Added logging for all basic operations

src/pretix/control/views/auth.py

@@ -62,6 +62,7 @@ def register(request):
                 timezone=request.timezone if hasattr(request, 'timezone') else settings.TIME_ZONE
             )
             user = authenticate(email=user.email, password=form.cleaned_data['password'])
+            user.log_action('pretix.control.auth.user.created', user=user)
             auth_login(request, user)
             return redirect('control:index')
     else:
@@ -90,6 +91,7 @@ class Forgot(TemplateView):
                 },
                 None, locale=user.locale
             )
+            user.log_action('pretix.control.auth.user.forgot_password.mail_sent')
             messages.success(request, _('We sent you an e-mail containing further instructions.'))
             return redirect('control:auth.forgot')
         else:
@@ -141,6 +143,7 @@ class Recover(TemplateView):
             user.set_password(self.form.cleaned_data['password'])
             user.save()
             messages.success(request, _('You can now login using your new password.'))
+            user.log_action('pretix.control.auth.user.forgot_password.recovered')
             return redirect('control:auth.login')
         else:
             return self.get(request, *args, **kwargs)

src/pretix/control/views/event.py

@@ -3,6 +3,7 @@ from collections import OrderedDict
 from django import forms
 from django.contrib import messages
 from django.core.urlresolvers import reverse
+from django.db import transaction
 from django.db.models import Sum
 from django.forms import modelformset_factory
 from django.shortcuts import redirect, render
@@ -53,8 +54,17 @@ class EventUpdate(EventPermissionRequiredMixin, UpdateView):
         context['sform'] = self.sform
         return context
 
+    @transaction.atomic()
     def form_valid(self, form):
         self.sform.save()
+        if self.sform.has_changed():
+            self.request.event.log_action('pretix.event.settings', user=self.request.user, data={
+                k: self.request.event.settings.get(k) for k in self.sform.changed_data
+            })
+        if form.has_changed():
+            self.request.event.log_action('pretix.event.changed', user=self.request.user, data={
+                k: getattr(self.request.event, k) for k in form.changed_data
+            })
         messages.success(self.request, _('Your changes have been saved.'))
         return super().form_valid(form)
 
@@ -97,15 +107,20 @@ class EventPlugins(EventPermissionRequiredMixin, TemplateView, SingleObjectMixin
     def post(self, request, *args, **kwargs):
         self.object = self.get_object()
         plugins_active = self.object.get_plugins()
-        for key, value in request.POST.items():
-            if key.startswith("plugin:"):
-                module = key.split(":")[1]
-                if value == "enable":
-                    plugins_active.append(module)
-                else:
-                    plugins_active.remove(module)
-        self.object.plugins = ",".join(plugins_active)
-        self.object.save()
+        with transaction.atomic():
+            for key, value in request.POST.items():
+                if key.startswith("plugin:"):
+                    module = key.split(":")[1]
+                    if value == "enable":
+                        self.request.event.log_action('pretix.event.plugins.enabled', user=self.request.user,
+                                                      data={'plugin': module})
+                        plugins_active.append(module)
+                    else:
+                        self.request.event.log_action('pretix.event.plugins.disabled', user=self.request.user,
+                                                      data={'plugin': module})
+                        plugins_active.remove(module)
+            self.object.plugins = ",".join(plugins_active)
+            self.object.save()
         messages.success(self.request, _('Your changes have been saved.'))
         return redirect(self.get_success_url())
 
@@ -159,11 +174,18 @@ class PaymentSettings(EventPermissionRequiredMixin, TemplateView, SingleObjectMi
         context['providers'] = self.provider_forms
         return self.render_to_response(context)
 
+    @transaction.atomic()
     def post(self, request, *args, **kwargs):
         self.object = self.get_object()
         success = True
         for provider in self.provider_forms:
             if provider.form.is_valid():
+                if provider.form.has_changed():
+                    self.request.event.log_action(
+                        'pretix.event.payment.provider.' + provider.identifier, user=self.request.user, data={
+                            k: provider.form.cleaned_data.get(k) for k in provider.form.changed_data
+                        }
+                    )
                 provider.form.save()
             else:
                 success = False
@@ -207,16 +229,29 @@ class TicketSettings(EventPermissionRequiredMixin, FormView):
         form.prepare_fields()
         return form
 
