[SECURITY] Fix stored XSS in help texts

src/pretix/base/forms/questions.py

@@ -674,7 +674,7 @@ class BaseQuestionsForm(forms.Form):
                     label=label, required=required,
                     min_value=q.valid_number_min or Decimal('0.00'),
                     max_value=q.valid_number_max,
-                    help_text=q.help_text,
+                    help_text=help_text,
                     initial=initial.answer if initial else None,
                 )
             elif q.type == Question.TYPE_STRING:

src/pretix/presale/forms/checkout.py

@@ -51,6 +51,7 @@ from pretix.base.forms.questions import (
     guess_country,
 )
 from pretix.base.i18n import get_babel_locale, language
+from pretix.base.templatetags.rich_text import rich_text
 from pretix.base.validators import EmailBanlistValidator
 from pretix.presale.signals import contact_form_fields
 
@@ -89,7 +90,7 @@ class ContactForm(forms.Form):
                 self.fields['phone'] = PhoneNumberField(
                     label=_('Phone number'),
                     required=self.event.settings.order_phone_required,
-                    help_text=self.event.settings.checkout_phone_helptext,
+                    help_text=rich_text(self.event.settings.checkout_phone_helptext),
                     # We now exploit an implementation detail in PhoneNumberPrefixWidget to allow us to pass just
                     # a country code but no number as an initial value. It's a bit hacky, but should be stable for
                     # the future.
@@ -102,7 +103,7 @@ class ContactForm(forms.Form):
             # is an autofocus field. Who would have thought… See e.g. here:
             # https://floatboxjs.com/forum/topic.php?post=8440&usebb_sid=2e116486a9ec6b7070e045aea8cded5b#post8440
             self.fields['email'].widget.attrs['autofocus'] = 'autofocus'
-        self.fields['email'].help_text = self.event.settings.checkout_email_helptext
+        self.fields['email'].help_text = rich_text(self.event.settings.checkout_email_helptext)
 
         responses = contact_form_fields.send(self.event, request=self.request)
         for r, response in responses:

src/pretix/presale/forms/waitinglist.py

@@ -30,6 +30,7 @@ from pretix.base.forms.questions import (
 )
 from pretix.base.i18n import get_babel_locale, language
 from pretix.base.models import Quota, WaitingListEntry
+from pretix.base.templatetags.rich_text import rich_text
 from pretix.presale.views.event import get_grouped_items
 
 
@@ -105,7 +106,7 @@ class WaitingListForm(forms.ModelForm):
                 self.fields['phone'] = PhoneNumberField(
                     label=_("Phone number"),
                     required=event.settings.waiting_list_phones_required,
-                    help_text=event.settings.waiting_list_phones_explanation_text,
+                    help_text=rich_text(event.settings.waiting_list_phones_explanation_text),
                     widget=WrappedPhoneNumberPrefixWidget()
                 )
         else: