CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

upstream/2026.7.0 #21

Merged
simon merged 194 commits from upstream/2026.7.0 into master 2026-08-01 15:33:26 +00:00
Conversation 0 Commits 194 Files Changed 331
+567539 -584908
194 Commits
Author SHA1 Message Date
TechuserUpdatechecker 45173e6b3a Merge branch 'master' into upstream/2026.7.0
Build Deploy email notification tool / Apply-Kubernetes-Resources (push) Successful in 2m54s
Details 
# Conflicts:
#	src/pretix/locale/de/LC_MESSAGES/django.po
 2026-08-01 17:25:41 +02:00
Raphael Michel 79dcf60ed2 Bump version to 2026.7.0 2026-07-30 20:39:13 +02:00
Raphael MichelandRaphael Michel 8775ca09b4 Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6387 of 6387 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-07-30 20:38:23 +02:00
Raphael MichelandRaphael Michel c34cdf5ec6 Translations: Update German 
Currently translated at 100.0% (6387 of 6387 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-07-30 20:38:23 +02:00
Raphael Michel 8a000f9892 Translations: Update wordlists 2026-07-30 20:36:15 +02:00
Raphael Michel 07bf0b3118 Update po files 
[CI skip]

Signed-off-by: Raphael Michel <michel@pretix.eu>
 2026-07-30 15:52:37 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		abe938795c Bump postcss from 8.5.15 to 8.5.23 (#6429) 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.15 to 8.5.23.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.15...8.5.23)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-30 15:52:04 +02:00
AlbizuriandRaphael Michel f1cb5a9010 Translations: Update Basque 
Currently translated at 43.4% (113 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/eu/

powered by weblate
 2026-07-30 15:51:59 +02:00
AlbizuriandRaphael Michel 6e6ca0a7bc Translations: Update Basque 
Currently translated at 48.4% (3081 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/eu/

powered by weblate
 2026-07-30 15:51:59 +02:00
Raphael MichelandRaphael Michel 8800b15a33 Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6362 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-07-30 15:51:59 +02:00
Raphael MichelandGitHub 85de097497 API: Disable endpoints that should have never existed (#6431) 2026-07-29 13:04:45 +02:00
Raphael Michel 16040f70bb [SECURITY] Add missing permission check for view (CVE-2026-57532) 2026-07-28 12:24:59 +02:00
Raphael MichelandGitHub 9b5ed06b2e Improve handling of reauth during async tasks (Z#23238978) (#6381) 2026-07-28 10:59:42 +02:00
Raphael MichelandGitHub f3ffce4e5b Question form: Allow to unset required boolean questions (Z#23239887) (#6382) 
Proper fix for #6366
 2026-07-28 10:59:34 +02:00
AlbizuriandRaphael Michel 5c98dc16b7 Translations: Update Basque 
Currently translated at 48.3% (3077 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/eu/

powered by weblate
 2026-07-28 10:11:51 +02:00
NikolaiandRaphael Michel d814b40fcd Translations: Update Danish 
Currently translated at 61.8% (3932 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/da/

powered by weblate
 2026-07-28 10:11:51 +02:00
LilaHexeGitHubRaphael Michel
 		a696c493e2 PayPal: Drop maximum length of client ID (#6424) 
* Update PayPal max_length to 82 characters

* Apply suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

---------

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
 2026-07-28 09:13:45 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		e88b539375 Update tlds requirement from >=2026041800 to >=2026072401 (#6428) 
Updates the requirements on [tlds](https://github.com/kichik/tlds) to permit the latest version.
- [Commits](https://github.com/kichik/tlds/commits)

---
updated-dependencies:
- dependency-name: tlds
  dependency-version: '2026072401'
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 09:08:29 +02:00
Raphael MichelandGitHub 163cf85c86 Orders: Fix N+1 query issues on order detail and change page (#6390) 
* rders: Fix N+1 query issues on order detail and change page

There is one I couldn't fix: Loading the list of tax rules for every
select box on the OrderChange page. Unfortunately, Django has a
cache-breaking .all() in ModelChoiceField and that would need nasty
patching that didn't feel worth it

* Fix isort

* Fix N+1 query in gate call

* Fix leftovers

* Add local cache for objects referenced in log entries

* Update src/pretix/control/views/orders.py
 2026-07-28 09:08:14 +02:00
pajowuandGitHub 55b6887c5e Show new login time in users timezone (Z#23241469) (#6420) 2026-07-28 09:08:00 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		2592d3cb8d Update django-phonenumber-field requirement from ==8.4.* to ==8.5.* (#6415) 
Updates the requirements on [django-phonenumber-field](https://github.com/django-phonenumber-field/django-phonenumber-field) to permit the latest version.
- [Release notes](https://github.com/django-phonenumber-field/django-phonenumber-field/releases)
- [Changelog](https://github.com/django-phonenumber-field/django-phonenumber-field/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/django-phonenumber-field/django-phonenumber-field/compare/8.4.0...8.5.0)

---
updated-dependencies:
- dependency-name: django-phonenumber-field
  dependency-version: 8.5.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 09:07:55 +02:00
Raphael MichelandGitHub 47b632eabe RejectInvalidInputMiddleware: Ignore invalid charsets on body (#6314) 2026-07-28 09:07:16 +02:00
Raphael MichelandGitHub 7f2e957092 Security profiles: Ensure default profile is always listed first (#6266) 2026-07-28 09:06:59 +02:00
Raphael MichelandGitHub 1ff9742a08 Customer export: Add memberships tab (Z#23228422) (#6253) 2026-07-28 09:06:45 +02:00
Raphael MichelandGitHub d9f8679647 Waiting list: Redirect back after voucher edit (Z#23230178) (#6252) 2026-07-27 23:19:10 +02:00
Raphael MichelGitHubpajowu
 		1a7e36a144 Event-dashboard: Lazy-load warnings (#6421) 
* Event-dashboard: Lazy-load warnings

I don't like this, it's not pretty, but we have no quick way of fixing
the overpaid orders check otherwise and a slow query on the event
dashboard feels really bad, because even if you don't wanna see the
dashboard ou are always going through it in navigation and that can get
very annoying very quickly.

