required', _('Ask and require input'))
+                ]
+            )
+            self.virtual_keys.append(virtual_key)
+
+            if self.initial[required_key]:
+                self.initial[virtual_key] = 'required'
+            elif self.initial[asked_key]:
+                self.initial[virtual_key] = 'optional'
+            else:
+                self.initial[virtual_key] = 'do_not_ask'
+
 
 class CancelSettingsForm(SettingsForm):
     auto_fields = [
@@ -592,6 +622,7 @@ class PaymentSettingsForm(SettingsForm):
         'payment_term_last',
         'payment_term_expire_automatically',
         'payment_term_accept_late',
+        'payment_pending_hidden',
         'payment_explanation',
     ]
     tax_rate_default = forms.ModelChoiceField(
@@ -618,7 +649,7 @@ class PaymentSettingsForm(SettingsForm):
         data = super().clean()
         settings_dict = self.obj.settings.freeze()
         settings_dict.update(data)
-        validate_settings(self.obj, data)
+        validate_event_settings(self.obj, data)
         return data
 
     def __init__(self, *args, **kwargs):
@@ -750,7 +781,7 @@ class InvoiceSettingsForm(SettingsForm):
         data = super().clean()
         settings_dict = self.obj.settings.freeze()
         settings_dict.update(data)
-        validate_settings(self.obj, data)
+        validate_event_settings(self.obj, data)
         return data
 
 
@@ -1121,15 +1152,16 @@ class CommentForm(I18nModelForm):
         }
 
 
-class CountriesAndEU(Countries):
+class CountriesAndEU(CachedCountries):
     override = {
         'ZZ': _('Any country'),
         'EU': _('European Union')
     }
     first = ['ZZ', 'EU']
+    cache_subkey = 'with_any_or_eu'
 
 
-class TaxRuleLineForm(forms.Form):
+class TaxRuleLineForm(I18nForm):
     country = LazyTypedChoiceField(
         choices=CountriesAndEU(),
         required=False
@@ -1156,11 +1188,26 @@ class TaxRuleLineForm(forms.Form):
         max_digits=10, decimal_places=2,
         required=False
     )
+    invoice_text = I18nFormField(
+        label=_('Text on invoice'),
+        required=False,
+        widget=I18nTextInput
+    )
+
+
+class I18nBaseFormSet(I18nFormSetMixin, forms.BaseFormSet):
+    # compatibility shim for django-i18nfield library
+
+    def __init__(self, *args, **kwargs):
+        self.event = kwargs.pop('event', None)
+        if self.event:
+            kwargs['locales'] = self.event.settings.get('locales')
+        super().__init__(*args, **kwargs)
 
 
 TaxRuleLineFormSet = formset_factory(
-    TaxRuleLineForm,
+    TaxRuleLineForm, formset=I18nBaseFormSet,
-    can_order=False, can_delete=True, extra=0
+    can_order=True, can_delete=True, extra=0
 )
 
 

src/pretix/control/forms/filter.py

@@ -150,8 +150,8 @@ class OrderFilterForm(FilterForm):
                 (Order.STATUS_PENDING + Order.STATUS_PAID, _('Pending or paid')),
             )),
             (_('Cancellations'), (
-                (Order.STATUS_CANCELED, _('Canceled')),
+                (Order.STATUS_CANCELED, _('Canceled (fully)')),
-                ('cp', _('Canceled (or with paid fee)')),
+                ('cp', _('Canceled (fully or with paid fee)')),
                 ('rc', _('Cancellation requested')),
             )),
             (_('Payment process'), (
@@ -159,7 +159,8 @@ class OrderFilterForm(FilterForm):
                 (Order.STATUS_PENDING + Order.STATUS_EXPIRED, _('Pending or expired')),
                 ('o', _('Pending (overdue)')),
                 ('overpaid', _('Overpaid')),
-                ('underpaid', _('Underpaid')),
+                ('partially_paid', _('Partially paid')),
+                ('underpaid', _('Underpaid (but confirmed)')),
                 ('pendingpaid', _('Pending (but fully paid)')),
             )),
             (_('Approval process'), (
@@ -245,6 +246,14 @@ class OrderFilterForm(FilterForm):
                     Q(status__in=(Order.STATUS_EXPIRED, Order.STATUS_PENDING)) & Q(pending_sum_t__lte=0)
                     & Q(require_approval=False)
                 )
+            elif s == 'partially_paid':
+                qs = Order.annotate_overpayments(qs, refunds=False, results=False, sums=True)
+                qs = qs.filter(
+                    computed_payment_refund_sum__lt=F('total'),
+                    computed_payment_refund_sum__gt=Decimal('0.00')
+                ).exclude(
+                    status=Order.STATUS_CANCELED
+                )
             elif s == 'underpaid':
                 qs = Order.annotate_overpayments(qs, refunds=False, results=False, sums=True)
                 qs = qs.filter(
@@ -564,7 +573,7 @@ class EventOrderExpertFilterForm(EventOrderFilterForm):
         if fdata.get('created_from'):
             qs = qs.filter(datetime__gte=fdata.get('created_from'))
         if fdata.get('created_to'):
-            qs = qs.filter(datetime__gte=fdata.get('created_to'))
+            qs = qs.filter(datetime__lte=fdata.get('created_to'))
         if fdata.get('comment'):
             qs = qs.filter(comment__icontains=fdata.get('comment'))
         if fdata.get('sales_channel'):
@@ -1113,8 +1122,8 @@ class CheckInFilterForm(FilterForm):
         '-item': ('-item__name', '-variation__value', '-order__code'),
         'seat': ('seat__sorting_rank', 'seat__guid'),
         '-seat': ('-seat__sorting_rank', '-seat__guid'),
-        'date': ('subevent__date_from', 'order__code'),
+        'date': ('subevent__date_from', 'subevent__id', 'order__code'),
-        '-date': ('-subevent__date_from', '-order__code'),
+        '-date': ('-subevent__date_from', 'subevent__id', '-order__code'),
         'name': {'_order': F('display_name').asc(nulls_first=True),
                  'display_name': Coalesce('attendee_name_cached', 'addon_to__attendee_name_cached')},
         '-name': {'_order': F('display_name').desc(nulls_last=True),

src/pretix/control/forms/global_settings.py

@@ -10,11 +10,15 @@ from pretix.base.signals import register_global_settings
 
 
 class GlobalSettingsForm(SettingsForm):
+    auto_fields = [
+        'region'
+    ]
+
     def __init__(self, *args, **kwargs):
         self.obj = GlobalSettingsObject()
         super().__init__(*args, obj=self.obj, **kwargs)
 
