From 47b632eabe67afd554cb95562584fc14e81c1cf0 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Tue, 28 Jul 2026 09:07:16 +0200 Subject: [PATCH] RejectInvalidInputMiddleware: Ignore invalid charsets on body (#6314) --- src/pretix/base/middleware.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/pretix/base/middleware.py b/src/pretix/base/middleware.py index 43fe146474..9970183b4f 100644 --- a/src/pretix/base/middleware.py +++ b/src/pretix/base/middleware.py @@ -497,8 +497,16 @@ class RejectInvalidInputMiddleware(MiddlewareMixin): if "\x00" in request.META['QUERY_STRING'] or "%00" in request.META['QUERY_STRING']: raise BadRequest("Invalid characters in input.") if request.method in ('POST', 'PUT', 'PATCH') and request.content_type == "application/x-www-form-urlencoded": - if any("\x00" in value for key, value_list in request.POST.lists() for value in value_list): - raise BadRequest("Invalid characters in input.") + try: + post_data = request.POST.lists() + except BadRequest: + # Reading request.POST wasn't possible, probably an invalid charset. Django will crash once we actually + # use request.POST, but if we don't, let's not crash it (required for some weird payment provider + # webhooks, e.g. computop). + pass + else: + if any("\x00" in value for key, value_list in post_data for value in value_list): + raise BadRequest("Invalid characters in input.") class CustomCommonMiddleware(CommonMiddleware):