diff --git a/src/pretix/control/views/pdf.py b/src/pretix/control/views/pdf.py
index 03f21c731..e8c5d855d 100644
--- a/src/pretix/control/views/pdf.py
+++ b/src/pretix/control/views/pdf.py
@@ -284,7 +284,7 @@ class BaseEditorView(EventPermissionRequiredMixin, TemplateView):
ctx['pdf'] = self.get_current_background()
ctx['variables'] = self.get_variables()
ctx['images'] = self.get_images()
- ctx['layout'] = json.dumps(self.get_current_layout())
+ ctx['layout'] = self.get_current_layout()
ctx['title'] = self.title
ctx['locales'] = [p for p in settings.LANGUAGES if p[0] in self.request.event.settings.locales]
ctx['maxfilesize'] = self.maxfilesize
diff --git a/src/pretix/helpers/apps.py b/src/pretix/helpers/apps.py
index c51aa3ed3..847fccb6d 100644
--- a/src/pretix/helpers/apps.py
+++ b/src/pretix/helpers/apps.py
@@ -29,3 +29,8 @@ class PretixHelpersConfig(AppConfig):
def ready(self):
from .monkeypatching import monkeypatch_all_at_ready
monkeypatch_all_at_ready()
+
+ # Ensure reportlab does not make any calls to the internet or the local disk
+ from reportlab import rl_config
+ rl_config.trustedHosts = []
+ rl_config.trustedSchemes = ['data']
diff --git a/src/pretix/helpers/monkeypatching.py b/src/pretix/helpers/monkeypatching.py
index 1eb46fb5f..2e309255d 100644
--- a/src/pretix/helpers/monkeypatching.py
+++ b/src/pretix/helpers/monkeypatching.py
@@ -27,6 +27,7 @@ from datetime import datetime
from http import cookies
from django.conf import settings
+from django.core.exceptions import SuspiciousFileOperation
from PIL import Image
from requests.adapters import HTTPAdapter
from urllib3.connection import HTTPConnection, HTTPSConnection
@@ -40,6 +41,8 @@ from urllib3.util.connection import (
)
from urllib3.util.timeout import _DEFAULT_TIMEOUT
+from pretix.helpers.reportlab import ThumbnailingImageReader
+
_cgnat_net = ipaddress.ip_network('100.64.0.0/10')
@@ -230,9 +233,27 @@ def monkeypatch_cookie_morsel():
cookies.Morsel._reserved.setdefault("partitioned", "Partitioned")
+def monkeypatch_reportlab_imagereader():
+ from reportlab.lib import utils
+ old_init = utils.ImageReader.__init__
+
+ def new_init(self, fileName, ident=None): # noqa
+ if not isinstance(fileName, Image.Image) and not hasattr(fileName, 'read') and not hasattr(fileName, 'str'):
+ if not isinstance(self, ThumbnailingImageReader):
+ # ThumbnailingImageReader is only used by us explicitly and not by using
in html, so it is safe
+ raise SuspiciousFileOperation("reportlab should not be reading images from disk")
+
+ return types.MethodType(old_init, self)(
+ fileName, ident
+ )
+
+ utils.ImageReader.__init__ = new_init
+
+
def monkeypatch_all_at_ready():
monkeypatch_vobject_performance()
monkeypatch_pillow_safer()
monkeypatch_requests_timeout()
monkeypatch_urllib3_ssrf_protection()
monkeypatch_cookie_morsel()
+ monkeypatch_reportlab_imagereader()
diff --git a/src/pretix/helpers/reportlab.py b/src/pretix/helpers/reportlab.py
index 5a39ac4a5..618dbb87e 100644
--- a/src/pretix/helpers/reportlab.py
+++ b/src/pretix/helpers/reportlab.py
@@ -20,14 +20,19 @@
#
.
#
import logging
+import re
+import unicodedata
from arabic_reshaper import ArabicReshaper
+from bidi import get_display
from django.conf import settings
from django.utils.functional import SimpleLazyObject
+from django.utils.html import escape
from PIL import Image
from reportlab.lib.styles import ParagraphStyle
from reportlab.lib.utils import ImageReader
from reportlab.pdfbase import pdfmetrics
+from reportlab.pdfbase.ttfonts import TTFont
from reportlab.platypus import Paragraph
from pretix.presale.style import get_fonts
@@ -70,6 +75,20 @@ reshaper = SimpleLazyObject(lambda: ArabicReshaper(configuration={
}))
+def normalize_text(text: str) -> str:
+ # reportlab does not support unicode combination characters
+ # It's important we do this before we use ArabicReshaper
+ text = unicodedata.normalize("NFKC", text)
+
+ # reportlab does not support RTL, ligature-heavy scripts like Arabic. Therefore, we use ArabicReshaper
+ # to resolve all ligatures and python-bidi to switch RTL texts.