+    @transaction.atomic()
     def post(self, request, *args, **kwargs):
         success = True
         for provider in self.provider_forms:
             if provider.form.is_valid():
                 provider.form.save()
+                if provider.form.has_changed():
+                    self.request.event.log_action(
+                        'pretix.event.tickets.provider.' + provider.identifier, user=self.request.user, data={
+                            k: provider.form.cleaned_data.get(k) for k in provider.form.changed_data
+                        }
+                    )
             else:
                 success = False
         form = self.get_form(self.get_form_class())
         if success and form.is_valid():
             form.save()
+            if form.has_changed():
+                self.request.event.log_action(
+                    'pretix.event.tickets.settings', user=self.request.user, data={
+                        k: form.cleaned_data.get(k) for k in form.changed_data
+                    }
+                )
             messages.success(self.request, _('Your changes have been saved.'))
             return redirect(self.get_success_url())
         else:
@@ -310,6 +345,7 @@ class EventPermissions(EventPermissionRequiredMixin, TemplateView):
         ctx['add_form'] = self.add_form
         return ctx
 
+    @transaction.atomic()
     def post(self, *args, **kwargs):
         if self.formset.is_valid() and self.add_form.is_valid():
             if self.add_form.has_changed():
@@ -327,7 +363,22 @@ class EventPermissions(EventPermissionRequiredMixin, TemplateView):
                         messages.error(self.request, _('This user already has permissions for this event.'))
                         return self.get(*args, **kwargs)
                     self.add_form.save()
+                    logdata = {
+                        k: v for k, v in self.add_form.cleaned_data.items()
+                    }
+                    logdata['user'] = self.add_form.instance.user_id
+                    self.request.event.log_action(
+                        'pretix.event.permissions.added', user=self.request.user, data=logdata
+                    )
             for form in self.formset.forms:
+                if form.has_changed():
+                    changedata = {
+                        k: form.cleaned_data.get(k) for k in form.changed_data
+                    }
+                    changedata['user'] = form.instance.user_id
+                    self.request.event.log_action(
+                        'pretix.event.permissions.changed', user=self.request.user, data=changedata
+                    )
                 if form.instance.user_id == self.request.user.pk:
                     if not form.cleaned_data['can_change_permissions'] or form in self.formset.deleted_forms:
                         messages.error(self.request, _('You cannot remove your own permission to view this page.'))

src/pretix/control/views/item.py

@@ -103,12 +103,14 @@ class CategoryDelete(EventPermissionRequiredMixin, DeleteView):
         except ItemCategory.DoesNotExist:
             raise Http404(_("The requested product category does not exist."))
 
+    @transaction.atomic()
     def delete(self, request, *args, **kwargs):
         self.object = self.get_object()
         for item in self.object.items.all():
             item.category = None
             item.save()
         success_url = self.get_success_url()
+        self.object.log_action('pretix.event.category.deleted', user=self.request.user)
         self.object.delete()
         messages.success(request, _('The selected category has been deleted.'))
         return HttpResponseRedirect(success_url)
@@ -136,8 +138,15 @@ class CategoryUpdate(EventPermissionRequiredMixin, UpdateView):
         except ItemCategory.DoesNotExist:
             raise Http404(_("The requested product category does not exist."))
 