-        self.fields = OrderedDict([
+        self.fields = OrderedDict(list(self.fields.items()) + [
             ('footer_text', I18nFormField(
                 widget=I18nTextInput,
                 required=False,
@@ -41,6 +45,10 @@ class GlobalSettingsForm(SettingsForm):
                 required=False,
                 label=_("OpenCage API key for geocoding"),
             )),
+            ('mapquest_apikey', SecretKeySettingsField(
+                required=False,
+                label=_("MapQuest API key for geocoding"),
+            )),
             ('leaflet_tiles', forms.CharField(
                 required=False,
                 label=_("Leaflet tiles URL pattern"),

src/pretix/control/forms/item.py

@@ -16,6 +16,7 @@ from i18nfield.forms import I18nFormField, I18nTextarea
 
 from pretix.base.channels import get_all_sales_channels
 from pretix.base.forms import I18nFormSet, I18nModelForm
+from pretix.base.forms.widgets import DatePickerWidget
 from pretix.base.models import (
     Item, ItemCategory, ItemVariation, Question, QuestionOption, Quota,
 )
@@ -111,14 +112,26 @@ class QuestionForm(I18nModelForm):
             'dependency_question',
             'dependency_values',
             'print_on_invoice',
+            'valid_number_min',
+            'valid_number_max',
+            'valid_datetime_min',
+            'valid_datetime_max',
+            'valid_date_min',
+            'valid_date_max',
         ]
         widgets = {
+            'valid_datetime_min': SplitDateTimePickerWidget(),
+            'valid_datetime_max': SplitDateTimePickerWidget(),
+            'valid_date_min': DatePickerWidget(),
+            'valid_date_max': DatePickerWidget(),
             'items': forms.CheckboxSelectMultiple(
                 attrs={'class': 'scrolling-multiple-choice'}
             ),
             'dependency_values': forms.SelectMultiple,
         }
         field_classes = {
+            'valid_datetime_min': SplitDateTimeField,
+            'valid_datetime_max': SplitDateTimeField,
             'items': SafeModelMultipleChoiceField,
             'dependency_question': SafeModelChoiceField,
         }

src/pretix/control/forms/orders.py

@@ -16,6 +16,7 @@ from i18nfield.strings import LazyI18nString
 
 from pretix.base.email import get_available_placeholders
 from pretix.base.forms import I18nModelForm, PlaceholderValidator
+from pretix.base.forms.questions import WrappedPhoneNumberPrefixWidget
 from pretix.base.forms.widgets import (
     DatePickerWidget, SplitDateTimePickerWidget,
 )
@@ -460,7 +461,15 @@ class OrderContactForm(forms.ModelForm):
 
     class Meta:
         model = Order
-        fields = ['email', 'email_known_to_work']
+        fields = ['email', 'email_known_to_work', 'phone']
+        widgets = {
+            'phone': WrappedPhoneNumberPrefixWidget()
+        }
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if not self.instance.event.settings.order_phone_asked and not self.instance.phone:
+            del self.fields['phone']
 
 
 class OrderLocaleForm(forms.ModelForm):

src/pretix/control/forms/organizer.py

@@ -4,24 +4,19 @@ from urllib.parse import urlparse
 from django import forms
 from django.conf import settings
 from django.core.exceptions import ValidationError
-from django.core.validators import RegexValidator
 from django.db.models import Q
 from django.utils.safestring import mark_safe
 from django.utils.translation import gettext_lazy as _, pgettext_lazy
 from django_scopes.forms import SafeModelMultipleChoiceField
-from i18nfield.forms import I18nFormField, I18nTextarea
 
 from pretix.api.models import WebHook
 from pretix.api.webhooks import get_all_webhook_events
 from pretix.base.forms import I18nModelForm, SettingsForm
 from pretix.base.forms.widgets import SplitDateTimePickerWidget
 from pretix.base.models import Device, Gate, GiftCard, Organizer, Team
-from pretix.control.forms import (
+from pretix.control.forms import ExtFileField, SplitDateTimeField
-    ExtFileField, FontSelect, MultipleLanguagesWidget, SplitDateTimeField,
-)
 from pretix.control.forms.event import SafeEventMultipleChoiceField
 from pretix.multidomain.models import KnownDomain
-from pretix.presale.style import get_fonts
 
 
 class OrganizerForm(I18nModelForm):
@@ -218,72 +213,27 @@ class DeviceForm(forms.ModelForm):
 
 
 class OrganizerSettingsForm(SettingsForm):
+    auto_fields = [
+        'organizer_info_text',
+        'event_list_type',
+        'event_list_availability',
+        'organizer_homepage_text',
+        'organizer_link_back',
+        'organizer_logo_image_large',
+        'giftcard_length',
+        'giftcard_expiry_years',
+        'locales',
+        'region',
+        'event_team_provisioning',
+        'primary_color',
+        'theme_color_success',
+        'theme_color_danger',
+        'theme_color_background',
+        'theme_round_borders',
+        'primary_font'
 
-    organizer_info_text = I18nFormField(
+    ]
-        label=_('Info text'),
-        required=False,
-        widget=I18nTextarea,
-        help_text=_('Not displayed anywhere by default, but if you want to, you can use this e.g. in ticket templates.')
-    )
 