+ try:
+ text = "\n".join(get_display(reshaper.reshape(l)) for l in re.split("\n", text))
+ except:
+ logger.exception('Reshaping/Bidi fixes failed on string {}'.format(repr(text)))
+ return text
+
+
class FontFallbackParagraph(Paragraph):
def __init__(self, text, style=None, *args, **kwargs):
if style is None:
@@ -87,6 +106,8 @@ class FontFallbackParagraph(Paragraph):
if not text:
return True
font = pdfmetrics.getFont(font_name)
+ if not isinstance(font, TTFont):
+ return True
return all(
ord(c) in font.face.charToGlyph or not c.isprintable()
for c in text
@@ -102,6 +123,24 @@ class FontFallbackParagraph(Paragraph):
return family
+class PlainTextParagraph(FontFallbackParagraph):
+ def __init__(self, text, style=None, linebreaks=True, *args, **kwargs):
+ if not isinstance(text, str):
+ if hasattr(text, '__html__'):
+ raise ValueError("It is contradictory to pass escaped content to PlainTextParagraph")
+ text = str(text)
+
+ # Normalize unicode and apply reshaping
+ text = normalize_text(text)
+
+ # Escape any HTML in the text
+ text = escape(text)
+
+ if linebreaks:
+ text = text.strip().replace("\n", "
\n")
+ super().__init__(text, style, *args, **kwargs)
+
+
def register_ttf_font_if_new(name, path):
from reportlab.pdfbase import pdfmetrics
from reportlab.pdfbase.ttfonts import TTFont
diff --git a/src/pretix/helpers/templatetags/wrap_in.py b/src/pretix/helpers/templatetags/wrap_in.py
new file mode 100644
index 000000000..e08bd2c90
--- /dev/null
+++ b/src/pretix/helpers/templatetags/wrap_in.py
@@ -0,0 +1,33 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-today pretix GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see
.
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program. If not, see
+# .
+#
+import logging
+
+from django import template
+from django.utils.html import format_html
+
+register = template.Library()
+logger = logging.getLogger(__name__)
+
+
+@register.filter
+def wrap_in(content, tag_name):
+ return format_html(f'<{tag_name}>{{}}{tag_name}>', content)
diff --git a/src/pretix/locale/de/LC_MESSAGES/djangojs.po b/src/pretix/locale/de/LC_MESSAGES/djangojs.po
index ca79c1705..40b6b84e8 100644
--- a/src/pretix/locale/de/LC_MESSAGES/djangojs.po
+++ b/src/pretix/locale/de/LC_MESSAGES/djangojs.po
@@ -161,12 +161,12 @@ msgstr "Bezahlte Bestellungen"
#: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js:27
#: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js:39
msgid "Attendees (ordered)"
-msgstr "Teilnehmende (bestellt)"
+msgstr "Teilnehmer (bestellt)"
#: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js:27
#: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js:39
msgid "Attendees (paid)"
-msgstr "Teilnehmende (bezahlt)"
+msgstr "Teilnehmer (bezahlt)"
#: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js:51
msgid "Total revenue"
diff --git a/src/pretix/locale/de_Informal/LC_MESSAGES/djangojs.po b/src/pretix/locale/de_Informal/LC_MESSAGES/djangojs.po
index ba1788508..94c6174ac 100644
--- a/src/pretix/locale/de_Informal/LC_MESSAGES/djangojs.po
+++ b/src/pretix/locale/de_Informal/LC_MESSAGES/djangojs.po
@@ -161,12 +161,12 @@ msgstr "Bezahlte Bestellungen"
#: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js:27
#: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js:39
msgid "Attendees (ordered)"
-msgstr "Teilnehmende (bestellt)"
+msgstr "Teilnehmer (bestellt)"
#: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js:27
#: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js:39
msgid "Attendees (paid)"
-msgstr "Teilnehmende (bezahlt)"
+msgstr "Teilnehmer (bezahlt)"
#: pretix/plugins/statistics/static/pretixplugins/statistics/statistics.js:51
msgid "Total revenue"
diff --git a/src/pretix/plugins/checkinlists/exporters.py b/src/pretix/plugins/checkinlists/exporters.py
index 8bd8763fc..40d98add1 100644
--- a/src/pretix/plugins/checkinlists/exporters.py
+++ b/src/pretix/plugins/checkinlists/exporters.py
@@ -64,7 +64,7 @@ from pretix.base.timeframes import (
from pretix.control.forms.widgets import Select2
from pretix.helpers.filenames import safe_for_filename
from pretix.helpers.iter import chunked_iterable
-from pretix.helpers.reportlab import FontFallbackParagraph
+from pretix.helpers.reportlab import PlainTextParagraph
from pretix.helpers.templatetags.jsonfield import JSONExtract
from pretix.plugins.reports.exporters import ReportlabExportMixin
@@ -343,7 +343,7 @@ class PDFCheckinList(ReportlabExportMixin, CheckInListMixin, BaseExporter):
]
story = [
- FontFallbackParagraph(
+ PlainTextParagraph(
cl.name,
headlinestyle
),
@@ -351,7 +351,7 @@ class PDFCheckinList(ReportlabExportMixin, CheckInListMixin, BaseExporter):
if cl.subevent:
story += [
Spacer(1, 3 * mm),
- FontFallbackParagraph(
+ PlainTextParagraph(
'{} ({} {})'.format(
cl.subevent.name,
cl.subevent.get_date_range_display(),
@@ -381,10 +381,10 @@ class PDFCheckinList(ReportlabExportMixin, CheckInListMixin, BaseExporter):
headrowstyle.fontName = 'OpenSansBd'
for q in questions:
txt = str(q.question)
- p = FontFallbackParagraph(txt, headrowstyle)
+ p = PlainTextParagraph(txt, headrowstyle)
while p.wrap(colwidths[len(tdata[0])], 5000)[1] > 30 * mm:
txt = txt[:len(txt) - 50] + "..."