+    @transaction.atomic()
     def form_valid(self, form):
         messages.success(self.request, _('Your changes have been saved.'))
+        if form.has_changed():
+            self.object.log_action(
+                'pretix.event.category.changed', user=self.request.user, data={
+                    k: form.cleaned_data.get(k) for k in form.changed_data
+                }
+            )
         return super().form_valid(form)
 
     def get_success_url(self) -> str:
@@ -160,10 +169,13 @@ class CategoryCreate(EventPermissionRequiredMixin, CreateView):
             'event': self.request.event.slug,
         })
 
+    @transaction.atomic()
     def form_valid(self, form):
         form.instance.event = self.request.event
         messages.success(self.request, _('The new category has been created.'))
-        return super().form_valid(form)
+        ret = super().form_valid(form)
+        form.instance.log_action('pretix.event.category.added', data=dict(form.cleaned_data), user=self.request.user)
+        return ret
 
 
 class CategoryList(ListView):
@@ -248,9 +260,11 @@ class QuestionDelete(EventPermissionRequiredMixin, DeleteView):
         context['dependent'] = list(self.get_object().items.all())
         return context
 
+    @transaction.atomic()
     def delete(self, request, *args, **kwargs):
         self.object = self.get_object()
         success_url = self.get_success_url()
+        self.object.log_action(action='pretix.event.question.deleted', user=request.user)
         self.object.delete()
         messages.success(request, _('The selected question has been deleted.'))
         return HttpResponseRedirect(success_url)
@@ -277,7 +291,14 @@ class QuestionUpdate(EventPermissionRequiredMixin, UpdateView):
         except Question.DoesNotExist:
             raise Http404(_("The requested question does not exist."))
 
+    @transaction.atomic()
     def form_valid(self, form):
+        if form.has_changed():
+            self.object.log_action(
+                'pretix.event.question.changed', user=self.request.user, data={
+                    k: form.cleaned_data.get(k) for k in form.changed_data
+                }
+            )
         messages.success(self.request, _('Your changes have been saved.'))
         return super().form_valid(form)
 
@@ -306,9 +327,12 @@ class QuestionCreate(EventPermissionRequiredMixin, CreateView):
             'event': self.request.event.slug,
         })
 
+    @transaction.atomic()
     def form_valid(self, form):
         messages.success(self.request, _('The new question has been created.'))
-        return super().form_valid(form)
+        ret = super().form_valid(form)
+        form.instance.log_action('pretix.event.question.added', user=self.request.user, data=dict(form.cleaned_data))
+        return ret
 
 
 class QuotaList(ListView):
@@ -378,10 +402,13 @@ class QuotaCreate(EventPermissionRequiredMixin, QuotaEditorMixin, CreateView):
             'event': self.request.event.slug,
         })
 
+    @transaction.atomic()
     def form_valid(self, form):
         form.instance.event = self.request.event
         messages.success(self.request, _('The new quota has been created.'))
-        return super().form_valid(form)
+        ret = super().form_valid(form)
+        form.instance.log_action('pretix.event.quota.added', user=self.request.user, data=dict(form.cleaned_data))
+        return ret
 
 
 class QuotaUpdate(EventPermissionRequiredMixin, QuotaEditorMixin, UpdateView):
@@ -399,8 +426,15 @@ class QuotaUpdate(EventPermissionRequiredMixin, QuotaEditorMixin, UpdateView):
         except Quota.DoesNotExist:
             raise Http404(_("The requested quota does not exist."))
 
+    @transaction.atomic()
     def form_valid(self, form):
         messages.success(self.request, _('Your changes have been saved.'))
+        if form.has_changed():
+            self.object.log_action(
+                'pretix.event.quota.changed', user=self.request.user, data={
+                    k: form.cleaned_data.get(k) for k in form.changed_data
+                }
+            )
         return super().form_valid(form)
 
     def get_success_url(self) -> str:
@@ -429,9 +463,11 @@ class QuotaDelete(EventPermissionRequiredMixin, DeleteView):
         context['dependent'] = list(self.get_object().items.all())
         return context
 
+    @transaction.atomic()
     def delete(self, request, *args, **kwargs):
         self.object = self.get_object()
         success_url = self.get_success_url()
+        self.object.log_action(action='pretix.event.quota.deleted', user=request.user)
         self.object.delete()
         messages.success(self.request, _('The selected quota has been deleted.'))
         return HttpResponseRedirect(success_url)
@@ -471,9 +507,12 @@ class ItemCreate(EventPermissionRequiredMixin, CreateView):
             'item': self.object.id,
         })
 