-    event_team_provisioning = forms.BooleanField(
-        label=_('Allow creating a new team during event creation'),
-        help_text=_('Users that do not have access to all events under this organizer, must select one of their teams '
-                    'to have access to the created event. This setting allows users to create an event-specified team'
-                    ' on-the-fly, even when they do not have \"Can change teams and permissions\" permission.'),
-        required=False,
-    )
-
-    primary_color = forms.CharField(
-        label=_("Primary color"),
-        required=False,
-        validators=[
-            RegexValidator(regex='^#[0-9a-fA-F]{6}$',
-                           message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
-        ],
-        widget=forms.TextInput(attrs={'class': 'colorpickerfield'})
-    )
-    theme_color_success = forms.CharField(
-        label=_("Accent color for success"),
-        help_text=_("We strongly suggest to use a shade of green."),
-        required=False,
-        validators=[
-            RegexValidator(regex='^#[0-9a-fA-F]{6}$',
-                           message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
-        ],
-        widget=forms.TextInput(attrs={'class': 'colorpickerfield'})
-    )
-    theme_color_danger = forms.CharField(
-        label=_("Accent color for errors"),
-        help_text=_("We strongly suggest to use a shade of red."),
-        required=False,
-        validators=[
-            RegexValidator(regex='^#[0-9a-fA-F]{6}$',
-                           message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
-
-        ],
-        widget=forms.TextInput(attrs={'class': 'colorpickerfield'})
-    )
-    theme_color_background = forms.CharField(
-        label=_("Page background color"),
-        required=False,
-        validators=[
-            RegexValidator(regex='^#[0-9a-fA-F]{6}$',
-                           message=_('Please enter the hexadecimal code of a color, e.g. #990000.')),
-
-        ],
-        widget=forms.TextInput(attrs={'class': 'colorpickerfield no-contrast'})
-    )
-    theme_round_borders = forms.BooleanField(
-        label=_("Use round edges"),
-        required=False,
-    )
-    organizer_homepage_text = I18nFormField(
-        label=_('Homepage text'),
-        required=False,
-        widget=I18nTextarea,
-        help_text=_('This will be displayed on the organizer homepage.')
-    )
     organizer_logo_image = ExtFileField(
         label=_('Header image'),
         ext_whitelist=(".png", ".jpg", ".gif", ".jpeg"),
@@ -294,44 +244,6 @@ class OrganizerSettingsForm(SettingsForm):
                     'can increase the size with the setting below. We recommend not using small details on the picture '
                     'as it will be resized on smaller screens.')
     )
-    organizer_logo_image_large = forms.BooleanField(
-        label=_('Use header image in its full size'),
-        help_text=_('We recommend to upload a picture at least 1170 pixels wide.'),
-        required=False,
-    )
-    event_list_type = forms.ChoiceField(
-        label=_('Default overview style'),
-        choices=(
-            ('list', _('List')),
-            ('week', _('Week calendar')),
-            ('calendar', _('Month calendar')),
-        )
-    )
-    event_list_availability = forms.BooleanField(
-        label=_('Show availability in event overviews'),
-        help_text=_('If checked, the list of events will show if events are sold out. This might '
-                    'make for longer page loading times if you have lots of events and the shown status might be out '
-                    'of date for up to two minutes.'),
-        required=False
-    )
-    organizer_link_back = forms.BooleanField(
-        label=_('Link back to organizer overview on all event pages'),
-        required=False
-    )
-    locales = forms.MultipleChoiceField(
-        choices=settings.LANGUAGES,
-        label=_("Use languages"),
-        widget=MultipleLanguagesWidget,
-        help_text=_('Choose all languages that your organizer homepage should be available in.')
-    )
-    primary_font = forms.ChoiceField(
-        label=_('Font'),
-        choices=[
-            ('Open Sans', 'Open Sans')
-        ],
-        widget=FontSelect,
-        help_text=_('Only respected by modern browsers.')
-    )
     favicon = ExtFileField(
         label=_('Favicon'),
         ext_whitelist=(".ico", ".png", ".jpg", ".gif", ".jpeg"),
@@ -340,24 +252,6 @@ class OrganizerSettingsForm(SettingsForm):
         help_text=_('If you provide a favicon, we will show it instead of the default pretix icon. '
                     'We recommend a size of at least 200x200px to accommodate most devices.')
     )
-    giftcard_length = forms.IntegerField(
-        label=_('Length of gift card codes'),
-        help_text=_('The system generates by default {}-character long gift card codes. However, if a different length '
-                    'is required, it can be set here.'.format(settings.ENTROPY['giftcard_secret'])),
-        required=False
-    )
-    giftcard_expiry_years = forms.IntegerField(
-        label=_('Validity of gift card codes in years'),
-        help_text=_('If you set a number here, gift cards will by default expire at the end of the year after this '
-                    'many years. If you keep it empty, gift cards do not have an explicit expiry date.'),
-        required=False
-    )
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.fields['primary_font'].choices += [
-            (a, {"title": a, "data": v}) for a, v in get_fonts().items()
-        ]
 
 
 class WebHookForm(forms.ModelForm):

src/pretix/control/logdisplay.py

@@ -292,6 +292,10 @@ def pretixcontrol_logentry_display(sender: Event, logentry: LogEntry, **kwargs):
         'pretix.event.order.denied': _('The order has been denied.'),
         'pretix.event.order.contact.changed': _('The email address has been changed from "{old_email}" '
                                                 'to "{new_email}".'),
+        'pretix.event.order.contact.confirmed': _('The email address has been confirmed to be working (the user clicked on a link '
+                                                  'in the email for the first time).'),
+        'pretix.event.order.phone.changed': _('The phone number has been changed from "{old_phone}" '
+                                              'to "{new_phone}".'),
         'pretix.event.order.locale.changed': _('The order locale has been changed.'),
         'pretix.event.order.invoice.generated': _('The invoice has been generated.'),
         'pretix.event.order.invoice.regenerated': _('The invoice has been regenerated.'),
@@ -305,6 +309,7 @@ def pretixcontrol_logentry_display(sender: Event, logentry: LogEntry, **kwargs):
         'pretix.event.order.email.attachments.skipped': _('The email has been sent without attachments since they '
                                                           'would have been too large to be likely to arrive.'),
         'pretix.event.order.email.custom_sent': _('A custom email has been sent.'),
+        'pretix.event.order.position.email.custom_sent': _('A custom email has been sent to an attendee.'),
         'pretix.event.order.email.download_reminder_sent': _('An email has been sent with a reminder that the ticket '
                                                              'is available for download.'),
         'pretix.event.order.email.expire_warning_sent': _('An email has been sent with a warning that the order is about '

src/pretix/control/templates/pretixcontrol/base.html

@@ -18,7 +18,7 @@
             <script type="text/javascript" src="{% url 'javascript-catalog' lang=request.LANGUAGE_CODE %}"
                     defer></script>
         {% else %}
-            <script src="{% statici18n LANGUAGE_CODE %}" async></script>
+            <script src="{% statici18n request.LANGUAGE_CODE %}" async></script>
         {% endif %}
 		{% compress js %}
             <script type="text/javascript" src="{% static "jquery/js/jquery-2.1.1.min.js" %}"></script>

src/pretix/control/templates/pretixcontrol/event/invoicing.html

@@ -31,6 +31,7 @@
                 {% bootstrap_field form.invoice_address_beneficiary layout="control" %}
                 {% bootstrap_field form.invoice_address_not_asked_free layout="control" %}
                 {% bootstrap_field form.invoice_address_custom_field layout="control" %}
+                {% bootstrap_field form.invoice_address_explanation_text layout="control" %}
             </fieldset>
             <fieldset>
                 <legend>{% trans "Issuer details" %}</legend>
@@ -51,7 +52,6 @@
                 {% bootstrap_field form.invoice_additional_text layout="control" %}
                 {% bootstrap_field form.invoice_footer_text layout="control" %}
                 {% bootstrap_field form.invoice_logo_image layout="control" %}
-                {% bootstrap_field form.invoice_address_explanation_text layout="control" %}
                 {% bootstrap_field form.invoice_eu_currencies layout="control" %}
             </fieldset>
         </div>