* Update src/pretix/control/templates/pretixcontrol/event/dashboard_partial_warnings.html

Co-authored-by: pajowu <engelhardt@pretix.eu>

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
 2026-07-27 14:40:34 +02:00
Raphael Michelpajowupajowu
 		9afc71c245 Update src/pretix/control/views/checkin.py 
Co-authored-by: pajowu <engelhardt@pretix.eu>
 2026-07-27 13:54:06 +02:00
Raphael Michelandpajowu 1087db9529 Check-in history: Avoid JOINs 
On a test dataset, this was a speedup from 18s to 900ms
 2026-07-27 13:54:06 +02:00
Kara Engelhardtandpajowu 6d62284d87 Add global id field to order 2026-07-27 13:22:42 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel db147280fd Translations: Update Hungarian 
Currently translated at 100.0% (6362 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/hu/

powered by weblate
 2026-07-24 13:45:01 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel d1ce4566a7 Translations: Update Hungarian 
Currently translated at 63.8% (4060 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/hu/

powered by weblate
 2026-07-24 13:45:01 +02:00
dependabot[bot]andRaphael Michel c3cfd4ea91 Update fakeredis requirement from ==2.36.* to ==2.37.* 
Updates the requirements on [fakeredis](https://github.com/cunla/fakeredis-py) to permit the latest version.
- [Release notes](https://github.com/cunla/fakeredis-py/releases)
- [Commits](https://github.com/cunla/fakeredis-py/compare/v2.36.0...v2.37.0)

---
updated-dependencies:
- dependency-name: fakeredis
  dependency-version: 2.37.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-24 13:43:01 +02:00
Raphael MichelandGitHub 92e7069a8e Improve performance of overpayment checks (Z#23241035) (#6410) 
* Improve performance of overpayment checks

* Upgrade django-scopes
 2026-07-24 13:42:33 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		f471091d77 Bump immutable from 5.1.5 to 5.1.9 (#6417) 
Bumps [immutable](https://github.com/immutable-js/immutable-js) from 5.1.5 to 5.1.9.
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/immutable-js/immutable-js/compare/v5.1.5...v5.1.9)

---
updated-dependencies:
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-24 12:18:20 +02:00
Raphael MichelandGitHub 351d2055f8 Log view: Disable counting the number of pages (Z#23241035) (#6414) 2026-07-24 12:17:48 +02:00
Raphael MichelGitHubluelista
 		ca03a2556d Log view: New filter form (#6412) 
* Rework filter form for event log view

* Log view: New filter form

* isort

* Update src/pretix/control/forms/filter.py

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
 2026-07-23 17:35:18 +02:00
Richard SchreiberandGitHub 2381af4267 Widget: re-create vue2-behaviour to replace container instead of setting innerHTML (#6405) 
* Widget: replace container instead of setting innerHTML

* remove console.log call

* fix code-style
 2026-07-23 11:36:06 +02:00
Raphael Michel 9fd570a53d Add cautionary comment about vobject bug 2026-07-22 14:49:53 +02:00
Kara Engelhardtandpajowu 072c17c91a Banktransfer: Notify incomplete payments after manual assignment (Z#23241009) 2026-07-22 14:15:14 +02:00
Raphael MichelandGitHub 003bfb707d Fix scoping for OrderPosition.objects (follow-up to #4278) (#6407) 2026-07-22 14:10:34 +02:00
Raphael MichelandRaphael Michel faf8a6b1d2 Translations: Update Arabic 
Currently translated at 99.7% (6348 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ar/

powered by weblate
 2026-07-22 14:09:38 +02:00
Kara Engelhardtandpajowu a4d10d9550 Sendmail: clarify order status labels (Z#23230149) 2026-07-22 13:43:07 +02:00
Richard Schreiberandpajowu baf3cf04ec fix import and missing license-header 2026-07-21 18:39:07 +02:00
Kara Engelhardtandpajowu fa2009ed03 Add central helper for ssrf address protection 2026-07-21 18:39:07 +02:00
luelistaandGitHub cc082e2001 Improve CSP handling in vite integration; refactor CSP handling into helper functions (Z#23240534) (#6387) 2026-07-21 13:20:31 +02:00
Raphael Michel 930e153db4 Security profiles: Add missing annul checkpoint 2026-07-21 12:30:37 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		560a369e65 Update django-countries requirement from ==8.2.* to ==9.0.* (#6316) 
Updates the requirements on [django-countries](https://github.com/SmileyChris/django-countries) to permit the latest version.
- [Changelog](https://github.com/SmileyChris/django-countries/blob/main/CHANGES.md)
- [Commits](https://github.com/SmileyChris/django-countries/compare/v8.2.0...v9.0.0)

---
updated-dependencies:
- dependency-name: django-countries
  dependency-version: 9.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 08:53:00 +02:00
Raphael MichelandGitHub d47c435489 LocaleMiddleware: Always render error pages in cookie or browser language (#6277) 2026-07-20 15:18:14 +02:00
Raphael MichelandGitHub 32e0e31b15 Redirection plugin: Improve validation to avoid ReDoS (#6395) 
* Redirection plugin: Improve validation to avoid ReDoS

* Stricter regex
 2026-07-20 13:39:15 +02:00
Raphael MichelandGitHub ea819530f9 Escape HTML arguments to translation strings (#6399) 2026-07-20 13:15:09 +02:00
Raphael MichelandGitHub 09aef94376 Vouchers: Fix race condition that allows budget to be exceeded (#6396) 2026-07-20 13:14:49 +02:00
Kara Engelhardtandpajowu 39fbd25fbb Ignore expiry date for payments created via api (Z#23232671) 2026-07-20 12:46:50 +02:00
Kara Engelhardtandpajowu 214ea5fcd3 Show end time in subevent list (Z#23237612) 2026-07-20 12:00:22 +02:00
Raphael Michel 2de032c2be Fix test failure on PostgreSQL 2026-07-17 19:22:50 +02:00
Raphael Michel 2574b31afd Fix unused import 2026-07-17 18:44:33 +02:00
Raphael MichelGitHubluelistaluelista
 		5f2264daeb User email verifications: Add rate limiting (Z#23232834) (#6219) 
* User email verifications: Add rate limiting (Z#23232834)

Also, refactor rate limiting into a central utility

* Make ip block work in dev

* Review notes

* Update src/pretix/base/forms/user.py

Co-authored-by: luelista <weller@rami.io>

* Apply suggestions from code review

Co-authored-by: luelista <mira@teamwiki.de>

* Add rate limit reset

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: luelista <mira@teamwiki.de>
 2026-07-17 18:35:03 +02:00
Raphael Michel 4295b02406 Fix tests after hierarkey update 2026-07-17 18:33:20 +02:00
Raphael MichelandGitHub 49247062bc Drop second component from many time picker fields (#6150) 2026-07-17 17:42:51 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		f3db461a2a Update sentry-sdk requirement from ==2.65.* to ==2.66.* (#6391) 
Updates the requirements on [sentry-sdk](https://github.com/getsentry/sentry-python) to permit the latest version.
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-python/compare/2.65.0...2.66.0)