+    @transaction.atomic()
     def form_valid(self, form):
         messages.success(self.request, _('Your changes have been saved.'))
-        return super().form_valid(form)
+        ret = super().form_valid(form)
+        form.instance.log_action('pretix.event.item.added', user=self.request.user, data=dict(form.cleaned_data))
+        return ret
 
     def get_form_kwargs(self):
         """
@@ -497,8 +536,15 @@ class ItemUpdateGeneral(ItemDetailMixin, EventPermissionRequiredMixin, UpdateVie
             'item': self.get_object().id,
         })
 
+    @transaction.atomic()
     def form_valid(self, form):
         messages.success(self.request, _('Your changes have been saved.'))
+        if form.has_changed():
+            self.object.log_action(
+                'pretix.event.item.changed', user=self.request.user, data={
+                    k: form.cleaned_data.get(k) for k in form.changed_data
+                }
+            )
         return super().form_valid(form)
 
 
@@ -543,13 +589,31 @@ class ItemProperties(ItemDetailMixin, EventPermissionRequiredMixin, TemplateView
         for f in formset:
             f.instance.event = self.request.event
             f.instance.item = self.get_object()
+            is_created = not f.instance.pk
             f.instance.save()
-            print(f.instance)
+            if f.has_changed() and not is_created:
+                change_data = {
+                    k: f.cleaned_data.get(k) for k in f.changed_data
+                }
+                change_data['id'] = f.instance.pk
+                f.instance.item.log_action(
+                    'pretix.event.item.property.changed', user=self.request.user, data=change_data
+                )
+            elif is_created:
+                change_data = dict(f.cleaned_data)
+                change_data['id'] = f.instance.pk
+                f.instance.item.log_action(
+                    'pretix.event.item.property.added', user=self.request.user, data=change_data
+                )
 
             for n in f.nested:
-                print(n.deleted_forms, n.ordered_forms, n.extra_forms)
 
                 for fn in n.deleted_forms:
+                    f.instance.item.log_action(
+                        'pretix.event.item.property.value.deleted', user=self.request.user, data={
+                            'id': fn.instance.pk
+                        }
+                    )
                     fn.instance.delete()
                     fn.instance.pk = None
 
@@ -557,8 +621,24 @@ class ItemProperties(ItemDetailMixin, EventPermissionRequiredMixin, TemplateView
                     fn.instance.position = i
                     fn.instance.prop = f.instance
                     fn.save()
+                    if f.has_changed():
+                        change_data = {k: f.cleaned_data.get(k) for k in f.changed_data}
+                        change_data['id'] = f.instance.pk
+                        f.instance.item.log_action(
+                            'pretix.event.item.property.value.changed', user=self.request.user, data=change_data
+                        )
 
-                n.save_new_objects()
+                for form in n.extra_forms:
+                    if not form.has_changed():
+                        continue
+                    if n.can_delete and n._should_delete_form(form):
+                        continue
+                    change_data = dict(f.cleaned_data)
+                    n.save_new(form)
+                    change_data['id'] = form.instance.pk
+                    f.instance.item.log_action(
+                        'pretix.event.item.property.value.added', user=self.request.user, data=change_data
+                    )
         messages.success(self.request, _('Your changes have been saved.'))
         return redirect(self.get_success_url())
 
@@ -700,6 +780,13 @@ class ItemVariations(ItemDetailMixin, EventPermissionRequiredMixin, TemplateView
             for form in self.forms_flat:
                 if form.is_valid() and form.has_changed():
                     form.save()
+                    change_data = {
+                        k: form.cleaned_data.get(k) for k in form.changed_data
+                    }
+                    change_data['id'] = form.instance.pk
+                    self.object.log_action(
+                        'pretix.event.item.variation.changed', user=self.request.user, data=change_data
+                    )
                     if hasattr(form.instance, 'creation') and form.instance.creation:
                         # We need this special 'creation' field set to true in get_form
                         # for newly created items as cleanerversion does already set the
@@ -758,9 +845,11 @@ class ItemDelete(EventPermissionRequiredMixin, DeleteView):
                 raise Http404(_("The requested product does not exist."))
         return self.object
 