src/pretix/control/templates/pretixcontrol/event/payment.html

@@ -66,6 +66,7 @@
                 {% bootstrap_field form.payment_term_last layout="control" %}
                 {% bootstrap_field form.payment_term_expire_automatically layout="control" %}
                 {% bootstrap_field form.payment_term_accept_late layout="control" %}
+                {% bootstrap_field form.payment_pending_hidden layout="control" %}
             </fieldset>
             <fieldset>
                 <legend>{% trans "Advanced" %}</legend>

src/pretix/control/templates/pretixcontrol/event/settings.html

@@ -83,20 +83,60 @@
                 {% bootstrap_field sform.locales layout="control" %}
                 {% bootstrap_field sform.locale layout="control" %}
                 {% bootstrap_field sform.timezone layout="control" %}
+                {% bootstrap_field sform.region layout="control" %}
             </fieldset>
             <fieldset>
-                <legend>{% trans "Attendee data" %}</legend>
+                <legend>{% trans "Customer and attendee data" %}</legend>
-                {% bootstrap_field sform.attendee_names_asked layout="control" %}
+                <h4>{% trans "Customer data (once per order)" %}</h4>
-                {% bootstrap_field sform.attendee_names_required layout="control" %}
+                <div class="form-group">
+                    <label class="control-label col-md-3">
+                        {% trans "E-mail" %}
+                    </label>
+                    <div class="col-md-9">
+                        <div class="checkbox">
+                            <label><input type="checkbox" checked="checked" disabled="disabled"> {% trans "Ask and require input" %}</label>
+                        </div>
+                    </div>
+                </div>
+                {% bootstrap_field sform.order_email_asked_twice layout="control" %}
+                {% bootstrap_field sform.order_phone_asked_required layout="control" %}
+                <div class="form-group">
+                    <label class="control-label col-md-3">
+                        {% trans "Name and address" %}
+                    </label>
+                    <div class="col-md-9 static-form-row">
+                        <p>
+                            <a href="{% url "control:event.settings.invoice" event=request.event.slug organizer=request.organizer.slug %}#tab-0-1-open" target="_blank">
+                                {% trans "See invoice settings" %}
+                            </a>
+                        </p>
+                    </div>
+                </div>
+
+                <h4>{% trans "Attendee data (once per admission ticket)" %}</h4>
+
+                {% bootstrap_field sform.attendee_names_asked_required layout="control" %}
+                {% bootstrap_field sform.attendee_emails_asked_required layout="control" %}
+                {% bootstrap_field sform.attendee_company_asked_required layout="control" %}
+                {% bootstrap_field sform.attendee_addresses_asked_required layout="control" %}
+
+                <div class="form-group">
+                    <label class="control-label col-md-3">
+                        {% trans "Custom fields" %}
+                    </label>
+                    <div class="col-md-9 static-form-row">
+                        <p>
+                            <a href="{% url "control:event.items.questions" event=request.event.slug organizer=request.organizer.slug %}" target="_blank">
+                                {% trans "Manage questions" %}
+                            </a>
+                        </p>
+                    </div>
+                </div>
+                {% bootstrap_field sform.attendee_data_explanation_text layout="control" %}
+
+                <h4>{% trans "Other settings" %}</h4>
                 {% bootstrap_field sform.name_scheme layout="control" %}
                 {% bootstrap_field sform.name_scheme_titles layout="control" %}
-                {% bootstrap_field sform.order_email_asked_twice layout="control" %}
-                {% bootstrap_field sform.attendee_emails_asked layout="control" %}
-                {% bootstrap_field sform.attendee_emails_required layout="control" %}
-                {% bootstrap_field sform.attendee_company_asked layout="control" %}
-                {% bootstrap_field sform.attendee_company_required layout="control" %}
-                {% bootstrap_field sform.attendee_addresses_asked layout="control" %}
-                {% bootstrap_field sform.attendee_addresses_required layout="control" %}
                 {% bootstrap_field sform.checkout_show_copy_answers_button layout="control" %}
             </fieldset>
             <fieldset>
@@ -176,6 +216,7 @@
                 </div>
 
                 {% bootstrap_field sform.checkout_email_helptext layout="control" %}
+                {% bootstrap_field sform.checkout_phone_helptext layout="control" %}
                 {% bootstrap_field sform.banner_text layout="control" %}
                 {% bootstrap_field sform.banner_text_bottom layout="control" %}
             </fieldset>
@@ -219,6 +260,7 @@
                 {% if sform.event_list_type %}
                     {% bootstrap_field sform.event_list_type layout="control" %}
                 {% endif %}
+                {% bootstrap_field form.sales_channels layout="control" %}
             </fieldset>
             <fieldset>
                 <legend>{% trans "Cart" %}</legend>

src/pretix/control/templates/pretixcontrol/event/tax_edit.html

@@ -18,103 +18,135 @@
     <form action="" method="post" class="form-horizontal">
         {% csrf_token %}
         {% bootstrap_form_errors form %}
-        <div class="tabbed-form">
+        <div class="row">
-            <fieldset>
+            <div class="col-xs-12 col-lg-10">
-                <legend>{% trans "General" %}</legend>
+                <div class="tabbed-form">
-                {% bootstrap_field form.name layout="control" %}
+                    <fieldset>
-                {% bootstrap_field form.rate addon_after="%" layout="control" %}
+                        <legend>{% trans "General" %}</legend>
-                {% bootstrap_field form.price_includes_tax layout="control" %}
+                        {% bootstrap_field form.name layout="control" %}
-            </fieldset>
+                        {% bootstrap_field form.rate addon_after="%" layout="control" %}
-            <fieldset>
+                        {% bootstrap_field form.price_includes_tax layout="control" %}
-                <legend>{% trans "Advanced" %}</legend>
+                    </fieldset>
-                <div class="alert alert-legal">
+                    <fieldset>
-                    {% blocktrans trimmed with docs="https://docs.pretix.eu/en/latest/user/events/taxes.html" %}
+                        <legend>{% trans "Advanced" %}</legend>
-                        These settings are intended for advanced users. See the
+                        <div class="alert alert-legal">
-                        <a href="{{ docs }}">documentation</a>
+                            {% blocktrans trimmed with docs="https://docs.pretix.eu/en/latest/user/events/taxes.html" %}
-                        for more information. Note that we are not responsible for the correct handling
+                                These settings are intended for advanced users. See the
-                        of taxes in your ticket shop. If in doubt, please contact a lawyer or tax consultant.
+                                <a href="{{ docs }}">documentation</a>
-                    {% endblocktrans %}
+                                for more information. Note that we are not responsible for the correct handling
-                </div>
+                                of taxes in your ticket shop. If in doubt, please contact a lawyer or tax consultant.
-                {% bootstrap_field form.eu_reverse_charge layout="control" %}
+                            {% endblocktrans %}
-                {% bootstrap_field form.home_country layout="control" %}
+                        </div>
-                <h3>{% trans "Custom taxation rules" %}</h3>
+                        {% bootstrap_field form.eu_reverse_charge layout="control" %}
-                <div class="alert alert-warning">
+                        {% bootstrap_field form.home_country layout="control" %}
-                    {% blocktrans trimmed %}
+                        <h3>{% trans "Custom taxation rules" %}</h3>
-                        These settings are intended for professional users with very specific taxation situations.
+                        <div class="alert alert-warning">
-                        If you create any rule here, the reverse charge settings above will be ignored. The rules will be
+                            {% blocktrans trimmed %}
-                        checked in order and once the first rule matches the order, it will be used and all further rules will
+                                These settings are intended for professional users with very specific taxation situations.
-                        be ignored. If no rule matches, tax will be charged.
+                                If you create any rule here, the reverse charge settings above will be ignored. The rules will be
-                    {% endblocktrans %}
+                                checked in order and once the first rule matches the order, it will be used and all further rules will
-                    {% trans "All of these rules will only apply if an invoice address is set." %}
+                                be ignored. If no rule matches, tax will be charged.
-                </div>
+                            {% endblocktrans %}
+                            {% trans "All of these rules will only apply if an invoice address is set." %}
+                        </div>
 