---
updated-dependencies:
- dependency-name: sentry-sdk
  dependency-version: 2.66.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-17 17:03:30 +02:00
luelistaandGitHub 83e607b88d Fix double escaping in dashboard widgets (Z#23240769) (#6394) 2026-07-17 17:03:09 +02:00
Raphael Michel 9609722a98 Bump hierarkey to 2.0.2 2026-07-17 15:38:00 +02:00
Raphael MichelandGitHub 4372aa6725 Devices: Allow admins to inspect raw info data (#6389) 2026-07-16 19:22:31 +02:00
luelistaandGitHub 71488f0a02 Fix migration conflict (#6388) 2026-07-16 17:07:25 +02:00
luelistaGitHubRaphael Michel
 		52a4381277 Enforce uniqueness of EventMetaProperty names in DB (Z#23231419) (#6106) 
After enforcing this on application level in commit 4c37351, we can now also add
a unique constraint on DB level and a migration to fix any left over non-unique entries.

---------

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
 2026-07-16 15:44:58 +02:00
luelistaandGitHub bf066909a7 Remove more usages of |safe (#6363) 
* Replace |safe with |escapejson where appropriate
* Use JSON encoding for data-replace-with-qr
 2026-07-16 13:14:37 +02:00
luelistaandGitHub 1399d37827 UX improvement for enabling payment provider plugins (#6364) 
Make flow of enabling new payment plugin smoother by redirecting back to
payment settings, and highlighting the newly enabled provider.
 2026-07-16 12:59:29 +02:00
luelistaandGitHub 0c0842c9db Remove dead code in orderchange.js (#6384) 2026-07-16 12:58:09 +02:00
luelistaandGitHub 6e647b41e4 Use format_html in dashboard widgets (#6369) 
This changes the API of pretix.control.signals.event_dashboard_widgets and 
pretix.control.signals.user_dashboard_widgets, such that the "content" key of
returned dictionaries must contain a SafeString if HTML therein is to be 
rendered.
 2026-07-16 12:56:39 +02:00
luelistaGitHubKara Engelhardt
 		7cff4321e0 Order change: Fix crash if addon has hidden_if_item_available (Z#23236380) (#6357) 
* Fix crash in rebooking if addon has hidden_if_item_available
* Move get_grouped_items into its own file and rename to prepare_item_list_for_shop
  (but keep a reference under original name for plugin compatibility)
* Make Item[Variation].unavailability_reason helper functions next to get_grouped_items
* Use current_unavailability_reason attribute instead of unavailability_reason()
* Add test case for:
  Order has product with addon 1; Addon 1 is hidden if Addon 2 is available; When order is changed, Addon 1 should not be removable
* Fix special case if addon product is now set to require a voucher (vouchers for addons are not supported)

---------

Co-authored-by: Kara Engelhardt <engelhardt@pretix.eu>
 2026-07-16 12:52:08 +02:00
luelistaandGitHub fe5d095ae7 Prevent changing ticket secret of gift-card-issuing order positions (#6281) 2026-07-16 12:41:27 +02:00
luelistaandGitHub ebc31c901a Fix sorting in voucher list (Z#23240539) (#6383) 2026-07-16 12:11:30 +02:00
Raphael Michel 2660dfe1bc CSP: Hotfix connect-src to allow static file access for PDF editor 2026-07-16 10:23:44 +02:00
Raphael MichelandGitHub 08c376a459 API: Add raw_source_type to failed checkins update (#6272) 2026-07-15 18:06:58 +02:00
Gerasimos ChourdakisandGitHub 6901ed8b26 Event settings: Improve wording of help message for is_remote (#6386) 2026-07-15 17:46:15 +02:00
Llewelyn BarkhuizenandRaphael Michel 62f1cbadaf Translations: Update Afrikaans 
Currently translated at 0.1% (3 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/af/

powered by weblate
 2026-07-15 17:44:34 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel 1386b40e6f Translations: Update Hungarian 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/hu/

powered by weblate
 2026-07-15 17:44:34 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel bbcd1b86b7 Translations: Update Hungarian 
Currently translated at 17.8% (1138 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/hu/

powered by weblate
 2026-07-15 17:44:34 +02:00
Jochen SiebertandRaphael Michel 6894070239 Translations: Update German 
Currently translated at 100.0% (6362 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-07-15 17:44:34 +02:00
Llewelyn BarkhuizenandRaphael Michel 7470a7198b Translations: Add Afrikaans 2026-07-15 17:44:34 +02:00
Llewelyn BarkhuizenandRaphael Michel ddda634ef3 Translations: Add Afrikaans 2026-07-15 17:44:34 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel 3f7064f12b Translations: Update Hungarian 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/hu/

powered by weblate
 2026-07-15 17:44:34 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel 6386c99175 Translations: Update Hungarian 
Currently translated at 17.0% (1084 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/hu/

powered by weblate
 2026-07-15 17:44:34 +02:00
Raphael MichelGitHubrobbi5
 		eb29101d09 Allow more decimal places for tax rates (#6092) 
* Allow more decimal places for tax rates

* Fix normalization

* More tax rate handling

* Add uncommitted tests

* Rebase migration

* Update src/pretix/base/migrations/0304_tax_rate_decimals.py

Co-authored-by: robbi5 <richt@rami.io>

---------

Co-authored-by: robbi5 <richt@rami.io>
 2026-07-15 16:20:45 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel d007fb9566 Translations: Update Hungarian 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/hu/

powered by weblate
 2026-07-15 11:39:34 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel 93cbbea193 Translations: Update Hungarian 
Currently translated at 16.7% (1064 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/hu/

powered by weblate
 2026-07-15 11:39:34 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel eacce6d1f8 Translations: Update Hungarian 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/hu/

powered by weblate
 2026-07-15 11:39:34 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel cdd7412fbb Translations: Update Hungarian 
Currently translated at 13.2% (844 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/hu/

powered by weblate
 2026-07-15 11:39:34 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel a6d462c14e Translations: Update Hungarian 
Currently translated at 11.2% (717 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/hu/

powered by weblate
 2026-07-15 11:39:34 +02:00
Hijiri UmemotoandRaphael Michel d5d928cdce Translations: Update Japanese 
Currently translated at 100.0% (6362 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ja/