+    @transaction.atomic
     def delete(self, request, *args, **kwargs):
         success_url = self.get_success_url()
         if self.is_allowed():
+            self.get_object().log_action('pretix.event.item.deleted', user=self.request.user)
             self.get_object().delete()
             messages.success(request, _('The selected product has been deleted.'))
             return HttpResponseRedirect(success_url)
@@ -768,6 +857,9 @@ class ItemDelete(EventPermissionRequiredMixin, DeleteView):
             o = self.get_object()
             o.active = False
             o.save()
+            o.log_action('pretix.event.item.changed', user=self.request.user, data={
+                'active': False
+            })
             messages.success(request, _('The selected product has been deactivated.'))
             return HttpResponseRedirect(success_url)
 

src/pretix/control/views/orders.py

@@ -17,7 +17,7 @@ from pretix.base.models import (
 )
 from pretix.base.services import tickets
 from pretix.base.services.export import export
-from pretix.base.services.orders import mark_order_paid
+from pretix.base.services.orders import cancel_order, mark_order_paid
 from pretix.base.services.stats import order_overview
 from pretix.base.signals import (
     register_data_exporters, register_payment_providers,
@@ -136,8 +136,8 @@ class OrderDetail(OrderView):
         def keyfunc(pos):
             if (pos.item.admission and self.request.event.settings.attendee_names_asked) \
                     or pos.item.questions.all():
-                return pos.id, "", "", ""
-            return "", pos.item_id, pos.variation_id, pos.price
+                return pos.id, 0, 0, 0
+            return 0, pos.item_id, pos.variation_id, pos.price
 
         positions = []
         for k, g in groupby(sorted(list(cartpos), key=keyfunc), key=keyfunc):
@@ -164,19 +164,19 @@ class OrderTransition(OrderView):
         to = self.request.POST.get('status', '')
         if self.order.status == 'n' and to == 'p':
             try:
-                mark_order_paid(self.order, manual=True)
+                mark_order_paid(self.order, manual=True, user=self.request.user)
             except Quota.QuotaExceededException as e:
                 messages.error(self.request, str(e))
             else:
                 messages.success(self.request, _('The order has been marked as paid.'))
         elif self.order.status == 'n' and to == 'c':
-            self.order.status = Order.STATUS_CANCELLED
-            self.order.save()
+            cancel_order(self.order, user=self.request.user)
             messages.success(self.request, _('The order has been cancelled.'))
         elif self.order.status == 'p' and to == 'n':
             self.order.status = Order.STATUS_PENDING
             self.order.payment_manual = True
             self.order.save()
+            self.order.log_action('pretix.base.order.unpaid', user=self.request.user)
             messages.success(self.request, _('The order has been marked as not paid.'))
         elif self.order.status == 'p' and to == 'r':
             ret = self.payment_provider.order_control_refund_perform(self.request, self.order)
@@ -247,6 +247,9 @@ class OrderExtend(OrderView):
         if self.form.is_valid():
             if oldvalue > now():
                 messages.success(self.request, _('The payment term has been changed.'))
+                self.order.log_action('pretix.order.changed', user=self.request.user, data={
+                    'expires': self.order.expires
+                })
                 self.form.save()
             else:
                 try:
@@ -254,6 +257,9 @@ class OrderExtend(OrderView):
                         is_available = self.order._is_still_available()
                         if is_available is True:
                             self.form.save()
+                            self.order.log_action('pretix.order.changed', user=self.request.user, data={
+                                'expires': self.order.expires
+                            })
                             messages.success(self.request, _('The payment term has been changed.'))
                         else:
                             messages.error(self.request, is_available)