Make all orders "guest orders"

src/tests/base/test_models.py

@@ -308,7 +308,7 @@ class OrderTestCase(BaseQuotaTestCase):
         self.user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
         self.order = Order.objects.create(
             status=Order.STATUS_PENDING, event=self.event,
-            user=self.user, datetime=now() - timedelta(days=5),
+            datetime=now() - timedelta(days=5),
             expires=now() + timedelta(days=5), total=46
         )
         self.quota.items.add(self.item1)

src/tests/base/test_orders.py

@@ -22,7 +22,7 @@ def event():
 def test_expiry_days(event):
     today = now()
     event.settings.set('payment_term_days', 5)
-    order = place_order(event, user=None, email='dummy@example.org', positions=[],
+    order = place_order(event, email='dummy@example.org', positions=[],
                         dt=today, payment_provider=FreeOrderProvider(event),
                         locale='de')
     assert (order.expires - today).days == 5
@@ -33,12 +33,12 @@ def test_expiry_last(event):
     today = now()
     event.settings.set('payment_term_days', 5)
     event.settings.set('payment_term_last', now() + timedelta(days=3))
-    order = place_order(event, user=None, email='dummy@example.org', positions=[],
+    order = place_order(event, email='dummy@example.org', positions=[],
                         dt=today, payment_provider=FreeOrderProvider(event),
                         locale='de')
     assert (order.expires - today).days == 3
     event.settings.set('payment_term_last', now() + timedelta(days=7))
-    order = place_order(event, user=None, email='dummy@example.org', positions=[],
+    order = place_order(event, email='dummy@example.org', positions=[],
                         dt=today, payment_provider=FreeOrderProvider(event),
                         locale='de')
     assert (order.expires - today).days == 5

src/tests/control/test_orders.py

@@ -25,8 +25,8 @@ def env():
         can_change_orders=True
     )
     o = Order.objects.create(
-        code='FOO', event=event,
-        user=user, status=Order.STATUS_PENDING,
+        code='FOO', event=event, email='dummy@dummy.test',
+        status=Order.STATUS_PENDING,
         datetime=now(), expires=now() + timedelta(days=10),
         total=0, payment_provider='banktransfer'
     )

src/tests/control/test_permissions.py

@@ -18,7 +18,7 @@ def env():
     user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
     Order.objects.create(
         code='FOO', event=event,
-        user=user, status=Order.STATUS_PENDING,
+        status=Order.STATUS_PENDING,
         datetime=now(), expires=now() + timedelta(days=10),
         total=0, payment_provider='banktransfer'
     )

src/tests/plugins/banktransfer/test_import.py

@@ -21,13 +21,13 @@ def env():
     EventPermission.objects.create(user=user, event=event)
     o1 = Order.objects.create(
         code='1234S', event=event,
-        user=user, status=Order.STATUS_PENDING,
+        status=Order.STATUS_PENDING,
         datetime=now(), expires=now() + timedelta(days=10),
         total=23, payment_provider='banktransfer'
     )
     o2 = Order.objects.create(
         code='6789Z', event=event,
-        user=user, status=Order.STATUS_CANCELLED,
+        status=Order.STATUS_CANCELLED,
         datetime=now(), expires=now() + timedelta(days=10),
         total=23, payment_provider='banktransfer'
     )

src/tests/plugins/test_pretixdroid.py

@@ -30,8 +30,7 @@ def env():
     var2.values.add(val2)
     ticket = Item.objects.create(event=event, name='Ticket', default_price=23)
     o1 = Order.objects.create(
-        code='FOO', event=event,
-        user=user, status=Order.STATUS_PENDING,
+        code='FOO', event=event, status=Order.STATUS_PENDING,
         datetime=now(), expires=now() + timedelta(days=10),
         total=0, payment_provider='banktransfer'
     )