powered by weblate
 2026-07-15 11:39:34 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel e0a8b81290 Translations: Update Hungarian 
Currently translated at 11.1% (711 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/hu/

powered by weblate
 2026-07-15 11:39:34 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel 6b0419e488 Translations: Update Hungarian 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/hu/

powered by weblate
 2026-07-15 11:39:34 +02:00
szurofkamarciidfbe08444ef04788andRaphael Michel 48104e0c9f Translations: Update Hungarian 
Currently translated at 10.8% (690 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/hu/

powered by weblate
 2026-07-15 11:39:34 +02:00
ahmed badrandRaphael Michel 7eefb18b67 Translations: Update Arabic 
Currently translated at 99.7% (6348 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ar/

powered by weblate
 2026-07-15 11:39:34 +02:00
ahmed badrandRaphael Michel f9022e5a5e Translations: Update Arabic 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/ar/

powered by weblate
 2026-07-15 11:39:34 +02:00
ahmed shabbatandRaphael Michel 08c5963d7b Translations: Update Arabic 
Currently translated at 99.7% (6348 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ar/

powered by weblate
 2026-07-15 11:39:34 +02:00
ahmed badrandRaphael Michel e8274527cb Translations: Update Arabic 
Currently translated at 99.7% (6348 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ar/

powered by weblate
 2026-07-15 11:39:34 +02:00
Raphael MichelandRaphael Michel f77aad0eeb Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/de_Informal/

powered by weblate
 2026-07-15 11:39:34 +02:00
ahmed badrandRaphael Michel d5b0059c34 Translations: Update Arabic 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/ar/

powered by weblate
 2026-07-15 11:39:34 +02:00
ahmed badrandRaphael Michel 47a170ab62 Translations: Update Arabic 
Currently translated at 78.6% (5005 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ar/

powered by weblate
 2026-07-15 11:39:34 +02:00
ahmed shabbatandRaphael Michel 93aebffe2c Translations: Update Arabic 
Currently translated at 65.8% (4191 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ar/

powered by weblate
 2026-07-15 11:39:34 +02:00
ahmed badrandRaphael Michel 7795c711be Translations: Update Arabic 
Currently translated at 65.8% (4191 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ar/

powered by weblate
 2026-07-15 11:39:34 +02:00
ahmed badrandRaphael Michel 1eb685d4ee Translations: Update Arabic 
Currently translated at 59.8% (3808 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ar/

powered by weblate
 2026-07-15 11:39:34 +02:00
CVZ-esandRaphael Michel b8c523cfac Translations: Update Spanish 
Currently translated at 100.0% (6362 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/es/

powered by weblate
 2026-07-15 11:39:34 +02:00
Joram SchwartzmannandRaphael Michel fae9fff98e Translations: Update French 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/fr/

powered by weblate
 2026-07-15 11:39:34 +02:00
CVZ-esandRaphael Michel 92cfbd54b9 Translations: Update French 
Currently translated at 100.0% (6362 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/fr/

powered by weblate
 2026-07-15 11:39:34 +02:00
Joram SchwartzmannandRaphael Michel 18203e0804 Translations: Update French 
Currently translated at 100.0% (6362 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/fr/

powered by weblate
 2026-07-15 11:39:34 +02:00
Raphael MichelandGitHub 52ed8eeb50 Mail setup: Add DKIM + DMARC validation (#6339) 
* Mail setup: Add DKIM + DMARC validation

* Tests

* Test fixes
 2026-07-15 11:36:35 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		1e4888bad0 Bump django-filter from 25.1 to 26.1 (#6377) 
Bumps [django-filter](https://github.com/carltongibson/django-filter) from 25.1 to 26.1.
- [Release notes](https://github.com/carltongibson/django-filter/releases)
- [Changelog](https://github.com/carltongibson/django-filter/blob/main/CHANGES.rst)
- [Commits](https://github.com/carltongibson/django-filter/compare/25.1...26.1)

---
updated-dependencies:
- dependency-name: django-filter
  dependency-version: '26.1'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-15 09:41:35 +02:00
dependabot[bot]andRaphael Michel c3056a8aae Update sentry-sdk requirement from ==2.64.* to ==2.65.* 
Updates the requirements on [sentry-sdk](https://github.com/getsentry/sentry-python) to permit the latest version.
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-python/compare/2.64.0...2.65.0)

---
updated-dependencies:
- dependency-name: sentry-sdk
  dependency-version: 2.65.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-15 09:41:18 +02:00
Raphael MichelandGitHub 4a4cff3c41 Drop all csp_ignore statements from core (except stripe, for now) (#6337) 
* Add proper CSP policy for HTML email preview

* Handle safe types centrally

* Precompile schema validation function to get rid of ajv2020

* Fix tests

* adjust more tests
 2026-07-15 09:39:42 +02:00
Raphael MichelandGitHub ffca102a8a Question form: Do not store invalid False values for required boolean questions (Z#23239887) (#6366) 2026-07-10 16:42:10 +02:00
luelistaandGitHub 78f8830f90 Hotfix: fix order_position_buttons receiver 2026-07-10 15:08:10 +02:00
Raphael Michel eb594266a7 Hotfix: Add missing mark_safe after strip 2026-07-10 14:56:48 +02:00
pajowupajowuRaphael Michel
 		76e6803eac Fix customer views using wrong csrf middleware (#6027) 
* Fix customer views using wrong csrf middleware

This lead to persistent csrf validation errors if the token from the cookie expired, which could only be solved by clearing cookies.

* Remove unneccesary csrf_protect decorators

* Fix typo

Co-authored-by: Raphael Michel <michel@pretix.eu>

---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
 2026-07-10 13:25:40 +02:00
Richard Schreiberandpajowu e19908571c Fix delete_cookie for partitioned legacy CSRF cookie 2026-07-10 13:25:40 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		779ab360df Bump django-formtools from 2.6.1 to 2.7 (#6371) 
Bumps [django-formtools](https://github.com/jazzband/django-formtools) from 2.6.1 to 2.7.
- [Changelog](https://github.com/jazzband/django-formtools/blob/master/docs/changelog.rst)
- [Commits](https://github.com/jazzband/django-formtools/compare/2.6.1...2.7)

---
updated-dependencies:
- dependency-name: django-formtools
  dependency-version: '2.7'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-10 12:17:12 +02:00
Raphael MichelandGitHub 723c63008d Team invite: Improve error message (Z#23239860) (#6368) 2026-07-10 12:13:44 +02:00
Raphael MichelGitHubpajowu
 		15c194c0a3 Add base class for historical payment providers (#6336) 
* Add base class for historical payment providers

* Update src/pretix/base/payment.py

Co-authored-by: pajowu <engelhardt@pretix.eu>

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
 2026-07-10 11:10:32 +02:00
pajowuandGitHub 7f847c3dd2 Fix TypeError if task.request.headers is None (#6367) 2026-07-09 18:52:49 +02:00
luelistaandGitHub 430c6dd269 Use SafeStrings for plugin signals returning HTML that should be rendered (#6343) 
As a security precaution, we change the contract of some signals such that a 
SafeString needs to be returned if HTML should be rendered without further 
escaping.

