From 2e2fe874e1f2ec1c5f1231a2435233d9ce40c6b5 Mon Sep 17 00:00:00 2001
From: Mira Weller <weller@rami.io>
Date: Mon, 29 Jun 2026 22:15:51 +0200
Subject: [PATCH] Remove more usages of |safe

---
 src/pretix/base/payment.py                                   | 4 ++--
 src/pretix/control/templates/pretixcontrol/order/cancel.html | 2 +-
 src/pretix/control/templates/pretixcontrol/order/index.html  | 4 ++--
 src/pretix/control/views/orders.py                           | 4 ++--
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/pretix/base/payment.py b/src/pretix/base/payment.py
index 8efc58d495..5a4a562b8b 100644
--- a/src/pretix/base/payment.py
+++ b/src/pretix/base/payment.py
@@ -936,7 +936,7 @@ class BasePaymentProvider:
         """
         Will be called if the *event administrator* views the details of a payment.
 
-        It should return HTML code containing information regarding the current payment
+        It should return a SafeString containing HTML code, with information regarding the current payment
         status and, if applicable, next steps.
 
         The default implementation returns an empty string.
@@ -961,7 +961,7 @@ class BasePaymentProvider:
         """
         Will be called if the *event administrator* views the details of a refund.
 
-        It should return HTML code containing information regarding the current refund
+        It should return a SafeString containing HTML code, with information regarding the current refund
         status and, if applicable, next steps.
 
         The default implementation returns an empty string.
diff --git a/src/pretix/control/templates/pretixcontrol/order/cancel.html b/src/pretix/control/templates/pretixcontrol/order/cancel.html
index 158cce737c..8530c50052 100644
--- a/src/pretix/control/templates/pretixcontrol/order/cancel.html
+++ b/src/pretix/control/templates/pretixcontrol/order/cancel.html
@@ -26,7 +26,7 @@
         {% if form.cancellation_fee %}
             {% if fee %}
                 {% with fee|money:request.event.currency as f %}
-                    <p>{% blocktrans trimmed with fee="<strong>"|add:f|add:"</strong>"|safe %}
+                    <p>{% blocktrans trimmed with fee=f|wrap_in:"strong" %}
                         The configured cancellation fee for a self-service cancellation would be {{ fee }} for this
                         order, but for a cancellation performed by you, you need to set the cancellation fee here:
                     {% endblocktrans %}</p>
diff --git a/src/pretix/control/templates/pretixcontrol/order/index.html b/src/pretix/control/templates/pretixcontrol/order/index.html
index 37e6171c6f..07157f1e1c 100644
--- a/src/pretix/control/templates/pretixcontrol/order/index.html
+++ b/src/pretix/control/templates/pretixcontrol/order/index.html
@@ -903,7 +903,7 @@
                                             <tr>
                                                 <td colspan="1"></td>
                                                 <td colspan="5">
-                                                    {{ p.html_info|safe }}
+                                                    {{ p.html_info }}
                                                     {% if staff_session %}
                                                         <p>
                                                             <a href="" class="btn btn-default btn-xs admin-only" data-expandpayment data-id="{{ p.pk }}">
@@ -1018,7 +1018,7 @@
                                                             </dl>
                                                         {% endif %}
                                                         {% if r.html_info %}
-                                                            {{ r.html_info|safe }}
+                                                            {{ r.html_info }}
                                                         {% endif %}
                                                         {% if staff_session %}
                                                             <p>
diff --git a/src/pretix/control/views/orders.py b/src/pretix/control/views/orders.py
index 53b628ed58..38e6b45d06 100644
--- a/src/pretix/control/views/orders.py
+++ b/src/pretix/control/views/orders.py
@@ -551,10 +551,10 @@ class OrderDetail(OrderView):
         ctx['refunds'] = self.order.refunds.select_related('payment').order_by('-created')
         for p in ctx['payments']:
             if p.payment_provider:
-                p.html_info = (p.payment_provider.payment_control_render(self.request, p) or "").strip()
+                p.html_info = p.payment_provider.payment_control_render(self.request, p) or ""
         for r in ctx['refunds']:
             if r.payment_provider:
-                r.html_info = (r.payment_provider.refund_control_render(self.request, r) or "").strip()
+                r.html_info = r.payment_provider.refund_control_render(self.request, r) or ""
         ctx['invoices'] = list(self.order.invoices.all().select_related('event'))
         ctx['comment_form'] = CommentForm(initial={
             'comment': self.order.comment,