- p = FontFallbackParagraph(txt, headrowstyle)
+ p = PlainTextParagraph(txt, headrowstyle)
tdata[0].append(p)
qs = self._get_queryset(cl, form_data)
@@ -431,8 +431,8 @@ class PDFCheckinList(ReportlabExportMixin, CheckInListMixin, BaseExporter):
CBFlowable(bool(op.last_checked_in)) if not op.blocked else '—',
'✘' if op.order.status != Order.STATUS_PAID else '✔',
op.order.code,
- FontFallbackParagraph(name, self.get_style()),
- FontFallbackParagraph(bleach.clean(str(item), tags={'br'}).strip().replace(' ', ' '), self.get_style()),
+ PlainTextParagraph(name, self.get_style()),
+ PlainTextParagraph(bleach.clean(str(item), tags={'br'}).strip().replace(' ', ' '), self.get_style()),
]
acache = {}
if op.addon_to:
@@ -443,10 +443,10 @@ class PDFCheckinList(ReportlabExportMixin, CheckInListMixin, BaseExporter):
for q in questions:
txt = acache.get(q.pk, '')
txt = bleach.clean(txt, tags={'br'}).strip().replace(' ', ' ')
- p = FontFallbackParagraph(txt, self.get_style())
+ p = PlainTextParagraph(txt, self.get_style())
while p.wrap(colwidths[len(row)], 5000)[1] > 50 * mm:
txt = txt[:len(txt) - 50] + "..."
- p = FontFallbackParagraph(txt, self.get_style())
+ p = PlainTextParagraph(txt, self.get_style())
row.append(p)
if op.order.status != Order.STATUS_PAID:
tstyledata += [
diff --git a/src/pretix/plugins/reports/accountingreport.py b/src/pretix/plugins/reports/accountingreport.py
index 17315eb02..6c09ad141 100644
--- a/src/pretix/plugins/reports/accountingreport.py
+++ b/src/pretix/plugins/reports/accountingreport.py
@@ -36,7 +36,7 @@ from reportlab.lib import colors, pagesizes
from reportlab.lib.enums import TA_CENTER, TA_RIGHT
from reportlab.lib.units import mm
from reportlab.platypus import (
- KeepTogether, PageTemplate, Paragraph, Spacer, Table, TableStyle,
+ KeepTogether, PageTemplate, Spacer, Table, TableStyle,
)
from pretix.base.exporter import BaseExporter
@@ -49,7 +49,7 @@ from pretix.base.timeframes import (
resolve_timeframe_to_datetime_start_inclusive_end_exclusive,
)
from pretix.control.forms.filter import get_all_payment_providers
-from pretix.helpers.reportlab import FontFallbackParagraph
+from pretix.helpers.reportlab import PlainTextParagraph
from pretix.plugins.reports.exporters import ReportlabExportMixin
@@ -311,13 +311,13 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
tdata = [
[
- FontFallbackParagraph(self._transaction_group_header_label(), tstyle_bold),
- FontFallbackParagraph(_("Price"), tstyle_bold_right),
- FontFallbackParagraph(_("Tax rate"), tstyle_bold_right),
- FontFallbackParagraph("#", tstyle_bold_right),
- FontFallbackParagraph(_("Net total"), tstyle_bold_right),
- FontFallbackParagraph(_("Tax total"), tstyle_bold_right),
- FontFallbackParagraph(_("Gross total"), tstyle_bold_right),
+ PlainTextParagraph(self._transaction_group_header_label(), tstyle_bold),
+ PlainTextParagraph(_("Price"), tstyle_bold_right),
+ PlainTextParagraph(_("Tax rate"), tstyle_bold_right),
+ PlainTextParagraph("#", tstyle_bold_right),
+ PlainTextParagraph(_("Net total"), tstyle_bold_right),
+ PlainTextParagraph(_("Tax total"), tstyle_bold_right),
+ PlainTextParagraph(_("Gross total"), tstyle_bold_right),
]
]
@@ -347,12 +347,12 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
if e != last_group:
if last_group_head_idx > 0 and e is not None:
- tdata[last_group_head_idx][4] = Paragraph(money_filter(sum_price_by_group - sum_tax_by_group, currency), tstyle_bold_right),
- tdata[last_group_head_idx][5] = Paragraph(money_filter(sum_tax_by_group, currency), tstyle_bold_right),
- tdata[last_group_head_idx][6] = Paragraph(money_filter(sum_price_by_group, currency), tstyle_bold_right),
+ tdata[last_group_head_idx][4] = PlainTextParagraph(money_filter(sum_price_by_group - sum_tax_by_group, currency), tstyle_bold_right),
+ tdata[last_group_head_idx][5] = PlainTextParagraph(money_filter(sum_tax_by_group, currency), tstyle_bold_right),
+ tdata[last_group_head_idx][6] = PlainTextParagraph(money_filter(sum_price_by_group, currency), tstyle_bold_right),
tdata.append(
[
- FontFallbackParagraph(
+ PlainTextParagraph(
e,
tstyle_bold,
),
@@ -375,20 +375,20 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
text = self._transaction_row_label(r)
tdata.append(
[
- FontFallbackParagraph(text, tstyle),
- Paragraph(
+ PlainTextParagraph(text, tstyle),
+ PlainTextParagraph(
money_filter(r["price"], currency)
if "price" in r and r["price"] is not None
else "",
tstyle_right,
),
- Paragraph(localize(r["tax_rate"].normalize()) + " %", tstyle_right),
- Paragraph(str(r["sum_cont"]), tstyle_right),
- Paragraph(
+ PlainTextParagraph(localize(r["tax_rate"].normalize()) + " %", tstyle_right),
+ PlainTextParagraph(str(r["sum_cont"]), tstyle_right),
+ PlainTextParagraph(
money_filter(r["sum_price"] - r["sum_tax"], currency), tstyle_right
),
- Paragraph(money_filter(r["sum_tax"], currency), tstyle_right),
- Paragraph(money_filter(r["sum_price"], currency), tstyle_right),
+ PlainTextParagraph(money_filter(r["sum_tax"], currency), tstyle_right),
+ PlainTextParagraph(money_filter(r["sum_price"], currency), tstyle_right),
]
)
sum_cnt_by_tax_rate[r["tax_rate"]] += r["sum_cont"]
@@ -398,19 +398,19 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
sum_tax_by_group += r["sum_tax"]
if last_group_head_idx > 0 and last_group is not None:
- tdata[last_group_head_idx][4] = Paragraph(money_filter(sum_price_by_group - sum_tax_by_group, currency), tstyle_bold_right),
- tdata[last_group_head_idx][5] = Paragraph(money_filter(sum_tax_by_group, currency), tstyle_bold_right),
- tdata[last_group_head_idx][6] = Paragraph(money_filter(sum_price_by_group, currency), tstyle_bold_right),
+ tdata[last_group_head_idx][4] = PlainTextParagraph(money_filter(sum_price_by_group - sum_tax_by_group, currency), tstyle_bold_right),
+ tdata[last_group_head_idx][5] = PlainTextParagraph(money_filter(sum_tax_by_group, currency), tstyle_bold_right),
+ tdata[last_group_head_idx][6] = PlainTextParagraph(money_filter(sum_price_by_group, currency), tstyle_bold_right),
if len(sum_tax_by_tax_rate) > 1:
for tax_rate in sorted(sum_tax_by_tax_rate.keys(), reverse=True):
tdata.append(
[
- FontFallbackParagraph(_("Sum"), tstyle),
- Paragraph("", tstyle_right),
- Paragraph(localize(tax_rate.normalize()) + " %", tstyle_right),
- Paragraph("", tstyle_right),
- Paragraph(
+ PlainTextParagraph(_("Sum"), tstyle),
+ PlainTextParagraph("", tstyle_right),
+ PlainTextParagraph(localize(tax_rate.normalize()) + " %", tstyle_right),
+ PlainTextParagraph("", tstyle_right),
+ PlainTextParagraph(
money_filter(
sum_price_by_tax_rate[tax_rate]
- sum_tax_by_tax_rate[tax_rate],
@@ -418,10 +418,10 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
),
tstyle_right,
),
- Paragraph(
+ PlainTextParagraph(
money_filter(sum_tax_by_tax_rate[tax_rate], currency), tstyle_right
),
- Paragraph(
+ PlainTextParagraph(
money_filter(sum_price_by_tax_rate[tax_rate], currency),
tstyle_right,
),
@@ -439,11 +439,11 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
tdata.append(
[
- FontFallbackParagraph(_("Sum"), tstyle_bold),
- Paragraph("", tstyle_right),
- Paragraph("", tstyle_right),
- Paragraph("", tstyle_bold_right),
- Paragraph(
+ PlainTextParagraph(_("Sum"), tstyle_bold),
+ PlainTextParagraph("", tstyle_right),
+ PlainTextParagraph("", tstyle_right),
+ PlainTextParagraph("", tstyle_bold_right),
+ PlainTextParagraph(
money_filter(
sum(sum_price_by_tax_rate.values())
- sum(sum_tax_by_tax_rate.values()),
@@ -451,11 +451,11 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
),
tstyle_bold_right,
),
- Paragraph(
+ PlainTextParagraph(
money_filter(sum(sum_tax_by_tax_rate.values()), currency),
tstyle_bold_right,
),
- Paragraph(
+ PlainTextParagraph(
money_filter(sum(sum_price_by_tax_rate.values()), currency),
tstyle_bold_right,
),
@@ -493,10 +493,10 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