Before, the `{% signal ... %}` and `{% eventsignal ... %}` template tags 
called mark_safe themselves on all strings returned from signals. That could
lead to unsafe coding practices, where untrusted values are interpolated into
HTML format strings. However, such interpolations should usually be performed 
using helpers such Django's format_html, which automatically escapes inputs
and returns a SafeString.
Now, we call conditional_escape on signal results, so that any HTML not explicitly
marked as safe gets escaped.

Most plugins are not affected by this change as they return a SafeString as a 
result of Template.render already.
 2026-07-09 17:50:26 +02:00
Raphael Michel 6411648457 Revert "Update redis requirement from ==7.4.* to ==8.0.* (#6226)" 
This reverts commit 005b3864b1.
 2026-07-09 00:45:32 +02:00
dependabot[bot]GitHubluelistadependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Raphael MichelRaphael Michel
 		005b3864b1 Update redis requirement from ==7.4.* to ==8.0.* (#6226) 
* Update redis requirement from ==7.4.* to ==8.0.*

Updates the requirements on [redis](https://github.com/redis/redis-py) to permit the latest version.
- [Release notes](https://github.com/redis/redis-py/releases)
- [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES)
- [Commits](https://github.com/redis/redis-py/compare/v7.4.0...v8.0.0)

---
updated-dependencies:
- dependency-name: redis
  dependency-version: 8.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Remove setex calls

* Update src/pretix/presale/views/user.py

Co-authored-by: luelista <weller@rami.io>

* Fix tests

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Raphael Michel <michel@rami.io>
Co-authored-by: luelista <weller@rami.io>
 2026-07-08 12:07:54 +02:00
Raphael MichelandGitHub 1ee1c604cf Tax rules: Correctly write log when changing custom rules (#6358) 2026-07-08 11:33:06 +02:00
luelistaandGitHub e425105dbf Fix link from voucher tag to filtered voucher list (#6362) 2026-07-08 11:26:37 +02:00
Martin Gross 738b375042 DevDocs: Bump nodejs to 24 2026-07-08 10:53:14 +02:00
sweenuandGitHub d09572d999 Remove leftovers from contact url in quick setup (#6359) 2026-07-07 19:23:48 +02:00
Lukas BockstallerandGitHub 634754aacb repair sendmail rules so we don't send emails to all positions in order independent of checkin status (Z#23235255) (#6340) 
* add repro for Z#23235255

* add testcase for fallback to order.email

* only send to orderpositions included in op_qs

* codestyle
 2026-07-07 17:46:52 +02:00
Raphael MichelGitHubMartin Gross
 		14c3baa2aa Drop nullability on Order.organizer and OrderPosition.organizer (#4278) 
* Drop nullability on Order.organizer and OrderPosition.organizer

* Rebase migration and add autoclean

* Utilize new relationship for scopes

* Declare reverse noop

* Update src/pretix/base/migrations/0302_resolve_duplicate_codes_and_secrets.py

Co-authored-by: Martin Gross <gross@rami.io>

* Update src/pretix/base/migrations/0302_resolve_duplicate_codes_and_secrets.py

Co-authored-by: Martin Gross <gross@rami.io>

---------

Co-authored-by: Martin Gross <gross@rami.io>
 2026-07-07 17:44:19 +02:00
Raphael MichelGitHubluelista
 		dc1b62fc56 Vouchers: Allow to bulk-update (#6096) 
* Vouchers: Allow to bulk-delete larger numbers

* [DRAFT] voucher bulk update

* untested draft

* Minor fixes

* some tests and fixes

* More tests

* Bulk vouchers - refactor (#6353)

* Reuse parse_itemvar from VoucherForm

* Refactor: Method for _bulk update check

* remove unused parameter

* Refactor: Deduplicate get_affected_quotas code

* Remove unused delete button

* Prevent accidental update of *all* vouchers (cf PR #4960)

* Make sure we actually edit the selected items

* Use dataclass for bulk-edit data, deduplicate quota-blocking logic

* Move dataclass to models.py

* Fix linter errors

* Fix tests

* Fix tests

---------

Co-authored-by: luelista <weller@rami.io>
 2026-07-07 17:03:25 +02:00
Raphael MichelandGitHub ea2c81e6dc Improve handling of logout during asynchronous tasks (Z#23238978) (#6341) 
* Handle logout during async task requests properly

* Handle fragments safely on webcheckin logout

* Remove unnecessary comment

* Revert hash change
 2026-07-07 16:14:00 +02:00
Raphael Michel 2bd5e90a86 Fix isort 2026-07-07 15:43:00 +02:00
Raphael Michel 8095134400 Add query tagging for periodic tasks 2026-07-07 14:55:32 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		62f2ed55b2 Update webauthn requirement from ==2.8.* to ==3.0.* (#6350) 
Updates the requirements on [webauthn](https://github.com/duo-labs/py_webauthn) to permit the latest version.
- [Release notes](https://github.com/duo-labs/py_webauthn/releases)
- [Changelog](https://github.com/duo-labs/py_webauthn/blob/master/CHANGELOG.md)
- [Commits](https://github.com/duo-labs/py_webauthn/compare/v2.8.0-alpha1...v3.0.0)

---
updated-dependencies:
- dependency-name: webauthn
  dependency-version: 3.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-07 12:13:40 +02:00
Raphael MichelGitHubluelista
 		3533450601 Add trace IDs from request to celery task (#6333) 
* Add trace IDs from request to celery task

Celery tasks will log the request ID they were triggered from:

    [2026-07-02 10:33:17,614: INFO/MainProcess] Task pretix.base.services.orders.cancel_order[5f3104b3-0a54-4e49-921e-c866c4dc4c6d] received
    [2026-07-02 10:33:17,614: INFO/MainProcess] Task 5f3104b3-0a54-4e49-921e-c866c4dc4c6d has trace 4d389638-00ab-4c4d-bdec-d73ac322bf44

Nested celery tasks will then contain both the request ID as well as the previous tasks:

    [2026-07-02 10:33:18,354: INFO/MainProcess] Task pretix.base.services.notifications.notify[d52a3a49-9c89-4f67-bdde-9f773586fc07] received
    [2026-07-02 10:33:18,354: INFO/MainProcess] Task d52a3a49-9c89-4f67-bdde-9f773586fc07 has trace 4d389638-00ab-4c4d-bdec-d73ac322bf44 5f3104b3-0a54-4e49-921e-c866c4dc4c6d

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
 2026-07-07 12:09:27 +02:00
pajowuandGitHub 5fb827c8f5 CheckInListPDF export: remove double html escaping with PlainTextParagraph (Z#23239571) (#6347) 2026-07-07 12:00:17 +02:00
Raphael MichelandRaphael Michel af6727bbe2 Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6362 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-07-07 11:57:51 +02:00
Raphael MichelandRaphael Michel f0d2733e8d Translations: Update German 
Currently translated at 100.0% (6362 of 6362 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-07-07 11:57:51 +02:00
Raphael Michel 90bca935de Update po files 
[CI skip]

Signed-off-by: Raphael Michel <michel@rami.io>
 2026-07-07 11:34:15 +02:00
Raphael Michel 9c752b7263 Translations: Fix typo 2026-07-07 11:29:03 +02:00
CVZ-esandRaphael Michel bfdd61a14c Translations: Update French 
Currently translated at 99.9% (6355 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/fr/

powered by weblate
 2026-07-07 11:28:33 +02:00
CVZ-esandRaphael Michel 6aca806239 Translations: Update Spanish 
Currently translated at 100.0% (6360 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/es/

powered by weblate
 2026-07-07 11:28:33 +02:00
CVZ-esandRaphael Michel 8512a8c4a5 Translations: Update French 
Currently translated at 99.9% (6354 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/fr/

powered by weblate
 2026-07-07 11:28:33 +02:00
Raphael MichelandRaphael Michel ecee6f6c30 Translations: Update German (informal) (de_Informal) 
Currently translated at 99.9% (6359 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-07-07 11:28:33 +02:00
Raphael MichelandRaphael Michel 846ec77c50 Translations: Update German 
Currently translated at 99.9% (6359 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-07-07 11:28:33 +02:00
CVZ-esandRaphael Michel 49c69c816c Translations: Update French 
Currently translated at 99.8% (6348 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/fr/

powered by weblate
 2026-07-07 11:28:33 +02:00
Hijiri UmemotoandRaphael Michel f3868576c5 Translations: Update Japanese 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/ja/

powered by weblate
 2026-07-07 11:28:33 +02:00
Hijiri UmemotoandRaphael Michel 3857361559 Translations: Update Japanese 
Currently translated at 100.0% (6360 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ja/

powered by weblate
 2026-07-07 11:28:33 +02:00
CVZ-esandRaphael Michel b0c50de331 Translations: Update Spanish 
Currently translated at 100.0% (6360 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/es/

powered by weblate
 2026-07-07 11:28:33 +02:00
CVZ-esandRaphael Michel 1dad6bf801 Translations: Update French 
Currently translated at 99.7% (6347 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/fr/

powered by weblate
 2026-07-07 11:28:33 +02:00
Raphael MichelandRaphael Michel d94d4bd57e Translations: Update German (informal) (de_Informal) 
Currently translated at 99.9% (6358 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-07-07 11:28:33 +02:00
CVZ-esandRaphael Michel 2437f768c9 Translations: Update German (informal) (de_Informal) 
Currently translated at 99.9% (6358 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-07-07 11:28:33 +02:00
Raphael MichelandRaphael Michel ab621890a2 Translations: Update German 
Currently translated at 99.9% (6359 of 6360 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-07-07 11:28:33 +02:00
Raphael Michel a9135919a1 Translations: Update wordlists 2026-07-07 11:21:59 +02:00
Raphael Michel e2c437fd43 Update confusing verbiage after #6216 2026-07-07 10:58:27 +02:00
Raphael MichelandGitHub ba10fc8041 Event product list: Fix another performance issue for large series (#6331) 
This is a follow-up for #6318, basically the same problem but in a
neighboring query.

Performance comparison for real-world event with 13k subevents:

In [15]: %time get_grouped_items(e, subevent=se, channel=e.organizer.sales_channels.get(identifier="web"))
CPU times: user 49.1 ms, sys: 3.79 ms, total: 52.9 ms
Wall time: 1.12 s
Out[15]: ([<Item: xxx>], True

In [16]: %time get_grouped_items_patched(e, subevent=se, channel=e.organizer.sales_channels.get(identifier="web"))
CPU times: user 30.2 ms, sys: 445 μs, total: 30.6 ms
Wall time: 45.3 ms
Out[16]: ([<Item: xxx>], True)
 2026-07-07 10:48:50 +02:00
Raphael MichelandGitHub 7732794317 Do not use redis cache at import time (#6321) 
During our [2026-06-27 incident](https://pretix.eu/about/en/blog/20260630-pretix-hosted-outage/),
we noticed that pretix is using redis at import time. This means that
gunicorn and celery process were unable to start on servers who could
currently not reach redis. This is kinda mitigated through auto-restart
on systemd or docker level, but that's not really how it is supposed to
work. Celery even has smart retry/reconnect logic that becomes pointless
this way.
 2026-07-07 10:47:12 +02:00
Raphael Michel 8a47ba7ff5 Update po files 
[CI skip]

Signed-off-by: Raphael Michel <michel@rami.io>
 2026-07-06 17:53:13 +02:00
sweenuGitHubRaphael Michel
 		dd2a74557d Add contact URL setting (#6132) 
* Add contact URL setting

* Apply suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Apply suggestion from @raphaelm

---------

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
 2026-07-06 17:49:55 +02:00
Richard SchreiberandGitHub bb9c4fa18d Event calendar: Improve iOS VoiceOver month dropdown selection (Z#23234442) (#6320) 2026-07-06 17:38:23 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Raphael Michel
 		ac356acd29 Update django-redis requirement from ==6.0.* to ==7.0.* (#6244) 
Updates the requirements on [django-redis](https://github.com/jazzband/django-redis) to permit the latest version.
- [Release notes](https://github.com/jazzband/django-redis/releases)
- [Changelog](https://github.com/jazzband/django-redis/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/jazzband/django-redis/compare/6.0.0...7.0.0)

