forked from CGM_Public/pretix_original
luelistaandGitHub
430c6dd269
As a security precaution, we change the contract of some signals such that a
SafeString needs to be returned if HTML should be rendered without further
escaping.
Before, the `{% signal ... %}` and `{% eventsignal ... %}` template tags
called mark_safe themselves on all strings returned from signals. That could
lead to unsafe coding practices, where untrusted values are interpolated into
HTML format strings. However, such interpolations should usually be performed
using helpers such Django's format_html, which automatically escapes inputs
and returns a SafeString.
Now, we call conditional_escape on signal results, so that any HTML not explicitly
marked as safe gets escaped.
Most plugins are not affected by this change as they return a SafeString as a
result of Template.render already.
pretix ====== .. image:: https://img.shields.io/pypi/v/pretix.svg :target: https://pypi.python.org/pypi/pretix .. image:: https://github.com/pretix/pretix/workflows/Documentation/badge.svg :target: https://docs.pretix.eu/ .. image:: https://github.com/pretix/pretix/workflows/Tests/badge.svg :target: https://github.com/pretix/pretix/actions/workflows/tests.yml .. image:: https://codecov.io/gh/pretix/pretix/branch/master/graph/badge.svg :target: https://codecov.io/gh/pretix/pretix Reinventing ticket presales, one ticket at a time. Project status & release cycle ------------------------------ While there is always a lot to do and improve on, pretix by now has been in use for thousands of events conferences that sold millions of tickets combined. We therefore think of pretix as being stable and ready to use. If you want to use or extend pretix, we strongly recommend to follow our `blog`_. We will announce all releases there. You can always find the latest stable version on PyPI or in the ``release/X.Y`` branch of this repository. The ``master`` branch contains a development version that we also try to keep stable in the sense that it does not break your data, but its APIs might change without prior notice. To get started using pretix on your own server, look at the `installation guide`_ in our documentation. Support ------- This project is 100 percent free and open source software. You are welcome to ask questions in the GitHub repository. Private support via email or phone is only offered to customers of our pretix Hosted or pretix Enterprise offerings. If you are interested in commercial support, hosting services or supporting this project financially, please go to `pretix.eu`_ or contact us at support@pretix.eu. Contributing ------------ If you want to contribute to pretix, please read the `developer documentation`_ in our documentation. If you have any further questions, please do not hesitate to ask! .. image:: https://translate.pretix.eu/widgets/pretix/-/pretix/multi-blue.svg :target: https://translate.pretix.eu/engage/pretix/ Code of Conduct --------------- We have a `Code of Conduct`_ in place that applies to all project contributions, including issues, pull requests, etc. License ------- The code in this repository is covered by different licenses. Most of it is available to everyone under the terms of the GNU AGPL license v3 with additional terms. See the LICENSE file for the complete license details. .. _installation guide: https://docs.pretix.eu/self-hosting/installation/general/ .. _developer documentation: https://docs.pretix.eu/dev/development/index.html .. _Code of Conduct: https://docs.pretix.eu/dev/development/contribution/codeofconduct.html .. _pretix.eu: https://pretix.eu .. _blog: https://pretix.eu/about/en/blog/