-                <div class="formset" data-formset data-formset-prefix="{{ formset.prefix }}">
+                        <div class="formset tax-rules-formset" data-formset data-formset-prefix="{{ formset.prefix }}">
-                    {{ formset.management_form }}
+                            {{ formset.management_form }}
-                    {% bootstrap_formset_errors formset %}
+                            {% bootstrap_formset_errors formset %}
-                    <div data-formset-body>
+                            <script type="form-template" data-formset-empty-form>
-                        {% for form in formset %}
+                                {% escapescript %}
-                            {% bootstrap_form_errors form %}
+                                    <div class="row tax-rule-line" data-formset-form>
-                            <div class="row" data-formset-form>
+                                        <div class="sr-only">
-                                <div class="sr-only">
+                                            {{ formset.empty_form.id }}
-                                    {{ form.id }}
+                                            {% bootstrap_field formset.empty_form.DELETE form_group_class="" layout="inline" %}
-                                    {% bootstrap_field form.DELETE form_group_class="" layout="inline" %}
+                                            {% bootstrap_field formset.empty_form.ORDER form_group_class="" layout="inline" %}
-                                </div>
+                                        </div>
-                                <div class="col-sm-3">
+                                        <div class="col-sm-6 col-md-3 col-lg-3">
-                                    {% bootstrap_field form.country layout='inline' form_group_class="" %}
+                                            {% bootstrap_field formset.empty_form.country layout='inline' form_group_class="" %}
-                                </div>
+                                        </div>
-                                <div class="col-sm-3">
+                                        <div class="col-sm-6 col-md-3 col-lg-4">
-                                    {% bootstrap_field form.address_type layout='inline' form_group_class="" %}
+                                            {% bootstrap_field formset.empty_form.address_type layout='inline' form_group_class="" %}
-                                </div>
+                                        </div>
-                                <div class="col-sm-3">
+                                        <div class="col-sm-6 col-md-3 col-lg-3">
-                                    {% bootstrap_field form.action layout='inline' form_group_class="" %}
+                                            {% bootstrap_field formset.empty_form.action layout='inline' form_group_class="" %}
-                                </div>
+                                        </div>
-                                <div class="col-sm-2">
+                                        <div class="col-sm-6 col-md-3 col-lg-2 text-right flip">
-                                    {% bootstrap_field form.rate layout='inline' form_group_class="" %}
+                                            <button type="button" class="btn btn-default" data-formset-move-up-button>
-                                </div>
+                                                <i class="fa fa-arrow-up"></i></button>
-                                <div class="col-sm-1 text-right flip">
+                                            <button type="button" class="btn btn-default" data-formset-move-down-button>
-                                    <button type="button" class="btn btn-block btn-danger" data-formset-delete-button>
+                                                <i class="fa fa-arrow-down"></i></button>
-                                        <i class="fa fa-trash"></i></button>
+                                            <button type="button" class="btn btn-danger" data-formset-delete-button>
+                                                <i class="fa fa-trash"></i></button>
+                                        </div>
+                                        <div class="col-sm-6 col-md-3 col-lg-4 col-md-offset-3">
+                                            {% bootstrap_field formset.empty_form.invoice_text layout='inline' form_group_class="" %}
+                                        </div>
+                                        <div class="col-sm-6 col-md-3 col-lg-3">
+                                            {% bootstrap_field formset.empty_form.rate layout='inline' form_group_class="" %}
+                                        </div>
+                                    </div>
+                                {% endescapescript %}
+                            </script>
+                            <div data-formset-body class="tax-rule-lines">
+                                {% for form in formset %}
+                                    {% bootstrap_form_errors form %}
+                                    <div class="row tax-rule-line" data-formset-form>
+                                        <div class="sr-only">
+                                            {{ form.id }}
+                                            {% bootstrap_field form.DELETE form_group_class="" layout="inline" %}
+                                            {% bootstrap_field form.ORDER form_group_class="" layout="inline" %}
+                                        </div>
+                                        <div class="col-sm-6 col-md-3 col-lg-3">
+                                            {% bootstrap_field form.country layout='inline' form_group_class="" %}
+                                        </div>
+                                        <div class="col-sm-6 col-md-3 col-lg-4">
+                                            {% bootstrap_field form.address_type layout='inline' form_group_class="" %}
+                                        </div>
+                                        <div class="col-sm-6 col-md-3 col-lg-3">
+                                            {% bootstrap_field form.action layout='inline' form_group_class="" %}
+                                        </div>
+                                        <div class="col-sm-6 col-md-3 col-lg-2 text-right flip">
+                                            <button type="button" class="btn btn-default" data-formset-move-up-button>
+                                                <i class="fa fa-arrow-up"></i></button>
+                                            <button type="button" class="btn btn-default" data-formset-move-down-button>
+                                                <i class="fa fa-arrow-down"></i></button>
+                                            <button type="button" class="btn btn-danger" data-formset-delete-button>
+                                                <i class="fa fa-trash"></i></button>
+                                        </div>
+                                        <div class="col-sm-6 col-md-3 col-lg-4 col-md-offset-3">
+                                            {% bootstrap_field form.invoice_text layout='inline' form_group_class="" %}
+                                        </div>
+                                        <div class="col-sm-6 col-md-3 col-lg-3">
+                                            {% bootstrap_field form.rate layout='inline' form_group_class="" %}
+                                        </div>
+                                    </div>
+                                {% endfor %}
+                            </div>
+                            <div class="row tax-rule-line" data-formset-form>
+                                <div class="col-sm-12">
+                                    <button type="button" class="btn btn-default" data-formset-add>
+                                        <i class="fa fa-plus"></i> {% trans "Add a new rule" %}</button>
                                 </div>
                             </div>
-                        {% endfor %}
+                        </div>
-                    </div>
+                    </fieldset>
-                    <script type="form-template" data-formset-empty-form>
-                        {% escapescript %}
-                            <div class="row" data-formset-form>
-                                <div class="sr-only">
-                                    {{ form.id }}
-                                    {% bootstrap_field formset.empty_form.DELETE form_group_class="" layout="inline" %}
-                                </div>
-                                <div class="col-sm-3">
-                                    {% bootstrap_field formset.empty_form.country layout='inline' form_group_class="" %}
-                                </div>
-                                <div class="col-sm-3">
-                                    {% bootstrap_field formset.empty_form.address_type layout='inline' form_group_class="" %}
-                                </div>
-                                <div class="col-sm-3">
-                                    {% bootstrap_field formset.empty_form.action layout='inline' form_group_class="" %}
-                                </div>
-                                <div class="col-sm-2">
-                                    {% bootstrap_field formset.empty_form.rate layout='inline' form_group_class="" %}
-                                </div>
-                                <div class="col-sm-1 text-right flip">
-                                    <button type="button" class="btn btn-block btn-danger" data-formset-delete-button>
-                                        <i class="fa fa-trash"></i></button>
-                                </div>
-                            </div>
-                        {% endescapescript %}
-                    </script>
-                    <p>
-                        <button type="button" class="btn btn-default" data-formset-add>
-                            <i class="fa fa-plus"></i> {% trans "Add a new rule" %}</button>
-                    </p>
                 </div>
-            </fieldset>
+                <div class="form-group submit-group">
-        </div>
+                    <button type="submit" class="btn btn-primary btn-save">
-        <div class="form-group submit-group">
+                        {% trans "Save" %}
-            <button type="submit" class="btn btn-primary btn-save">
+                    </button>
-                {% trans "Save" %}
+                </div>
-            </button>
+            </div>
+            <div class="col-xs-12 col-lg-2">
+                <div class="panel panel-default">
+                    <div class="panel-heading">
+                        <h3 class="panel-title">
+                            {% trans "Change history" %}
+                        </h3>
+                    </div>
+                    {% include "pretixcontrol/includes/logs.html" with obj=rule %}
+                </div>
+            </div>
         </div>
     </form>
 {% endblock %}