---
updated-dependencies:
- dependency-name: django-redis
  dependency-version: 7.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Raphael Michel <michel@pretix.eu>
 2026-07-06 17:35:52 +02:00
Kian CrossGitHubRaphael Michel
 		54eadaffcc Improve admin-facing email templates (#6216) 
* Improve subject lines for admin-facing emails

A few of the current subjects are ambiguous about the expected
action, and some omit context that would help in an inbox preview
(which event, which address). The rewrites bring them closer to
common conventions in modern transactional email (verb-led,
recipient-addressed, with recipient-meaningful variables). Two
themes:

- Action-required emails lead with the action verb. "Reset your
  password", "Confirm event cancellation and bulk refund", and
  "Confirm <address> as a sender address" tell the recipient up
  front what's expected, where "Password recovery", "Bulk-refund
  confirmation" and "Sender address verification" did not.

- Surface the relevant variable when the email is about something
  specific. "Data shredding completed for <event>" is more useful
  than the generic version when an admin manages several events.
  "You've been invited to join <organizer>" names the inviting
  organizer. "Confirm <address> as a sender address" names the
  address.

The remaining rewrites are lighter rewordings. "New sign-in to
your account" replaces "Login from new source detected" because
"source" is jargon a non-technical recipient wouldn't recognise.
"Changes to your account" replaces "Account information changed"
because the possessive frames the email as being about the
recipient's own account.

Also fixes a hardcoded "pretix" in the confirmation-code subject.

* Standardise admin email sign-offs as "Thanks, The <instance> Team"

The current sign-offs ("Best regards, Your <instance> team") have
a formal tone. A review of the last ~20 transactional emails in
my inbox showed most senders use something friendlier:

- Thanks: Deliveroo, Starling Bank, GitHub, Cloudflare
- Thank you: AWS
- Sincerely: Google Workspace

A small minority (e.g., Sentry) had no sign-off at all. "Thanks"
was the most common, and among that group "The <instance> Team"
was the consistent phrasing rather than "Your <instance> team".

Two templates (cancel_confirm, export_failed) didn't have a
sign-off; they now get one for consistency. Notification emails
are deliberately excluded: they're system alerts rather than
direct correspondence.

* Add anti-phishing notice to admin emails containing confirmation codes

Three admin emails send the recipient a confirmation code to
enter back into a form: confirmation_code, email_setup, and
cancel_confirm. Only confirmation_code had an anti-phishing
warning, and its wording was awkward ("Please do never give this
code to another person. Our support team will never ask for this
code.").

This commit standardises the warning across all three:

> Don't share this code with anyone. The <instance> team will
> never ask you for it.

* Add structured details to login-notice email

The single-sentence body ("The login was performed using <agent>
on <os> from <country>.") is replaced with a labelled bullet list:
Time, Browser, Operating system, Device, Country.

Time and Device are new fields. Device is omitted when ua-parser
can't identify the device, Country when GeoIP isn't available,
so the user only sees fields with real values.

* Restructure notification.txt for clearer layout

- Attributes: bullet list instead of paragraph-per-attribute.

- Actions: label gets a colon, URL on its own paragraph (was
  4-space-indented code block).

- Footer: separated by --- and bulleted (manage / disable
  links). "Click here X" phrasing dropped (incidentally moots
  a missing-"to" typo).

- Minor whitespace fix: detail-block endif now matches the
  placement of the rest of the template.

notification.html's footer text is also updated, only to match
the new .txt wording (link labels and intro line). No
structural changes to the HTML template.

* Improve confirmation-code email reason strings

- Drop the redundant "to confirm" opener.

- Replace hardcoded "your pretix account" in email_verify
  with "{instance}".

* Polish admin email body copy

A small wording and formatting pass on the admin email bodies,
in three loosely-grouped themes:

1. Sentence case for body text (previously lowercase after
   "Hello,"), matching standard English convention.

2. Light restructuring where helpful: bullet lists for sets
   of labelled facts; 4-space-indented code blocks for codes
   the recipient is meant to type back.

3. Phrasing polish. Some sentences tightened or shortened.
   Largely matters of taste, but generally read smoother.

---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
 2026-07-06 17:25:52 +02:00
Swiftb0yGitHubRaphael Michel
 		617a548b19 Add event placeholder support to more fields (#6098) 
* Add event placeholder support to more fields

I found it useful to be able to use the `{event}` placeholder in
some fields such as the "End of presale text" because I don't need
to fix the texts creating a new event by cloning another event.
I made placeholders available to the other fields as well (where not too
difficult). Specifically `presale_has_ended_text`, `voucher_explanation_text`
`banner_text`, `banner_text_bottom` and `event_info_text`.
In addition, I grouped them under a new `texts` variable in the `context`
(including `frontpage_text` which was part of the root `context` previously).

* change compute location

---------

Co-authored-by: Raphael Michel <michel@rami.io>
 2026-07-06 17:18:04 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		fe0f7864e7 Update reportlab requirement from ==4.5.* to ==5.0.* (#6307) 
Updates the requirements on [reportlab](https://www.reportlab.com/) to permit the latest version.

---
updated-dependencies:
- dependency-name: reportlab
  dependency-version: 5.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-06 17:03:12 +02:00
Kian CrossGitHubRaphael Michel
 		fc4a2f5508 Customer SSO: Improve one-time token error message (#5841) 
* Improve SSO one-time token error message

Replace the generic 'invalid one-time token' message shown after failed
SSO login attempts with a clearer, user-facing explanation of what went
wrong and how to recover.

* Remove unneeded classes from headings

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Apply suggestions from code review

Added `trimmed` to translation blocks

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Reword SSO error template for improved translation clarity

---------

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
 2026-07-06 16:59:59 +02:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Raphael Michel
 		4cb32a753f Update requests requirement from ==2.32.* to ==2.34.* (#6178) 
Updates the requirements on [requests](https://github.com/psf/requests) to permit the latest version.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](https://github.com/psf/requests/compare/v2.32.0...v2.34.0)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.34.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Raphael Michel <michel@pretix.eu>
 2026-07-06 16:57:27 +02:00
KarlKeu00andGitHub 3ae9aabcfb Add Docker secrets support in config (#6250) 
* Add Docker secrets support in config

* ruff format

* Remove gracefully fallback exception handling

* Add support for loading secret fallbacks from environment file
 2026-07-06 15:09:31 +02:00
Puneet DixitGitHubPuneet DixitRaphael Michel
 		3270c4e583 Bank transfer: Fix incorrect HTML escaping in QR Code (fix #4780) (#6201) 
* Fix EPC QR beneficiary escaping

* Fix EPC QR script encoding

Keep EPC QR helper output as a plain string and serialize payment QR payloads as JSON script data before the QR replacement JavaScript parses them. This preserves apostrophes without relying on mark_safe in the helper.