src/tests/presale/test_account.py

@@ -1,91 +0,0 @@
-import time
-
-from tests.base import BrowserTest
-from tests.presale.test_event import EventTestMixin
-
-from pretix.base.models import User
-
-
-class UserSettingsTest(EventTestMixin, BrowserTest):
-    def setUp(self):
-        super().setUp()
-        self.user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
-        self.driver.implicitly_wait(10)
-        self.driver.get('%s/%s/%s/login' % (self.live_server_url, self.orga.slug, self.event.slug))
-        # open the login accordion
-        self.scroll_and_click(self.driver.find_element_by_css_selector('a[href*=loginForm]'))
-        time.sleep(1)
-        # enter login details
-        self.driver.find_element_by_css_selector('#loginForm input[name=email]').send_keys('dummy@dummy.dummy')
-        self.driver.find_element_by_css_selector('#loginForm input[name=password]').send_keys('dummy')
-        self.scroll_and_click(self.driver.find_element_by_css_selector('#loginForm button.btn-primary'))
-        self.driver.find_element_by_partial_link_text('Your account')
-        self.driver.get('%s/%s/%s/account/settings' % (self.live_server_url, self.orga.slug, self.event.slug))
-
-    def test_set_name(self):
-        self.driver.find_element_by_name("givenname").clear()
-        self.driver.find_element_by_name("familyname").clear()
-        self.driver.find_element_by_name("givenname").send_keys("Peter")
-        self.driver.find_element_by_name("familyname").send_keys("Miller")
-        self.scroll_and_click(self.driver.find_element_by_class_name('btn-save'))
-        self.driver.find_element_by_class_name("alert-success")
-        self.user = User.objects.get(pk=self.user.pk)
-        assert self.user.givenname == 'Peter'
-        assert self.user.familyname == 'Miller'
-
-    def test_change_email_require_password(self):
-        self.driver.find_element_by_name("email").clear()
-        self.driver.find_element_by_name("email").send_keys("foo@example.com")
-        self.scroll_and_click(self.driver.find_element_by_class_name('btn-save'))
-        self.driver.find_element_by_class_name("alert-danger")
-        self.user = User.objects.get(pk=self.user.pk)
-        assert self.user.email == 'dummy@dummy.dummy'
-
-    def test_change_email_success(self):
-        self.driver.find_element_by_name("email").clear()
-        self.driver.find_element_by_name("email").send_keys("foo@example.com")
-        self.driver.find_element_by_name("old_pw").clear()
-        self.driver.find_element_by_name("old_pw").send_keys("dummy")
-        self.scroll_and_click(self.driver.find_element_by_class_name('btn-save'))
-        self.driver.find_element_by_class_name("alert-success")
-        self.user = User.objects.get(pk=self.user.pk)
-        assert self.user.email == 'foo@example.com'
-
-    def test_change_email_no_duplicates(self):
-        User.objects.create_user('foo@example.com', 'foo')
-        self.driver.find_element_by_name("email").clear()
-        self.driver.find_element_by_name("email").send_keys("foo@example.com")
-        self.driver.find_element_by_name("old_pw").clear()
-        self.driver.find_element_by_name("old_pw").send_keys("dummy")
-        self.scroll_and_click(self.driver.find_element_by_class_name('btn-save'))
-        self.driver.find_element_by_class_name("alert-danger")
-        self.user = User.objects.get(pk=self.user.pk)
-        assert self.user.email == 'dummy@dummy.dummy'
-
-    def test_change_password_require_password(self):
-        self.driver.find_element_by_name("new_pw").send_keys("foo")
-        self.driver.find_element_by_name("new_pw_repeat").send_keys("foo")
-        self.scroll_and_click(self.driver.find_element_by_class_name('btn-save'))
-        self.driver.find_element_by_class_name("alert-danger")
-        pw = self.user.password
-        self.user = User.objects.get(pk=self.user.pk)
-        assert self.user.password == pw
-
-    def test_change_password_success(self):
-        self.driver.find_element_by_name("new_pw").send_keys("foo")
-        self.driver.find_element_by_name("new_pw_repeat").send_keys("foo")
-        self.driver.find_element_by_name("old_pw").send_keys("dummy")
-        self.scroll_and_click(self.driver.find_element_by_class_name('btn-save'))
-        self.driver.find_element_by_class_name("alert-success")
-        self.user = User.objects.get(pk=self.user.pk)
-        assert self.user.check_password("foo")
-
-    def test_change_password_require_repeat(self):
-        self.driver.find_element_by_name("new_pw").send_keys("foo")
-        self.driver.find_element_by_name("new_pw_repeat").send_keys("bar")
-        self.driver.find_element_by_name("old_pw").send_keys("dummy")
-        self.scroll_and_click(self.driver.find_element_by_class_name('btn-save'))
-        self.driver.find_element_by_class_name("alert-danger")
-        pw = self.user.password
-        self.user = User.objects.get(pk=self.user.pk)
-        assert self.user.password == pw

src/tests/presale/test_cart.py

@@ -3,6 +3,7 @@ import time
 from datetime import timedelta
 
 from bs4 import BeautifulSoup
+from django.conf import settings
 from django.test import TestCase
 from django.utils.timezone import now
 from tests.base import BrowserTest
@@ -14,7 +15,6 @@ from pretix.base.models import (
 
 
 class CartTestMixin:
-
     def setUp(self):
         super().setUp()
         self.orga = Organizer.objects.create(name='CCC', slug='ccc')
@@ -22,7 +22,6 @@ class CartTestMixin:
             organizer=self.orga, name='30C3', slug='30c3',
             date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc)
         )
-        self.user = User.objects.create_user('dummy@dummy.dummy', 'demo')
         self.category = ItemCategory.objects.create(event=self.event, name="Everything", position=0)
         self.quota_shirts = Quota.objects.create(event=self.event, name='Shirts', size=2)
         self.shirt = Item.objects.create(event=self.event, name='T-Shirt', category=self.category, default_price=12)
@@ -42,72 +41,11 @@ class CartTestMixin:
                                           category=self.category, default_price=23)
         self.quota_tickets.items.add(self.ticket)
 