src/pretix/control/templates/pretixcontrol/events/create_foundation.html

@@ -27,7 +27,7 @@
             </div>
             <div class="big-radio radio">
                 <label>
-                    <input type="radio" value="on" name="{{ form.has_subevents.html_name }}" {% if not form.has_subevents.value %}checked{% endif %}>
+                    <input type="radio" value="on" name="{{ form.has_subevents.html_name }}" {% if form.has_subevents.avalue %}checked{% endif %}>
                     <span class="fa fa-calendar"></span>
                     <strong>{% trans "Event series or time slot booking" %}</strong>
                     <div class="help-block">

src/pretix/control/templates/pretixcontrol/global_settings.html

@@ -6,7 +6,7 @@
     <form action="" method="post" class="form-horizontal" enctype="multipart/form-data">
         {% csrf_token %}
         {% bootstrap_form_errors form %}
-        {% bootstrap_form form layout='horizontal' %}
+        {% bootstrap_form form layout='control' %}
         <div class="form-group submit-group">
             <button type="submit" class="btn btn-primary btn-save">
                 {% trans "Save" %}

src/pretix/control/templates/pretixcontrol/items/question_edit.html

@@ -32,6 +32,18 @@
                         accepted. If you want to allow both options, do not make this field required.
                     {% endblocktrans %}
                 </div>
+                <div id="valid-number">
+                    {% bootstrap_field form.valid_number_min layout="control" %}
+                    {% bootstrap_field form.valid_number_max layout="control" %}
+                </div>
+                <div id="valid-date">
+                    {% bootstrap_field form.valid_date_min layout="control" %}
+                    {% bootstrap_field form.valid_date_max layout="control" %}
+                </div>
+                <div id="valid-datetime">
+                    {% bootstrap_field form.valid_datetime_min layout="control" %}
+                    {% bootstrap_field form.valid_datetime_max layout="control" %}
+                </div>
                 <div id="answer-options">
                     <h3>{% trans "Answer options" %}</h3>
                     <noscript>

src/pretix/control/templates/pretixcontrol/order/index.html

@@ -6,6 +6,7 @@
 {% load rich_text %}
 {% load safelink %}
 {% load eventsignal %}
+{% load phone_format %}
 {% block title %}
     {% blocktrans trimmed with code=order.code %}
         Order details: {{ code }}
@@ -201,6 +202,15 @@
                                 {% endif %}
                             {% endif %}
                         </dd>
+                        {% if order.phone or request.event.settings.order_phone_asked %}
+                            <dt>{% trans "Phone number" %}</dt>
+                            <dd>
+                                {{ order.phone|default_if_none:""|phone_format }}
+                                <a href="{% url "control:event.order.contact" event=request.event.slug organizer=request.event.organizer.slug code=order.code %}" class="btn btn-default btn-xs">
+                                    <span class="fa fa-edit"></span>
+                                </a>
+                            </dd>
+                        {% endif %}
                         {% if invoices %}
                             <dt>{% trans "Invoices" %}</dt>
                             <dd>
@@ -560,6 +570,26 @@
                         </div>
                         <div class="clearfix"></div>
                     </div>
+                    {% if order.status != "c" and order.total != payment_refund_sum %}
+                        <div class="row-fluid product-row cart-row">
+                            <div class="col-md-4 col-xs-6">
+                                {% trans "Successful payments" %}
+                            </div>
+                            <div class="col-md-3 col-xs-6 col-md-offset-5 price">
+                                {{ payment_refund_sum|money:event.currency }}
+                            </div>
+                            <div class="clearfix"></div>
+                        </div>
+                        <div class="row-fluid product-row total text-danger">
+                            <div class="col-md-4 col-xs-6">
+                                <strong>{% trans "Pending total" %}</strong>
+                            </div>
+                            <div class="col-md-3 col-xs-6 col-md-offset-5 price">
+                                <strong>{{ order.pending_sum|money:event.currency }}</strong>
+                            </div>
+                            <div class="clearfix"></div>
+                        </div>
+                    {% endif %}
                 </div>
             </div>
             {% eventsignal event "pretix.control.signals.order_info" order=order request=request %}

src/pretix/control/templates/pretixcontrol/orders/index.html

@@ -113,7 +113,7 @@
                         <a href="?{% url_replace request 'ordering' '-datetime' %}"><i class="fa fa-caret-down"></i></a>
                         <a href="?{% url_replace request 'ordering' 'datetime' %}"><i class="fa fa-caret-up"></i></a>
                     </th>
-                    <th class="text-right flip">{% trans "Order total" %}
+                    <th class="text-right flip">{% trans "Order  paid / total" %}
                         <a href="?{% url_replace request 'ordering' '-total' %}"><i class="fa fa-caret-down"></i></a>
                         <a href="?{% url_replace request 'ordering' 'total' %}"><i class="fa fa-caret-up"></i></a></th>
                     <th class="text-right flip">{% trans "Positions" %}</th>
@@ -141,7 +141,11 @@
                                 <br>{{ o.invoice_address.name }}
                             {% endif %}
                         </td>
-                        <td>{{ o.datetime|date:"SHORT_DATETIME_FORMAT" }}</td>
+                        <td>
+                            <span class="fa fa-{{ o.sales_channel_obj.icon }} text-muted"
+                                  data-toggle="tooltip" title="{% trans o.sales_channel_obj.verbose_name %}"></span>
+                            {{ o.datetime|date:"SHORT_DATETIME_FORMAT" }}
+                        </td>
                         <td class="text-right flip">
                             {% if o.has_cancellation_request %}
                                 <span class="label label-warning">{% trans "CANCELLATION REQUESTED" %}</span>
@@ -158,6 +162,13 @@
                             {% elif o.is_pending_with_full_payment %}
                                 <span class="label label-danger">{% trans "FULLY PAID" %}</span>
                             {% endif %}
+                            {% if o.computed_payment_refund_sum == o.total or o.computed_payment_refund_sum == 0 %}
+                                <span class="text-muted">
+                            {% endif %}
+                            {{ o.computed_payment_refund_sum|money:request.event.currency }} /
+                            {% if o.computed_payment_refund_sum == o.total or o.computed_payment_refund_sum == 0 %}
+                                </span>
+                            {% endif %}
                             {{ o.total|money:request.event.currency }}
                         </td>
                         <td class="text-right flip">{{ o.pcnt|default_if_none:"0" }}</td>

src/pretix/control/templates/pretixcontrol/organizers/edit.html

@@ -45,6 +45,7 @@
             <fieldset>
                 <legend>{% trans "Localization" %}</legend>
                 {% bootstrap_field sform.locales layout="control" %}
+                {% bootstrap_field sform.region layout="control" %}
             </fieldset>
             <fieldset>
                 <legend>{% trans "Shop design" %}</legend>

src/pretix/control/templates/pretixcontrol/vouchers/detail.html

@@ -32,7 +32,7 @@
                                 <label class="col-md-3 control-label" for="id_url">{% trans "Voucher link" %}</label>
                                 <div class="col-md-9">
                                     <input type="text" name="url"
-                                            value="{% abseventurl request.event "presale:event.redeem" %}?voucher={{ voucher.code }}&subevent={{ voucher.subevent_id }}"
+                                            value="{% abseventurl request.event "presale:event.redeem" %}?voucher={{ voucher.code }}{% if voucher.subevent_id %}&subevent={{ voucher.subevent_id }}{% endif %}"
                                             class="form-control"
                                             id="id_url" readonly>
                                 </div>

src/pretix/control/urls.py

@@ -1,4 +1,5 @@
 from django.conf.urls import include, url
+from django.views.generic.base import RedirectView
 
 from pretix.control.views import (
     auth, checkin, dashboards, event, geo, global_settings, item, main, oauth,
@@ -303,4 +304,5 @@ urlpatterns = [
         url(r'^checkinlists/(?P<list>\d+)/delete$', checkin.CheckinListDelete.as_view(),
             name='event.orders.checkinlists.delete'),
     ])),
+    url(r'^event/(?P<organizer>[^/]+)/$', RedirectView.as_view(pattern_name='control:organizer'), name='event.organizerredirect'),
 ]

src/pretix/control/views/auth.py

@@ -74,13 +74,15 @@ def login(request):
         backend = [b for b in backends if b.visible][0]
     if request.user.is_authenticated:
         next_url = backend.get_next_url(request) or 'control:index'
-        return redirect(next_url)
+        if next_url and url_has_allowed_host_and_scheme(next_url, allowed_hosts=None):
+            return redirect(next_url)
+        return redirect(reverse('control:index'))
     if request.method == 'POST':
-        form = LoginForm(backend=backend, data=request.POST)
+        form = LoginForm(backend=backend, data=request.POST, request=request)
         if form.is_valid() and form.user_cache and form.user_cache.auth_backend == backend.identifier:
             return process_login(request, form.user_cache, form.cleaned_data.get('keep_logged_in', False))
     else:
-        form = LoginForm(backend=backend)
+        form = LoginForm(backend=backend, request=request)
     ctx['form'] = form
     ctx['can_register'] = settings.PRETIX_REGISTRATION
     ctx['can_reset'] = settings.PRETIX_PASSWORD_RESET

src/pretix/control/views/event.py

@@ -10,7 +10,6 @@ from django.conf import settings
 from django.contrib import messages
 from django.contrib.contenttypes.models import ContentType
 from django.core.files import File
-from django.core.serializers.json import DjangoJSONEncoder
 from django.db import transaction
 from django.db.models import ProtectedError
 from django.forms import inlineformset_factory
@@ -20,7 +19,6 @@ from django.http import (
 )
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
-from django.utils import translation
 from django.utils.functional import cached_property
 from django.utils.timezone import now
 from django.utils.translation import gettext, gettext_lazy as _
@@ -28,6 +26,7 @@ from django.views.generic import DeleteView, FormView, ListView
 from django.views.generic.base import TemplateView, View
 from django.views.generic.detail import SingleObjectMixin
 from i18nfield.strings import LazyI18nString
+from i18nfield.utils import I18nJSONEncoder
 from pytz import timezone
 
 from pretix.base.channels import get_all_sales_channels
@@ -55,8 +54,9 @@ from pretix.multidomain.urlreverse import get_event_domain
 from pretix.plugins.stripe.payment import StripeSettingsHolder
 from pretix.presale.style import regenerate_css
 