Assisted-by: OpenAI GPT-5 <noreply@openai.com>

* "type safety"

---------

Co-authored-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com>
Co-authored-by: Raphael Michel <michel@rami.io>
 2026-07-06 12:52:29 +02:00
sweenuGitHubRaphael Michel
 		3b285a89dd Sentry: Optionally enable sending logs (#6222) 
* Enable sending logs to Sentry

* change to info

---------

Co-authored-by: Raphael Michel <michel@rami.io>
 2026-07-06 12:38:28 +02:00
sweenuandGitHub c1683df1fd Allow to update -> Allow updating (#6131) 2026-07-06 11:54:33 +02:00
Kian CrossandGitHub 6fdcbcebd2 Add typeahead suggestions for voucher tag field (#6058) 
Suggest existing tags as the user types in the voucher tag field.
Waiting list voucher tags are excluded from suggestions.
 2026-07-06 11:42:05 +02:00
Kian CrossandGitHub ddbea7c32e Customer login during checkout: Display SSO login errors inline (#5840) 
Replace the JavaScript alert used for SSO popup login errors during the
checkout flow with an inline HTML error message.
 2026-07-06 11:38:43 +02:00
luelistaandGitHub 3f8ed0f722 Only set vat_id_validated if vat_id non-empty (#6210) 2026-07-06 11:21:53 +02:00
sweenuandGitHub 388eb7de96 BasePaymentProvider: Fix type hinting on execute_payment() (#6078) 2026-07-06 11:19:53 +02:00
dependabot[bot]andRaphael Michel df4c83d849 Update pillow requirement from ==12.2.* to ==12.3.* 
Updates the requirements on [pillow](https://github.com/python-pillow/Pillow) to permit the latest version.
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0)

---
updated-dependencies:
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-06 11:12:11 +02:00
Benedikt BormannandRaphael Michel fa4cec8a2d Translations: Update German 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/de/

powered by weblate
 2026-07-06 11:11:51 +02:00
Lukas BockstallerGitHubRichard Schreiber
 		943b319557 use cookieretry only on presale event pages (Z#23236752) (#6297) 
* use cookieretry only on presale event pages

* use csrfcookieretry only on event index page

* include static tag

* include csrfcookieretry in order.html as well

* Update src/pretix/static/pretixpresale/js/csrfcookieretry.js

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
 2026-07-03 13:56:47 +02:00
Richard SchreiberandGitHub 28b13667ce Widget: add beta-flag to URL (#6338) 2026-07-03 12:04:54 +02:00
Raphael MichelandGitHub b00d1c9156 Bump django-querytagger 2026-07-03 11:53:34 +02:00
Raphael Michel 120317a8f2 Fix linter issue 2026-07-03 11:00:48 +02:00
Raphael Michel 7d5b00a610 Fix linter issues 2026-07-03 10:54:44 +02:00
Raphael Michel 83612c7d65 Merge branch 'security/harden-staffsession' into 'master' 
Harden StaffSession handling

See merge request pretix/pretix!42
 2026-07-03 10:41:39 +02:00
Mira WellerandRaphael Michel 7a5f96369a Harden StaffSession handling 2026-07-03 10:41:39 +02:00
Raphael Michel 7fd6bf41f9 Merge branch 'csp-refactor' into 'master' 
CSP refactor

See merge request pretix/pretix!35
 2026-07-03 10:33:35 +02:00
Mira WellerandRaphael Michel 458c3d4b83 CSP refactor 2026-07-03 10:33:35 +02:00
Raphael Michel d10d061e45 Merge branch 'check-csp' into 'master' 
Check CSP components before rendering, prevent format string traversal

See merge request pretix/pretix!33
 2026-07-03 10:26:23 +02:00
Mira WellerandRaphael Michel d30bca50f7 Check CSP components before rendering, prevent format string traversal 2026-07-03 10:26:23 +02:00
Phin WolkwitzandGitHub 3903aca7c9 Add Thai translations to community languages (Z#23239401) (#6334) 2026-07-02 17:44:28 +02:00
Raphael MichelandGitHub 493c920aba Install django-querytagger (#6332) 
* Install django-querytagger

* Update pyproject.toml
 2026-07-02 14:40:02 +02:00
Raphael MichelandGitHub 09b7bc00b0 Organizer calendar: Respect event_calendar_future_only (Z#23238776) (#6326) 
We initially didn't do this for two reasons:

- Performance implications of calling the settings store for every event
  that shows up in the calendar. As of d43e85da, we need that anyways.
- Performance implications of filtering in Python except SQL but... it
  can't really be worse than not filtering at all.
- We don't easily know if it's valid for all events so we can't stop
  rendering the unused calendar rows. That's an acceptable issue for
  now, still better than nothing. We can always optimize later.

So we might as well implement it.
 2026-07-02 14:31:44 +02:00
dependabot[bot]andRaphael Michel 2e195c0274 Update sentry-sdk requirement from ==2.63.* to ==2.64.* 
Updates the requirements on [sentry-sdk](https://github.com/getsentry/sentry-python) to permit the latest version.
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-python/compare/2.63.0...2.64.0)

---
updated-dependencies:
- dependency-name: sentry-sdk
  dependency-version: 2.64.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-02 13:53:33 +02:00
Raphael MichelandGitHub 18cb9c1816 Drop line numbers from gettext .po files (#6330) 
Knowing what file a string comes from is useful, but the line number is less
useful and changes a lot, causing very unreadable diffs of translation
files. I propose we drop them and only include the file names
 2026-07-02 10:21:09 +02:00
Richard SchreiberandGitHub c3e0120f9f Improve calendar explorability for VoiceOver on iOS 2026-07-02 08:13:09 +02:00
Raphael Michel 67f7fec134 Fix flake8 issue 2026-07-01 18:01:50 +02:00
Raphael Michel c2c97f31ca Bump version to 2026.7.0.dev0 2026-07-01 16:33:10 +02:00