-
-class CartBrowserTest(CartTestMixin, BrowserTest):
-
-    def test_not_logged_in(self):
-        self.driver.get('%s/%s/%s/' % (self.live_server_url, self.orga.slug, self.event.slug))
-        # add the entry ticket to cart
-        self.driver.find_element_by_css_selector('input[type=number][name=item_%s]' % self.ticket.identity).send_keys('1')
-        self.scroll_and_click(self.driver.find_element_by_css_selector('.checkout-button-row button'))
-        # should redirect to login page
-        self.driver.find_element_by_name('email')
-
-    def test_simple_login(self):
-        self.driver.get('%s/%s/%s/' % (self.live_server_url, self.orga.slug, self.event.slug))
-        # add the entry ticket to cart
-        self.driver.find_element_by_css_selector('input[type=number][name=item_%s]' % self.ticket.identity).send_keys('1')
-        self.scroll_and_click(self.driver.find_element_by_css_selector('.checkout-button-row button'))
-        # should redirect to login page
-        # open the login accordion
-        self.scroll_and_click(self.driver.find_element_by_css_selector('a[href*=loginForm]'))
-        time.sleep(1)
-        # enter login details
-        self.driver.find_element_by_css_selector('#loginForm input[name=email]').send_keys('dummy@dummy.dummy')
-        self.driver.find_element_by_css_selector('#loginForm input[name=password]').send_keys('demo')
-        self.scroll_and_click(self.driver.find_element_by_css_selector('#loginForm button.btn-primary'))
-        # should display our ticket
-        self.assertIn('Early-bird', self.driver.find_element_by_css_selector('.cart-row:first-child').text)
-
-    def test_simple_login_as_guest(self):
-        self.driver.get('%s/%s/%s/' % (self.live_server_url, self.orga.slug, self.event.slug))
-        # add the entry ticket to cart
-        self.driver.find_element_by_css_selector('input[type=number][name=item_%s]' % self.ticket.identity).send_keys('1')
-        self.scroll_and_click(self.driver.find_element_by_css_selector('.checkout-button-row button'))
-        # should redirect to login page
-        # open the login accordion
-        self.scroll_and_click(self.driver.find_element_by_css_selector('a[href*=guestForm]'))
-        time.sleep(1)
-        # enter login details
-        self.driver.find_element_by_css_selector('#guestForm input[name=email]').send_keys('dummy@dummy.dummy')
-        self.scroll_and_click(self.driver.find_element_by_css_selector('#guestForm button.btn-primary'))
-        # should display our ticket
-        self.assertIn('Early-bird', self.driver.find_element_by_css_selector('.cart-row:first-child').text)
-
-    def test_registration(self):
-        self.driver.get('%s/%s/%s/' % (self.live_server_url, self.orga.slug, self.event.slug))
-        # add the entry ticket to cart
-        self.driver.find_element_by_css_selector('input[type=number][name=item_%s]' % self.ticket.identity).send_keys('1')
-        self.scroll_and_click(self.driver.find_element_by_css_selector('.checkout-button-row button'))
-        # should redirect to login page
-        # open the login accordion
-        self.scroll_and_click(self.driver.find_element_by_css_selector('a[href*=registrationForm]'))
-        time.sleep(1)
-        # enter login details
-        self.driver.find_element_by_css_selector('#registrationForm input[name=email]').send_keys('demo@example.com')
-        self.driver.find_element_by_css_selector('#registrationForm input[name=password]').send_keys('demo')
-        self.driver.find_element_by_css_selector('#registrationForm input[name=password_repeat]').send_keys('demo')
-        self.scroll_and_click(self.driver.find_element_by_css_selector('#registrationForm button.btn-primary'))
-        # should display our ticket
-        self.assertIn('Early-bird', self.driver.find_element_by_css_selector('.cart-row:first-child').text)
+        self.client.get('/%s/%s/' % (self.orga.slug, self.event.slug))
+        self.session_key = self.client.cookies.get(settings.SESSION_COOKIE_NAME).value
 
 
 class CartTest(CartTestMixin, TestCase):
-
-    def setUp(self):
-        super().setUp()
-        self.assertTrue(self.client.login(email='dummy@dummy.dummy', password='demo'))
-
     def test_simple(self):
         response = self.client.post('/%s/%s/cart/add' % (self.orga.slug, self.event.slug), {
             'item_' + self.ticket.identity: '1'
@@ -119,7 +57,7 @@ class CartTest(CartTestMixin, TestCase):
         self.assertIn('1', doc.select('.cart .cart-row')[0].select('.count')[0].text)
         self.assertIn('23', doc.select('.cart .cart-row')[0].select('.price')[0].text)
         self.assertIn('23', doc.select('.cart .cart-row')[0].select('.price')[1].text)
-        objs = list(CartPosition.objects.filter(user=self.user, event=self.event))
+        objs = list(CartPosition.objects.filter(session=self.session_key, event=self.event))
         self.assertEqual(len(objs), 1)
         self.assertEqual(objs[0].item, self.ticket)
         self.assertIsNone(objs[0].variation)
@@ -137,7 +75,7 @@ class CartTest(CartTestMixin, TestCase):
         self.assertIn('1', doc.select('.cart .cart-row')[0].select('.count')[0].text)
         self.assertIn('14', doc.select('.cart .cart-row')[0].select('.price')[0].text)
         self.assertIn('14', doc.select('.cart .cart-row')[0].select('.price')[1].text)
-        objs = list(CartPosition.objects.filter(user=self.user, event=self.event))
+        objs = list(CartPosition.objects.filter(session=self.session_key, event=self.event))
         self.assertEqual(len(objs), 1)
         self.assertEqual(objs[0].item, self.shirt)
         self.assertEqual(objs[0].variation, self.shirt_red)
@@ -154,7 +92,7 @@ class CartTest(CartTestMixin, TestCase):
         self.assertIn('2', doc.select('.cart .cart-row')[0].select('.count')[0].text)
         self.assertIn('23', doc.select('.cart .cart-row')[0].select('.price')[0].text)
         self.assertIn('46', doc.select('.cart .cart-row')[0].select('.price')[1].text)
-        objs = list(CartPosition.objects.filter(user=self.user, event=self.event))
+        objs = list(CartPosition.objects.filter(session=self.session_key, event=self.event))
         self.assertEqual(len(objs), 2)
         for obj in objs:
             self.assertEqual(obj.item, self.ticket)
@@ -171,7 +109,7 @@ class CartTest(CartTestMixin, TestCase):
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('Early-bird', doc.select('.cart')[0].text)
         self.assertIn('Shirt', doc.select('.cart')[0].text)
-        objs = list(CartPosition.objects.filter(user=self.user, event=self.event))
+        objs = list(CartPosition.objects.filter(session=self.session_key, event=self.event))
         self.assertEqual(len(objs), 3)
         self.assertIn(self.shirt, [obj.item for obj in objs])
         self.assertIn(self.shirt_red, [obj.variation for obj in objs])
@@ -185,7 +123,7 @@ class CartTest(CartTestMixin, TestCase):
                              target_status_code=200)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('numbers only', doc.select('.alert-danger')[0].text)
-        self.assertFalse(CartPosition.objects.filter(user=self.user, event=self.event).exists())
+        self.assertFalse(CartPosition.objects.filter(session=self.session_key, event=self.event).exists())
 
         response = self.client.post('/%s/%s/cart/add' % (self.orga.slug, self.event.slug), {
         }, follow=True)
@@ -193,7 +131,7 @@ class CartTest(CartTestMixin, TestCase):
                              target_status_code=200)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('did not select any products', doc.select('.alert-warning')[0].text)
-        self.assertFalse(CartPosition.objects.filter(user=self.user, event=self.event).exists())
+        self.assertFalse(CartPosition.objects.filter(session=self.session_key, event=self.event).exists())
 
     def test_wrong_event(self):
         event2 = Event.objects.create(
@@ -208,7 +146,7 @@ class CartTest(CartTestMixin, TestCase):
                              target_status_code=200)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('not available', doc.select('.alert-danger')[0].text)
-        self.assertFalse(CartPosition.objects.filter(user=self.user, event=self.event).exists())
+        self.assertFalse(CartPosition.objects.filter(session=self.session_key, event=self.event).exists())
 
     def test_no_quota(self):
         shirt2 = Item.objects.create(event=self.event, name='T-Shirt', default_price=12)
@@ -219,11 +157,11 @@ class CartTest(CartTestMixin, TestCase):
                              target_status_code=200)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('no longer available', doc.select('.alert-danger')[0].text)
-        self.assertFalse(CartPosition.objects.filter(user=self.user, event=self.event).exists())
+        self.assertFalse(CartPosition.objects.filter(session=self.session_key, event=self.event).exists())
 
     def test_max_items(self):
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         self.event.settings.max_items_per_order = 5
@@ -234,7 +172,7 @@ class CartTest(CartTestMixin, TestCase):
                              target_status_code=200)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('more than', doc.select('.alert-danger')[0].text)
-        self.assertEqual(CartPosition.objects.filter(user=self.user, event=self.event).count(), 1)
+        self.assertEqual(CartPosition.objects.filter(session=self.session_key, event=self.event).count(), 1)
 
     def test_quota_full(self):
         self.quota_tickets.size = 0
@@ -246,7 +184,7 @@ class CartTest(CartTestMixin, TestCase):
                              target_status_code=200)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('no longer available', doc.select('.alert-danger')[0].text)
-        self.assertFalse(CartPosition.objects.filter(user=self.user, event=self.event).exists())
+        self.assertFalse(CartPosition.objects.filter(session=self.session_key, event=self.event).exists())
 
     def test_quota_partly(self):
         self.quota_tickets.size = 1
@@ -262,7 +200,7 @@ class CartTest(CartTestMixin, TestCase):
         self.assertIn('1', doc.select('.cart .cart-row')[0].select('.count')[0].text)
         self.assertIn('23', doc.select('.cart .cart-row')[0].select('.price')[0].text)
         self.assertIn('23', doc.select('.cart .cart-row')[0].select('.price')[1].text)
-        objs = list(CartPosition.objects.filter(user=self.user, event=self.event))
+        objs = list(CartPosition.objects.filter(session=self.session_key, event=self.event))
         self.assertEqual(len(objs), 1)
         self.assertEqual(objs[0].item, self.ticket)
         self.assertIsNone(objs[0].variation)
@@ -270,7 +208,7 @@ class CartTest(CartTestMixin, TestCase):
 
     def test_renew_in_time(self):
         cp = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         self.client.post('/%s/%s/cart/add' % (self.orga.slug, self.event.slug), {
@@ -280,12 +218,12 @@ class CartTest(CartTestMixin, TestCase):
 
     def test_renew_expired_successfully(self):
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() - timedelta(minutes=10)
         )
         self.client.post('/%s/%s/cart/add' % (self.orga.slug, self.event.slug), {
         }, follow=True)
-        objs = list(CartPosition.objects.current.filter(user=self.user, event=self.event))
+        objs = list(CartPosition.objects.current.filter(session=self.session_key, event=self.event))
         self.assertEqual(len(objs), 1)
         self.assertEqual(objs[0].item, self.ticket)
         self.assertIsNone(objs[0].variation)
@@ -297,7 +235,7 @@ class CartTest(CartTestMixin, TestCase):
         Currently fails. See: https://github.com/pretix/pretix/issues/20
         """
         cr1 = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() - timedelta(minutes=10)
         )
         q1 = Question.objects.create(
@@ -310,7 +248,7 @@ class CartTest(CartTestMixin, TestCase):
         ))
         self.client.post('/%s/%s/cart/add' % (self.orga.slug, self.event.slug), {
         }, follow=True)
-        objs = list(CartPosition.objects.current.filter(user=self.user, event=self.event))
+        objs = list(CartPosition.objects.current.filter(session=self.session_key, event=self.event))
         self.assertEqual(len(objs), 1)
         self.assertEqual(objs[0].answers.get(question=q1).answer, '23')
 
@@ -318,14 +256,14 @@ class CartTest(CartTestMixin, TestCase):
         self.quota_tickets.size = 0
         self.quota_tickets.save()
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() - timedelta(minutes=10)
         )
         response = self.client.post('/%s/%s/cart/add' % (self.orga.slug, self.event.slug), {
         }, follow=True)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('no longer available', doc.select('.alert-danger')[0].text)
-        self.assertFalse(CartPosition.objects.current.filter(user=self.user, event=self.event).exists())
+        self.assertFalse(CartPosition.objects.current.filter(session=self.session_key, event=self.event).exists())
 
     def test_restriction_ok(self):
         self.event.plugins = 'tests.testdummy'
@@ -336,7 +274,7 @@ class CartTest(CartTestMixin, TestCase):
         }, follow=True)
         self.assertRedirects(response, '/%s/%s/' % (self.orga.slug, self.event.slug),
                              target_status_code=200)
-        objs = list(CartPosition.objects.current.filter(user=self.user, event=self.event))
+        objs = list(CartPosition.objects.current.filter(session=self.session_key, event=self.event))
         self.assertEqual(len(objs), 1)
         self.assertEqual(objs[0].item, self.ticket)
         self.assertIsNone(objs[0].variation)
@@ -353,11 +291,11 @@ class CartTest(CartTestMixin, TestCase):
                              target_status_code=200)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('no longer available', doc.select('.alert-danger')[0].text)
-        self.assertFalse(CartPosition.objects.filter(user=self.user, event=self.event).exists())
+        self.assertFalse(CartPosition.objects.filter(session=self.session_key, event=self.event).exists())
 