tdata = [
[
- FontFallbackParagraph(_("Payment method"), tstyle_bold),
- FontFallbackParagraph(_("Payments"), tstyle_bold_right),
- FontFallbackParagraph(_("Refunds"), tstyle_bold_right),
- FontFallbackParagraph(_("Total"), tstyle_bold_right),
+ PlainTextParagraph(_("Payment method"), tstyle_bold),
+ PlainTextParagraph(_("Payments"), tstyle_bold_right),
+ PlainTextParagraph(_("Refunds"), tstyle_bold_right),
+ PlainTextParagraph(_("Total"), tstyle_bold_right),
]
]
@@ -537,20 +537,20 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
for p in providers:
tdata.append(
[
- Paragraph(provider_names.get(p, p), tstyle),
- FontFallbackParagraph(
+ PlainTextParagraph(provider_names.get(p, p), tstyle),
+ PlainTextParagraph(
money_filter(payments_by_provider[p], currency)
if p in payments_by_provider
else "",
tstyle_right,
),
- Paragraph(
+ PlainTextParagraph(
money_filter(refunds_by_provider[p], currency)
if p in refunds_by_provider
else "",
tstyle_right,
),
- Paragraph(
+ PlainTextParagraph(
money_filter(
payments_by_provider.get(p, Decimal("0.00"))
- refunds_by_provider.get(p, Decimal("0.00")),
@@ -563,20 +563,20 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
tdata.append(
[
- FontFallbackParagraph(_("Sum"), tstyle_bold),
- Paragraph(
+ PlainTextParagraph(_("Sum"), tstyle_bold),
+ PlainTextParagraph(
money_filter(
sum(payments_by_provider.values(), Decimal("0.00")), currency
),
tstyle_bold_right,
),
- Paragraph(
+ PlainTextParagraph(
money_filter(
sum(refunds_by_provider.values(), Decimal("0.00")), currency
),
tstyle_bold_right,
),
- Paragraph(
+ PlainTextParagraph(
money_filter(
sum(payments_by_provider.values(), Decimal("0.00"))
- sum(refunds_by_provider.values(), Decimal("0.00")),
@@ -641,7 +641,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
open_before = tx_before - p_before + r_before
tdata.append(
[
- FontFallbackParagraph(
+ PlainTextParagraph(
_("Pending payments at {datetime}").format(
datetime=date_format(
(df_start - datetime.timedelta.resolution).astimezone(
@@ -653,7 +653,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
tstyle,
),
"",
- Paragraph(money_filter(open_before, currency), tstyle_right),
+ PlainTextParagraph(money_filter(open_before, currency), tstyle_right),
]
)
else:
@@ -670,30 +670,30 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
] or Decimal("0.00")
tdata.append(
[
- FontFallbackParagraph(_("Orders"), tstyle),
- Paragraph("+", tstyle_center),
- Paragraph(money_filter(tx_during, currency), tstyle_right),
+ PlainTextParagraph(_("Orders"), tstyle),
+ PlainTextParagraph("+", tstyle_center),
+ PlainTextParagraph(money_filter(tx_during, currency), tstyle_right),
]
)
tdata.append(
[
- FontFallbackParagraph(_("Payments"), tstyle),
- Paragraph("-", tstyle_center),
- Paragraph(money_filter(p_during, currency), tstyle_right),
+ PlainTextParagraph(_("Payments"), tstyle),
+ PlainTextParagraph("-", tstyle_center),
+ PlainTextParagraph(money_filter(p_during, currency), tstyle_right),
]
)
tdata.append(
[
- FontFallbackParagraph(_("Refunds"), tstyle),
- Paragraph("+", tstyle_center),
- Paragraph(money_filter(r_during, currency), tstyle_right),
+ PlainTextParagraph(_("Refunds"), tstyle),
+ PlainTextParagraph("+", tstyle_center),
+ PlainTextParagraph(money_filter(r_during, currency), tstyle_right),
]
)
open_after = open_before + tx_during - p_during + r_during
tdata.append(
[
- Paragraph(
+ PlainTextParagraph(
_("Pending payments at {datetime}").format(
datetime=date_format(
((df_end or now()) - datetime.timedelta.resolution).astimezone(
@@ -704,8 +704,8 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
),
tstyle_bold,
),
- Paragraph("=", tstyle_center),
- Paragraph(money_filter(open_after, currency), tstyle_bold_right),
+ PlainTextParagraph("=", tstyle_center),
+ PlainTextParagraph(money_filter(open_after, currency), tstyle_bold_right),
]
)
tstyledata += [
@@ -752,7 +752,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
