Easier PCI DSS compliance for payment pages (#4273)

* Assign names to compressed scripts

* Make PCI-relevant pages detectable

* Make payment summary markup more consistant to easy work in tracking plugin

* Add docs note

src/tests/presale/test_checkout.py

@@ -68,7 +68,7 @@ class BaseCheckoutTestCase:
         self.event = Event.objects.create(
             organizer=self.orga, name='30C3', slug='30c3',
             date_from=datetime.datetime(now().year + 1, 12, 26, tzinfo=datetime.timezone.utc),
-            plugins='pretix.plugins.stripe,pretix.plugins.banktransfer',
+            plugins='pretix.plugins.stripe,pretix.plugins.banktransfer,tests.testdummy',
             live=True
         )
         self.tr19 = self.event.tax_rules.create(rate=19)
@@ -151,6 +151,28 @@ class CheckoutTestCase(BaseCheckoutTestCase, TimemachineTestMixin, TestCase):
         self._set_session('invoice_address', ia.pk)
         return ia
 
+    def test_pci_page(self):
+        with scopes_disabled():
+            CartPosition.objects.create(
+                event=self.event, cart_id=self.session_key, item=self.ticket,
+                price=23, expires=now() + timedelta(minutes=10)
+            )
+
+        r = self.client.get('/%s/%s/checkout/questions/' % (self.orga.slug, self.event.slug))
+        assert b'TRACKING SCRIPT' in r.content
+
+        payment_r = self.client.post('/%s/%s/checkout/questions/' % (self.orga.slug, self.event.slug), {
+            'is_business': 'business',
+            'company': 'Foo',
+            'name': 'Bar',
+            'street': 'Baz',
+            'zipcode': '1234',
+            'city': 'Here',
+            'country': 'AT',
+            'email': 'admin@localhost'
+        }, follow=True)
+        assert b'TRACKING SCRIPT' not in payment_r.content
+
     def test_empty_cart(self):
         response = self.client.get('/%s/%s/checkout/start' % (self.orga.slug, self.event.slug), follow=True)
         self.assertRedirects(response, '/%s/%s/?require_cookie=true' % (self.orga.slug, self.event.slug),

src/tests/testdummy/signals.py

@@ -26,6 +26,7 @@ from pretix.base.signals import (
     register_payment_providers, register_sales_channel_types,
     register_ticket_outputs,
 )
+from pretix.presale.signals import html_head
 
 
 @receiver(register_ticket_outputs, dispatch_uid="output_dummy")
@@ -61,3 +62,11 @@ class FoobarSalesChannel(SalesChannelType):
 @receiver(register_sales_channel_types, dispatch_uid="sc_dummy")
 def register_sc(sender, **kwargs):
     return [FoobarSalesChannel, FoobazSalesChannel]
+
+
+@receiver(html_head, dispatch_uid="dummy_html_head")
+def html_head_presale(sender, request=None, **kwargs):
+    if getattr(request, 'pci_dss_payment_page', False):
+        # No tracking scripts on PCI DSS relevant payment pages
+        return ""
+    return "<script>alert('BAD TRACKING SCRIPT')</script>"