     def test_remove_simple(self):
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         response = self.client.post('/%s/%s/cart/remove' % (self.orga.slug, self.event.slug), {
@@ -365,11 +303,11 @@ class CartTest(CartTestMixin, TestCase):
         }, follow=True)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('updated', doc.select('.alert-success')[0].text)
-        self.assertFalse(CartPosition.objects.current.filter(user=self.user, event=self.event).exists())
+        self.assertFalse(CartPosition.objects.current.filter(session=self.session_key, event=self.event).exists())
 
     def test_remove_variation(self):
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.shirt, variation=self.shirt_red,
+            event=self.event, session=self.session_key, item=self.shirt, variation=self.shirt_red,
             price=14, expires=now() + timedelta(minutes=10)
         )
         response = self.client.post('/%s/%s/cart/remove' % (self.orga.slug, self.event.slug), {
@@ -377,15 +315,15 @@ class CartTest(CartTestMixin, TestCase):
         }, follow=True)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('updated', doc.select('.alert-success')[0].text)
-        self.assertFalse(CartPosition.objects.current.filter(user=self.user, event=self.event).exists())
+        self.assertFalse(CartPosition.objects.current.filter(session=self.session_key, event=self.event).exists())
 
     def test_remove_one_of_multiple(self):
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         response = self.client.post('/%s/%s/cart/remove' % (self.orga.slug, self.event.slug), {
@@ -393,15 +331,15 @@ class CartTest(CartTestMixin, TestCase):
         }, follow=True)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('updated', doc.select('.alert-success')[0].text)
-        self.assertEqual(CartPosition.objects.current.filter(user=self.user, event=self.event).count(), 1)
+        self.assertEqual(CartPosition.objects.current.filter(session=self.session_key, event=self.event).count(), 1)
 
     def test_remove_multiple(self):
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         response = self.client.post('/%s/%s/cart/remove' % (self.orga.slug, self.event.slug), {
@@ -409,15 +347,15 @@ class CartTest(CartTestMixin, TestCase):
         }, follow=True)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('updated', doc.select('.alert-success')[0].text)
-        self.assertFalse(CartPosition.objects.current.filter(user=self.user, event=self.event).exists())
+        self.assertFalse(CartPosition.objects.current.filter(session=self.session_key, event=self.event).exists())
 
     def test_remove_most_expensive(self):
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=20, expires=now() + timedelta(minutes=10)
         )
         response = self.client.post('/%s/%s/cart/remove' % (self.orga.slug, self.event.slug), {
@@ -425,7 +363,7 @@ class CartTest(CartTestMixin, TestCase):
         }, follow=True)
         doc = BeautifulSoup(response.rendered_content)
         self.assertIn('updated', doc.select('.alert-success')[0].text)
-        objs = list(CartPosition.objects.current.filter(user=self.user, event=self.event))
+        objs = list(CartPosition.objects.current.filter(session=self.session_key, event=self.event))
         self.assertEqual(len(objs), 1)
         self.assertEqual(objs[0].item, self.ticket)
         self.assertIsNone(objs[0].variation)

src/tests/presale/test_checkout.py

@@ -2,17 +2,17 @@ import datetime
 from datetime import timedelta
 
 from bs4 import BeautifulSoup
+from django.conf import settings
 from django.test import TestCase
 from django.utils.timezone import now
 
 from pretix.base.models import (
     CartPosition, Event, Item, ItemCategory, Order, OrderPosition, Organizer,
-    Question, Quota, User,
+    Question, Quota,
 )
 
 
 class CheckoutTestCase(TestCase):
-
     def setUp(self):
         super().setUp()
         self.orga = Organizer.objects.create(name='CCC', slug='ccc')
@@ -21,16 +21,17 @@ class CheckoutTestCase(TestCase):
             date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc),
             plugins='pretix.plugins.stripe,pretix.plugins.banktransfer'
         )
-        self.user = User.objects.create_user('dummy@dummy.dummy', 'demo')
         self.category = ItemCategory.objects.create(event=self.event, name="Everything", position=0)
         self.quota_tickets = Quota.objects.create(event=self.event, name='Tickets', size=5)
         self.ticket = Item.objects.create(event=self.event, name='Early-bird ticket',
                                           category=self.category, default_price=23, admission=True)
         self.quota_tickets.items.add(self.ticket)
-        self.assertTrue(self.client.login(email='dummy@dummy.dummy', password='demo'))
         self.event.settings.set('attendee_names_asked', False)
         self.event.settings.set('payment_banktransfer__enabled', True)
 
+        self.client.get('/%s/%s/' % (self.orga.slug, self.event.slug))
+        self.session_key = self.client.cookies.get(settings.SESSION_COOKIE_NAME).value
+
     def test_empty_cart(self):
         response = self.client.get('/%s/%s/checkout' % (self.orga.slug, self.event.slug), follow=True)
         self.assertRedirects(response, '/%s/%s/' % (self.orga.slug, self.event.slug),
@@ -38,11 +39,11 @@ class CheckoutTestCase(TestCase):
 