)
tdata.append(
[
- Paragraph(
+ PlainTextParagraph(
_("Total gift card value at {datetime}").format(
datetime=date_format(
(df_start - datetime.timedelta.resolution).astimezone(
@@ -763,7 +763,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
),
tstyle,
),
- Paragraph(money_filter(tx_before, currency), tstyle_right),
+ PlainTextParagraph(money_filter(tx_before, currency), tstyle_right),
]
)
else:
@@ -774,8 +774,8 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
] or Decimal("0.00")
tdata.append(
[
- FontFallbackParagraph(_("Gift card transactions (credit)"), tstyle),
- Paragraph(money_filter(tx_during_pos, currency), tstyle_right),
+ PlainTextParagraph(_("Gift card transactions (credit)"), tstyle),
+ PlainTextParagraph(money_filter(tx_during_pos, currency), tstyle_right),
]
)
@@ -784,15 +784,15 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
] or Decimal("0.00")
tdata.append(
[
- FontFallbackParagraph(_("Gift card transactions (debit)"), tstyle),
- Paragraph(money_filter(tx_during_neg, currency), tstyle_right),
+ PlainTextParagraph(_("Gift card transactions (debit)"), tstyle),
+ PlainTextParagraph(money_filter(tx_during_neg, currency), tstyle_right),
]
)
open_after = tx_before + tx_during_pos + tx_during_neg
tdata.append(
[
- Paragraph(
+ PlainTextParagraph(
_("Total gift card value at {datetime}").format(
datetime=date_format(
((df_end or now()) - datetime.timedelta.resolution).astimezone(
@@ -803,7 +803,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
),
tstyle_bold,
),
- Paragraph(money_filter(open_after, currency), tstyle_bold_right),
+ PlainTextParagraph(money_filter(open_after, currency), tstyle_bold_right),
]
)
tstyledata += [
@@ -854,10 +854,10 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
style_small.leading = 10
story = [
- FontFallbackParagraph(self.verbose_name, style_h1),
+ PlainTextParagraph(self.verbose_name, style_h1),
Spacer(0, 3 * mm),
- FontFallbackParagraph(
- " ".join(escape(f) for f in self.describe_filters(form_data)),
+ PlainTextParagraph(
+ "\n".join(escape(f) for f in self.describe_filters(form_data)),
style_small,
),
]
@@ -870,7 +870,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
if s:
story += [
Spacer(0, 3 * mm),
- FontFallbackParagraph(_("Orders") + c_head, style_h2),
+ PlainTextParagraph(_("Orders") + c_head, style_h2),
Spacer(0, 3 * mm),
*s
]
@@ -881,7 +881,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
if s:
story += [
Spacer(0, 8 * mm),
- FontFallbackParagraph(_("Payments") + c_head, style_h2),
+ PlainTextParagraph(_("Payments") + c_head, style_h2),
Spacer(0, 3 * mm),
*s
]
@@ -894,7 +894,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
Spacer(0, 8 * mm),
KeepTogether(
[
- FontFallbackParagraph(_("Open items") + c_head, style_h2),
+ PlainTextParagraph(_("Open items") + c_head, style_h2),
Spacer(0, 3 * mm),
*s
]
@@ -912,7 +912,7 @@ class ReportExporter(ReportlabExportMixin, BaseExporter):
Spacer(0, 8 * mm),
KeepTogether(
[
- FontFallbackParagraph(_("Gift cards") + c_head, style_h2),
+ PlainTextParagraph(_("Gift cards") + c_head, style_h2),
Spacer(0, 3 * mm),
*s,
]
diff --git a/src/pretix/plugins/reports/exporters.py b/src/pretix/plugins/reports/exporters.py
index 6957ab396..98241865e 100644
--- a/src/pretix/plugins/reports/exporters.py
+++ b/src/pretix/plugins/reports/exporters.py
@@ -70,7 +70,7 @@ from pretix.base.timeframes import (
)
from pretix.control.forms.filter import OverviewFilterForm
from pretix.helpers.reportlab import (
- FontFallbackParagraph, register_ttf_font_if_new,
+ PlainTextParagraph, register_ttf_font_if_new,
)
from pretix.presale.style import get_fonts
@@ -282,7 +282,7 @@ class OverviewReport(Report):
headlinestyle.fontSize = 15
headlinestyle.fontName = 'OpenSansBd'
story = [
- FontFallbackParagraph(_('Orders by product') + ' ' + (_('(excl. taxes)') if net else _('(incl. taxes)')), headlinestyle),