+from ...base.i18n import language
 from ...base.models.items import ItemMetaProperty
-from ...base.settings import LazyI18nStringList
+from ...base.settings import SETTINGS_AFFECTING_CSS, LazyI18nStringList
 from ..logdisplay import OVERVIEW_BANLIST
 from . import CreateView, PaginationMixin, UpdateView
 
@@ -161,11 +161,7 @@ class EventUpdate(DecoupleMixin, EventSettingsViewMixin, EventPermissionRequired
             if self.confirm_texts_formset.has_changed():
                 data.update(confirm_texts=self.confirm_texts_formset.cleaned_data)
             self.request.event.log_action('pretix.event.settings', user=self.request.user, data=data)
-            display_properties = (
+            if any(p in self.sform.changed_data for p in SETTINGS_AFFECTING_CSS):
-                'primary_color', 'theme_color_success', 'theme_color_danger', 'primary_font',
-                'theme_color_background', 'theme_round_borders',
-            )
-            if any(p in self.sform.changed_data for p in display_properties):
                 change_css = True
         if form.has_changed():
             self.request.event.log_action('pretix.event.changed', user=self.request.user, data={
@@ -598,7 +594,7 @@ class MailSettings(EventSettingsViewMixin, EventSettingsFormView):
                 )
 
             if request.POST.get('test', '0').strip() == '1':
-                backend = self.request.event.get_mail_backend(force_custom=True)
+                backend = self.request.event.get_mail_backend(force_custom=True, timeout=10)
                 try:
                     backend.test(self.request.event.settings.mail_from)
                 except Exception as e:
@@ -663,7 +659,7 @@ class MailSettingsPreview(EventPermissionRequiredMixin, View):
             if matched is not None:
                 idx = matched.group('idx')
                 if idx in self.supported_locale:
-                    with translation.override(self.supported_locale[idx]):
+                    with language(self.supported_locale[idx], self.request.event.settings.region):
                         msgs[self.supported_locale[idx]] = markdown_compile_email(
                             v.format_map(self.placeholders(preview_item))
                         )
@@ -1097,6 +1093,7 @@ class TaxCreate(EventSettingsViewMixin, EventPermissionRequiredMixin, CreateView
     def formset(self):
         return TaxRuleLineFormSet(
             data=self.request.POST if self.request.method == "POST" else None,
+            event=self.request.event,
         )
 
     def get_context_data(self, **kwargs):
@@ -1108,8 +1105,8 @@ class TaxCreate(EventSettingsViewMixin, EventPermissionRequiredMixin, CreateView
     def form_valid(self, form):
         form.instance.event = self.request.event
         form.instance.custom_rules = json.dumps([
-            f.cleaned_data for f in self.formset if f not in self.formset.deleted_forms
+            f.cleaned_data for f in self.formset.ordered_forms if f not in self.formset.deleted_forms
-        ], cls=DjangoJSONEncoder)
+        ], cls=I18nJSONEncoder)
         messages.success(self.request, _('The new tax rule has been created.'))
         ret = super().form_valid(form)
         form.instance.log_action('pretix.event.taxrule.added', user=self.request.user, data=dict(form.cleaned_data))
@@ -1147,6 +1144,7 @@ class TaxUpdate(EventSettingsViewMixin, EventPermissionRequiredMixin, UpdateView
     def formset(self):
         return TaxRuleLineFormSet(
             data=self.request.POST if self.request.method == "POST" else None,
+            event=self.request.event,
             initial=json.loads(self.object.custom_rules) if self.object.custom_rules else []
         )
 
@@ -1159,8 +1157,8 @@ class TaxUpdate(EventSettingsViewMixin, EventPermissionRequiredMixin, UpdateView
     def form_valid(self, form):
         messages.success(self.request, _('Your changes have been saved.'))
         form.instance.custom_rules = json.dumps([
-            f.cleaned_data for f in self.formset if f not in self.formset.deleted_forms
+            f.cleaned_data for f in self.formset.ordered_forms if f not in self.formset.deleted_forms
-        ], cls=DjangoJSONEncoder)
+        ], cls=I18nJSONEncoder)
         if form.has_changed():
             self.object.log_action(
                 'pretix.event.taxrule.changed', user=self.request.user, data={

src/pretix/control/views/geo.py

@@ -14,14 +14,7 @@ logger = logging.getLogger(__name__)
 
 class GeoCodeView(LoginRequiredMixin, View):
     def get(self, request, *args, **kwargs):
-        gs = GlobalSettingsObject()
+        q = self.request.GET.get('q')
-        if not gs.settings.opencagedata_apikey:
-            return JsonResponse({
-                'success': False,
-                'results': []
-            }, status=200)
-
-        q = request.GET.get('q')
         cd = cache.get('geocode:{}'.format(q))
         if cd:
             return JsonResponse({
@@ -29,6 +22,26 @@ class GeoCodeView(LoginRequiredMixin, View):
                 'results': cd
             }, status=200)
 
+        gs = GlobalSettingsObject()
+        if gs.settings.opencagedata_apikey:
+            res = self._use_opencage(q)
+        if gs.settings.mapquest_apikey:
+            res = self._use_mapquest(q)
+        else:
+            return JsonResponse({
+                'success': False,
+                'results': []
+            }, status=200)
+
+        cache.set('geocode:{}'.format(q), res, timeout=3600 * 6)
+        return JsonResponse({
+            'success': True,
+            'results': res
+        }, status=200)
+
+    def _use_opencage(self, q):
+        gs = GlobalSettingsObject()
+
         try:
             r = requests.get(
                 'https://api.opencagedata.com/geocode/v1/json?q={}&key={}'.format(
@@ -51,9 +64,31 @@ class GeoCodeView(LoginRequiredMixin, View):
                 'lon': r['geometry']['lng'],
             } for r in d['results']
         ]
-        cache.set('geocode:{}'.format(q), res, timeout=3600 * 6)
+        return res
 
-        return JsonResponse({
+    def _use_mapquest(self, q):
-            'success': True,
+        gs = GlobalSettingsObject()
-            'results': res
+
-        }, status=200)
+        try:
+            r = requests.get(
+                'https://www.mapquestapi.com/geocoding/v1/address?location={}&key={}'.format(
+                    quote(q), gs.settings.mapquest_apikey
+                )
+            )
+            r.raise_for_status()
+        except IOError:
+            logger.exception("Geocoding failed")
+            return JsonResponse({
+                'success': False,
+                'results': []
+            }, status=200)
+        else:
+            d = r.json()
+        res = [
+            {
+                'formatted': q,
+                'lat': r['locations'][0]['latLng']['lat'],
+                'lon': r['locations'][0]['latLng']['lng'],
+            } for r in d['results']
+        ]
+        return res