     def test_no_questions(self):
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=20, expires=now() + timedelta(minutes=10)
         )
         response = self.client.get('/%s/%s/checkout' % (self.orga.slug, self.event.slug), follow=True)
@@ -61,11 +62,11 @@ class CheckoutTestCase(TestCase):
         self.ticket.questions.add(q1)
         self.ticket.questions.add(q2)
         cr1 = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         cr2 = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=20, expires=now() + timedelta(minutes=10)
         )
         response = self.client.get('/%s/%s/checkout' % (self.orga.slug, self.event.slug), follow=True)
@@ -107,7 +108,7 @@ class CheckoutTestCase(TestCase):
         self.event.settings.set('attendee_names_asked', True)
         self.event.settings.set('attendee_names_required', True)
         cr1 = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         response = self.client.get('/%s/%s/checkout' % (self.orga.slug, self.event.slug), follow=True)
@@ -135,7 +136,7 @@ class CheckoutTestCase(TestCase):
         self.event.settings.set('attendee_names_asked', True)
         self.event.settings.set('attendee_names_required', False)
         cr1 = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         response = self.client.get('/%s/%s/checkout' % (self.orga.slug, self.event.slug), follow=True)
@@ -157,7 +158,7 @@ class CheckoutTestCase(TestCase):
         self.event.settings.set('payment_stripe__enabled', True)
         self.event.settings.set('payment_banktransfer__enabled', True)
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         response = self.client.get('/%s/%s/checkout/payment' % (self.orga.slug, self.event.slug), follow=True)
@@ -177,7 +178,7 @@ class CheckoutTestCase(TestCase):
         self.event.settings.set('payment_stripe__enabled', True)
         self.event.settings.set('payment_banktransfer__enabled', True)
         cr1 = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
 
@@ -220,7 +221,7 @@ class CheckoutTestCase(TestCase):
 
     def test_confirm_in_time(self):
         cr1 = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() + timedelta(minutes=10)
         )
         self._set_session('payment', 'banktransfer')
@@ -229,12 +230,12 @@ class CheckoutTestCase(TestCase):
         doc = BeautifulSoup(response.rendered_content)
         self.assertEqual(len(doc.select(".thank-you")), 1)
         self.assertFalse(CartPosition.objects.current.filter(identity=cr1.identity).exists())
-        self.assertEqual(len(Order.objects.current.filter(user=self.user)), 1)
-        self.assertEqual(len(OrderPosition.objects.current.filter(order__user=self.user)), 1)
+        self.assertEqual(Order.objects.current.count(), 1)
+        self.assertEqual(OrderPosition.objects.current.count(), 1)
 
     def test_confirm_expired_available(self):
         cr1 = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() - timedelta(minutes=10)
         )
         self._set_session('payment', 'banktransfer')
@@ -243,15 +244,15 @@ class CheckoutTestCase(TestCase):
         doc = BeautifulSoup(response.rendered_content)
         self.assertEqual(len(doc.select(".thank-you")), 1)
         self.assertFalse(CartPosition.objects.current.filter(identity=cr1.identity).exists())
-        self.assertEqual(len(Order.objects.current.filter(user=self.user)), 1)
-        self.assertEqual(len(OrderPosition.objects.current.filter(order__user=self.user)), 1)
+        self.assertEqual(Order.objects.current.count(), 1)
+        self.assertEqual(OrderPosition.objects.current.count(), 1)
 
     def test_confirm_price_changed(self):
         self.ticket = self.ticket.clone()
         self.ticket.default_price = 24
         self.ticket.save()
         cr1 = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() - timedelta(minutes=10)
         )
         self._set_session('payment', 'banktransfer')
@@ -266,11 +267,11 @@ class CheckoutTestCase(TestCase):
         self.quota_tickets.size = 1
         self.quota_tickets.save()
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() - timedelta(minutes=10)
         )
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() - timedelta(minutes=10)
         )
         self._set_session('payment', 'banktransfer')
@@ -278,14 +279,14 @@ class CheckoutTestCase(TestCase):
         response = self.client.post('/%s/%s/checkout/confirm' % (self.orga.slug, self.event.slug), follow=True)
         doc = BeautifulSoup(response.rendered_content)
         self.assertEqual(len(doc.select(".alert-danger")), 1)
-        self.assertEqual(CartPosition.objects.current.filter(user=self.user).count(), 1)
+        self.assertEqual(CartPosition.objects.current.filter(session=self.session_key).count(), 1)
 
     def test_confirm_inactive(self):
         self.ticket = self.ticket.clone()
         self.ticket.active = False
         self.ticket.save()
         cr1 = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() - timedelta(minutes=10)
         )
         self._set_session('payment', 'banktransfer')
@@ -299,7 +300,7 @@ class CheckoutTestCase(TestCase):
         self.quota_tickets.size = 0
         self.quota_tickets.save()
         cr1 = CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() - timedelta(minutes=10)
         )
         self._set_session('payment', 'banktransfer')
@@ -312,7 +313,7 @@ class CheckoutTestCase(TestCase):
     def test_confirm_completely_unavailable(self):
         self.quota_tickets.items.remove(self.ticket)
         CartPosition.objects.create(
-            event=self.event, user=self.user, item=self.ticket,
+            event=self.event, session=self.session_key, item=self.ticket,
             price=23, expires=now() - timedelta(minutes=10)
         )
         self._set_session('payment', 'banktransfer')

src/tests/presale/test_event.py

@@ -142,12 +142,7 @@ class ItemDisplayTest(EventTestMixin, BrowserTest):
 
 class DeadlineTest(EventTestMixin, TestCase):
 
-    def setUp(self):
-        super().setUp()
-        self.user = User.objects.create_user('demo@demo.dummy', 'demo')
-
     def test_not_yet_started(self):
-        self.assertTrue(self.client.login(email='demo@demo.dummy', password='demo'))
         self.event.presale_start = now() + datetime.timedelta(days=1)
         self.event.save()
         response = self.client.get(
@@ -164,7 +159,6 @@ class DeadlineTest(EventTestMixin, TestCase):
         self.assertIn('not yet started', response.rendered_content)
 
     def test_over(self):
-        self.assertTrue(self.client.login(email='demo@demo.dummy', password='demo'))
         self.event.presale_end = now() - datetime.timedelta(days=1)
         self.event.save()
         response = self.client.get(