+ PlainTextParagraph(_('Orders by product') + ' ' + (_('(excl. taxes)') if net else _('(incl. taxes)')), headlinestyle),
Spacer(1, 5 * mm)
]
return story
@@ -292,7 +292,7 @@ class OverviewReport(Report):
if form_data.get('date_axis') and form_data.get('date_range'):
d_start, d_end = resolve_timeframe_to_dates_inclusive(now(), form_data['date_range'], self.timezone)
story += [
- FontFallbackParagraph(_('{axis} between {start} and {end}').format(
+ PlainTextParagraph(_('{axis} between {start} and {end}').format(
axis=dict(OverviewFilterForm(event=self.event).fields['date_axis'].choices)[form_data.get('date_axis')],
start=date_format(d_start, 'SHORT_DATE_FORMAT') if d_start else '–',
end=date_format(d_end, 'SHORT_DATE_FORMAT') if d_end else '–',
@@ -305,13 +305,13 @@ class OverviewReport(Report):
subevent = self.event.subevents.get(pk=self.form_data.get('subevent'))
except SubEvent.DoesNotExist:
subevent = self.form_data.get('subevent')
- story.append(FontFallbackParagraph(pgettext('subevent', 'Date: {}').format(subevent), self.get_style()))
+ story.append(PlainTextParagraph(pgettext('subevent', 'Date: {}').format(subevent), self.get_style()))
story.append(Spacer(1, 5 * mm))
if form_data.get('subevent_date_range'):
d_start, d_end = resolve_timeframe_to_datetime_start_inclusive_end_exclusive(now(), form_data['subevent_date_range'], self.timezone)
story += [
- FontFallbackParagraph(_('{axis} between {start} and {end}').format(
+ PlainTextParagraph(_('{axis} between {start} and {end}').format(
axis=_('Event date'),
start=date_format(d_start, 'SHORT_DATE_FORMAT') if d_start else '–',
end=date_format(d_end - timedelta(hours=1), 'SHORT_DATE_FORMAT') if d_end else '–',
@@ -384,13 +384,13 @@ class OverviewReport(Report):
tdata = [
[
_('Product'),
- FontFallbackParagraph(_('Canceled'), tstyle_th),
+ PlainTextParagraph(_('Canceled'), tstyle_th),
'',
- FontFallbackParagraph(_('Expired'), tstyle_th),
+ PlainTextParagraph(_('Expired'), tstyle_th),
'',
- FontFallbackParagraph(_('Approval pending'), tstyle_th),
+ PlainTextParagraph(_('Approval pending'), tstyle_th),
'',
- FontFallbackParagraph(_('Purchased'), tstyle_th),
+ PlainTextParagraph(_('Purchased'), tstyle_th),
'', '', '', '', ''
],
[
@@ -421,14 +421,14 @@ class OverviewReport(Report):
for tup in items_by_category:
if tup[0]:
tdata.append([
- FontFallbackParagraph(str(tup[0]), tstyle_bold)
+ PlainTextParagraph(str(tup[0]), tstyle_bold)
])
for l, s in states:
tdata[-1].append(str(tup[0].num[l][0]))
tdata[-1].append(floatformat(tup[0].num[l][2 if net else 1], places))
for item in tup[1]:
tdata.append([
- FontFallbackParagraph(str(item), tstyle)
+ PlainTextParagraph(str(item), tstyle)
])
for l, s in states:
tdata[-1].append(str(item.num[l][0]))
@@ -436,7 +436,7 @@ class OverviewReport(Report):
if item.has_variations:
for var in item.all_variations:
tdata.append([
- FontFallbackParagraph(" " + str(var), tstyle)
+ PlainTextParagraph(" " + str(var), tstyle)
])
for l, s in states:
tdata[-1].append(str(var.num[l][0]))
@@ -568,7 +568,7 @@ class OrderTaxListReportPDF(Report):
tstyledata.append(('SPAN', (5 + 2 * i, 0), (6 + 2 * i, 0)))
story = [
- FontFallbackParagraph(_('Orders by tax rate ({currency})').format(currency=self.event.currency), headlinestyle),
+ PlainTextParagraph(_('Orders by tax rate ({currency})').format(currency=self.event.currency), headlinestyle),
Spacer(1, 5 * mm)
]
tdata = [
diff --git a/src/pretix/presale/checkoutflow.py b/src/pretix/presale/checkoutflow.py
index 76c488624..e6ea9d372 100644
--- a/src/pretix/presale/checkoutflow.py
+++ b/src/pretix/presale/checkoutflow.py
@@ -51,6 +51,7 @@ from django.http import HttpResponseNotAllowed, JsonResponse
from django.shortcuts import redirect
from django.utils import translation
from django.utils.functional import cached_property
+from django.utils.html import conditional_escape
from django.utils.translation import (
get_language, gettext_lazy as _, pgettext_lazy,
)
