Ensure total ordering of paginated lists (#3061)

src/pretix/control/views/checkin.py

@@ -447,6 +447,7 @@ class CheckinListView(EventPermissionRequiredMixin, PaginationMixin, ListView):
     context_object_name = 'checkins'
     permission = 'can_view_orders'
     template_name = 'pretixcontrol/checkin/checkins.html'
+    ordering = ('-datetime', '-pk')
 
     def get_queryset(self):
         qs = Checkin.all.filter(

src/pretix/control/views/event.py

@@ -1061,7 +1061,7 @@ class EventLog(EventPermissionRequiredMixin, PaginationMixin, ListView):
     def get_queryset(self):
         qs = self.request.event.logentry_set.all().select_related(
             'user', 'content_type', 'api_token', 'oauth_application', 'device'
-        ).order_by('-datetime')
+        ).order_by('-datetime', '-pk')
         qs = qs.exclude(action_type__in=OVERVIEW_BANLIST)
         if not self.request.user.has_event_permission(self.request.organizer, self.request.event, 'can_view_orders',
                                                       request=self.request):

src/pretix/control/views/item.py

@@ -816,16 +816,18 @@ class QuotaList(PaginationMixin, ListView):
             qs = qs.filter(subevent_id=s)
 
         valid_orders = {
-            '-date': ('-subevent__date_from', 'name'),
-            'date': ('subevent__date_from', '-name'),
-            'size': ('size', 'name'),
-            '-size': ('-size', '-name'),
-            'name': ('name',),
-            '-name': ('-name',),
+            '-date': ('-subevent__date_from', 'name', 'pk'),
+            'date': ('subevent__date_from', '-name', '-pk'),
+            'size': ('size', 'name', 'pk'),
+            '-size': ('-size', '-name', '-pk'),
+            'name': ('name', 'pk'),
+            '-name': ('-name', '-pk'),
         }
 
         if self.request.GET.get("ordering", "-date") in valid_orders:
             qs = qs.order_by(*valid_orders[self.request.GET.get("ordering", "-date")])
+        else:
+            qs = qs.order_by('name', 'subevent__date_from', 'pk')
 
         return qs
 

src/pretix/control/views/orders.py

@@ -2529,7 +2529,7 @@ class RefundList(EventPermissionRequiredMixin, PaginationMixin, ListView):
     def get_queryset(self):
         qs = OrderRefund.objects.filter(
             order__event=self.request.event
-        ).select_related('order')
+        ).select_related('order').order_by('-created', '-pk')
 
         if self.filter_form.is_valid():
             qs = self.filter_form.filter_qs(qs)

src/pretix/control/views/organizer.py

@@ -556,7 +556,7 @@ class TeamListView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin, P
             memcount=Count('members', distinct=True),
             eventcount=Count('limit_events', distinct=True),
             invcount=Count('invites', distinct=True)
-        ).all().order_by('name')
+        ).all().order_by('name', 'pk')
         if self.filter_form.is_valid():
             qs = self.filter_form.filter_qs(qs)
         return qs
@@ -2040,6 +2040,8 @@ class LogView(OrganizerPermissionRequiredMixin, PaginationMixin, ListView):
     context_object_name = 'logs'
 
     def get_queryset(self):
+        # technically, we'd also need to sort by pk since this is a paginated list, but in this case we just can't
+        # bear the performance cost
         qs = self.request.organizer.all_logentries().select_related(
             'user', 'content_type', 'api_token', 'oauth_application', 'device'
         ).order_by('-datetime')
@@ -2437,7 +2439,7 @@ class CustomerDetailView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMi
             q |= Q(email__iexact=self.customer.email)
         qs = Order.objects.filter(
             q
-        ).select_related('event').order_by('-datetime')
+        ).select_related('event').order_by('-datetime', 'pk')
         return qs
 
     @cached_property