src/tests/presale/test_event_auth.py

@@ -1,215 +0,0 @@
-from datetime import date, timedelta
-
-from django.conf import settings
-from django.contrib.auth.tokens import (
-    PasswordResetTokenGenerator, default_token_generator,
-)
-from django.core import mail as djmail
-from django.test import TestCase
-from tests.presale.test_event import EventTestMixin
-
-from pretix.base.models import User
-
-
-class LoginTest(EventTestMixin, TestCase):
-    def setUp(self):
-        super().setUp()
-        self.user = User.objects.create_user('demo@demo.dummy', 'demo')
-
-    def test_login_invalid(self):
-        response = self.client.post(
-            '/%s/%s/login' % (self.orga.slug, self.event.slug),
-            {
-                'form': 'login',
-                'email': 'demo@demo.foo',
-                'password': 'bar'
-            }
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertIn('alert-danger', response.rendered_content)
-
-    def test_login_valid(self):
-        response = self.client.post(
-            '/%s/%s/login' % (self.orga.slug, self.event.slug),
-            {
-                'form': 'login',
-                'email': 'demo@demo.dummy',
-                'password': 'demo'
-            }
-        )
-        self.assertEqual(response.status_code, 302)
-
-    def test_login_already_logged_in(self):
-        self.assertTrue(self.client.login(email='demo@demo.dummy', password='demo'))
-        response = self.client.get(
-            '/%s/%s/login' % (self.orga.slug, self.event.slug),
-        )
-        self.assertEqual(response.status_code, 302)
-
-    def test_logout(self):
-        self.assertTrue(self.client.login(email='demo@demo.dummy', password='demo'))
-        response = self.client.get(
-            '/%s/%s/logout' % (self.orga.slug, self.event.slug),
-        )
-        self.assertEqual(response.status_code, 302)
-        response = self.client.get(
-            '/%s/%s/login' % (self.orga.slug, self.event.slug),
-        )
-        self.assertEqual(response.status_code, 200)
-
-
-class RegistrationFormTest(EventTestMixin, TestCase):
-    def test_different_passwords(self):
-        response = self.client.post('/%s/%s/login' % (self.orga.slug, self.event.slug), {
-            'form': 'registration',
-            'email': 'dummy@dummy.dummy',
-            'password': 'foo',
-            'password_repeat': 'foobar'
-        })
-        self.assertEqual(response.status_code, 200)
-
-    def test_email_duplicate(self):
-        self.user = User.objects.create_user('dummy@dummy.dummy', 'dummy')
-        response = self.client.post('/%s/%s/login' % (self.orga.slug, self.event.slug), {
-            'form': 'registration',
-            'email': 'dummy@dummy.dummy',
-            'password': 'foo',
-            'password_repeat': 'foo'
-        })
-        self.assertEqual(response.status_code, 200)
-
-    def test_success(self):
-        response = self.client.post('/%s/%s/login' % (self.orga.slug, self.event.slug), {
-            'form': 'registration',
-            'email': 'dummy@dummy.dummy',
-            'password': 'foo',
-            'password_repeat': 'foo'
-        })
-        self.assertEqual(response.status_code, 302)
-
-
-class PasswordRecoveryFormTest(EventTestMixin, TestCase):
-    def setUp(self):
-        super().setUp()
-        self.user = User.objects.create_user('demo@demo.dummy', 'demo')
-
-    def test_unknown(self):
-        response = self.client.post('/%s/%s/forgot' % (self.orga.slug, self.event.slug), {
-            'email': 'dummy@dummy.dummy',
-        })
-        self.assertEqual(response.status_code, 200)
-
-    def test_email_sent(self):
-        djmail.outbox = []
-
-        response = self.client.post('/%s/%s/forgot' % (self.orga.slug, self.event.slug), {
-            'email': 'demo@demo.dummy',
-        })
-        self.assertEqual(response.status_code, 302)
-
-        assert len(djmail.outbox) == 1
-        assert djmail.outbox[0].to == [self.user.email]
-        assert "recover?id=%d&token=" % self.user.id in djmail.outbox[0].body
-
-    def test_recovery_unknown_user(self):
-        response = self.client.get('/%s/%s/forgot/recover?id=0&token=foo' % (self.orga.slug, self.event.slug))
-        self.assertEqual(response.status_code, 302)
-        response = self.client.post(
-            '/%s/%s/forgot/recover?id=0&token=foo' % (self.orga.slug, self.event.slug),
-            {
-                'password': 'foobar',
-                'password_repeat': 'foobar'
-            }
-        )
-        self.assertEqual(response.status_code, 302)
-        self.user = User.objects.get(id=self.user.id)
-        self.assertTrue(self.user.check_password('demo'))
-
-    def test_recovery_invalid_token(self):
-        response = self.client.get(
-            '/%s/%s/forgot/recover?id=%d&token=foo' % (self.orga.slug, self.event.slug, self.user.id)
-        )
-        self.assertEqual(response.status_code, 302)
-        response = self.client.post(
-            '/%s/%s/forgot/recover?id=%d&token=foo' % (self.orga.slug, self.event.slug, self.user.id),
-            {
-                'password': 'foobar',
-                'password_repeat': 'foobar'
-            }
-        )
-        self.assertEqual(response.status_code, 302)
-        self.user = User.objects.get(id=self.user.id)
-        self.assertTrue(self.user.check_password('demo'))
-
-    def test_recovery_expired_token(self):
-        class Mocked(PasswordResetTokenGenerator):
-            def _today(self):
-                return date.today() - timedelta(settings.PASSWORD_RESET_TIMEOUT_DAYS + 1)
-
-        generator = Mocked()
-        token = generator.make_token(self.user)
-        response = self.client.get(
-            '/%s/%s/forgot/recover?id=%d&token=%s' % (self.orga.slug, self.event.slug, self.user.id, token)
-        )
-        self.assertEqual(response.status_code, 302)
-        response = self.client.post(
-            '/%s/%s/forgot/recover?id=%d&token=%s' % (self.orga.slug, self.event.slug, self.user.id, token),
-            {
-                'password': 'foobar',
-                'password_repeat': 'foobar'
-            }
-        )
-        self.assertEqual(response.status_code, 302)
-        self.user = User.objects.get(id=self.user.id)
-        self.assertTrue(self.user.check_password('demo'))
-
-    def test_recovery_valid_token_success(self):
-        token = default_token_generator.make_token(self.user)
-        response = self.client.get(
-            '/%s/%s/forgot/recover?id=%d&token=%s' % (self.orga.slug, self.event.slug, self.user.id, token)
-        )
-        self.assertEqual(response.status_code, 200)
-        response = self.client.post(
-            '/%s/%s/forgot/recover?id=%d&token=%s' % (self.orga.slug, self.event.slug, self.user.id, token),
-            {
-                'password': 'foobar',
-                'password_repeat': 'foobar'
-            }
-        )
-        self.assertEqual(response.status_code, 302)
-        self.user = User.objects.get(id=self.user.id)
-        self.assertTrue(self.user.check_password('foobar'))
-
-    def test_recovery_valid_token_empty_passwords(self):
-        token = default_token_generator.make_token(self.user)
-        response = self.client.get(
-            '/%s/%s/forgot/recover?id=%d&token=%s' % (self.orga.slug, self.event.slug, self.user.id, token)
-        )
-        self.assertEqual(response.status_code, 200)
-        response = self.client.post(
-            '/%s/%s/forgot/recover?id=%d&token=%s' % (self.orga.slug, self.event.slug, self.user.id, token),
-            {
-                'password': '',
-                'password_repeat': 'foobar'
-            }
-        )
-        self.assertEqual(response.status_code, 200)
-        self.user = User.objects.get(id=self.user.id)
-        self.assertTrue(self.user.check_password('demo'))
-
-    def test_recovery_valid_token_different_passwords(self):
-        token = default_token_generator.make_token(self.user)
-        response = self.client.get(
-            '/%s/%s/forgot/recover?id=%d&token=%s' % (self.orga.slug, self.event.slug, self.user.id, token)
-        )
-        self.assertEqual(response.status_code, 200)
-        response = self.client.post(
-            '/%s/%s/forgot/recover?id=%d&token=%s' % (self.orga.slug, self.event.slug, self.user.id, token),
-            {
-                'password': 'foo',
-                'password_repeat': 'foobar'
-            }
-        )
-        self.assertEqual(response.status_code, 200)
-        self.user = User.objects.get(id=self.user.id)
-        self.assertTrue(self.user.check_password('demo'))