@@ -1634,7 +1635,7 @@ class ConfirmStep(CartMixin, AsyncAction, TemplateFlowStep):
meta_info = {
'contact_form_data': self.cart_session.get('contact_form_data', {}),
'confirm_messages': [
- str(m) for m in self.confirm_messages.values()
+ conditional_escape(str(m)) for m in self.confirm_messages.values()
]
}
api_meta = {}
diff --git a/src/pretix/presale/signals.py b/src/pretix/presale/signals.py
index 38ae0dca0..1111f00b2 100644
--- a/src/pretix/presale/signals.py
+++ b/src/pretix/presale/signals.py
@@ -144,7 +144,7 @@ checkout_confirm_messages = EventPluginSignal()
This signal is sent out to retrieve short messages that need to be acknowledged by the user before the
order can be completed. This is typically used for something like "accept the terms and conditions".
Receivers are expected to return a dictionary where the keys are globally unique identifiers for the
-message and the values can be arbitrary HTML.
+message and the values can be a SafeString containing arbitrary HTML, or a string that will be HTML-escaped.
As with all event plugin signals, the ``sender`` keyword argument will contain the event.
"""
diff --git a/src/pretix/presale/templates/pretixpresale/event/checkout_confirm.html b/src/pretix/presale/templates/pretixpresale/event/checkout_confirm.html
index 40db91acc..ad47ad429 100644
--- a/src/pretix/presale/templates/pretixpresale/event/checkout_confirm.html
+++ b/src/pretix/presale/templates/pretixpresale/event/checkout_confirm.html
@@ -176,7 +176,7 @@
- {{ desc|safe }}
+ {{ desc }}
{% endfor %}
diff --git a/src/pretix/presale/templates/pretixpresale/event/position.html b/src/pretix/presale/templates/pretixpresale/event/position.html
index a8b735f10..2a89b69ee 100644
--- a/src/pretix/presale/templates/pretixpresale/event/position.html
+++ b/src/pretix/presale/templates/pretixpresale/event/position.html
@@ -4,6 +4,7 @@
{% load eventsignal %}
{% load money %}
{% load eventurl %}
+{% load wrap_in %}
{% block title %}{% trans "Registration details" %}{% endblock %}
{% block content %}
@@ -48,7 +49,7 @@
- {% blocktrans trimmed with email=""|add:order.email|add:" "|safe %}
+ {% blocktrans trimmed with email=order.email|wrap_in:"strong" %}
This order is managed for you by {{ email }}. Please contact them for any questions regarding
payment, cancellation or changes to this order.
{% endblocktrans %}
diff --git a/src/tests/helpers/test_reportlab.py b/src/tests/helpers/test_reportlab.py
new file mode 100644
index 000000000..354e2cbd1
--- /dev/null
+++ b/src/tests/helpers/test_reportlab.py
@@ -0,0 +1,50 @@
+#
+# This file is part of pretix (Community Edition).
+#
+# Copyright (C) 2014-2020 Raphael Michel and contributors
+# Copyright (C) 2020-today pretix GmbH and contributors
+#
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
+# Public License as published by the Free Software Foundation in version 3 of the License.
+#
+# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
+# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
+# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
+# this file, see .
+#
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along with this program. If not, see
+# .
+#
+import pytest
+from django.core.exceptions import SuspiciousFileOperation
+from reportlab.platypus import Paragraph
+
+
+def test_http_access_disabled(monkeypatch):
+ def guard(*args, **kwargs):
+ pytest.fail("No internet wanted!")
+
+ monkeypatch.setattr('socket.socket', guard)
+
+ with pytest.raises(SuspiciousFileOperation, match="should not be reading images from disk"):
+ Paragraph(
+ ' ',
+ )
+
+
+def test_file_access_disabled_scheme(monkeypatch):
+ with pytest.raises(SuspiciousFileOperation, match="should not be reading images from disk"):
+ Paragraph(
+ ' ',
+ )
+
+
+def test_file_access_disabled_direct(monkeypatch):
+ with pytest.raises(SuspiciousFileOperation, match="should not be reading images from disk"):
+ Paragraph(
+ ' ',
+ )