src/tests/presale/test_orders.py

@@ -12,7 +12,6 @@ from pretix.base.models import (
 
 
 class OrdersTest(TestCase):
-
     def setUp(self):
         super().setUp()
         self.orga = Organizer.objects.create(name='CCC', slug='ccc')
@@ -23,9 +22,6 @@ class OrdersTest(TestCase):
         )
         self.event.settings.set('payment_banktransfer__enabled', True)
         self.event.settings.set('ticketoutput_testdummy__enabled', True)
-        self.user = User.objects.create_user('dummy@dummy.dummy', 'foo')
-        self.user2 = User.objects.create_user('bar@dummy.dummy', 'foo')
-        self.assertTrue(self.client.login(email='dummy@dummy.dummy', password='foo'))
 
         self.category = ItemCategory.objects.create(event=self.event, name="Everything", position=0)
         self.quota_shirts = Quota.objects.create(event=self.event, name='Shirts', size=2)
@@ -54,7 +50,7 @@ class OrdersTest(TestCase):
         self.order = Order.objects.create(
             status=Order.STATUS_PENDING,
             event=self.event,
-            user=self.user,
+            email='admin@localhost',
             datetime=now() - datetime.timedelta(days=3),
             expires=now() + datetime.timedelta(days=11),
             total=Decimal("23"),
@@ -70,68 +66,57 @@ class OrdersTest(TestCase):
         self.not_my_order = Order.objects.create(
             status=Order.STATUS_PENDING,
             event=self.event,
-            user=self.user2,
+            email='user@localhost',
             datetime=now() - datetime.timedelta(days=3),
             expires=now() + datetime.timedelta(days=11),
             total=Decimal("23")
         )
 
-    def test_orders_list(self):
-        response = self.client.get(
-            '/%s/%s/orders' % (self.orga.slug, self.event.slug)
-        )
-        doc = BeautifulSoup(response.rendered_content)
-        rows = doc.select("table tbody tr")
-        self.assertEqual(len(rows), 1)
-        row = rows[0]
-        self.assertIn(self.order.code, row.text)
-        self.assertIn(str(self.order.total), row.text)
-
     def test_unknown_order(self):
         response = self.client.get(
-            '/%s/%s/order/ABCDE/' % (self.orga.slug, self.event.slug)
+            '/%s/%s/order/ABCDE/123/' % (self.orga.slug, self.event.slug)
         )
         assert response.status_code == 404
         response = self.client.get(
-            '/%s/%s/order/%s/' % (self.orga.slug, self.event.slug, self.not_my_order.code)
+            '/%s/%s/order/%s/123/' % (self.orga.slug, self.event.slug, self.not_my_order.code)
         )
         assert response.status_code == 404
         response = self.client.get(
-            '/%s/%s/order/ABCDE/pay' % (self.orga.slug, self.event.slug)
+            '/%s/%s/order/ABCDE/123/pay' % (self.orga.slug, self.event.slug)
         )
         assert response.status_code == 404
         response = self.client.get(
-            '/%s/%s/order/%s/pay' % (self.orga.slug, self.event.slug, self.not_my_order.code)
+            '/%s/%s/order/%s/123/pay' % (self.orga.slug, self.event.slug, self.not_my_order.code)
         )
         assert response.status_code == 404
         response = self.client.get(
-            '/%s/%s/order/ABCDE/pay/confirm' % (self.orga.slug, self.event.slug)
+            '/%s/%s/order/ABCDE/123/pay/confirm' % (self.orga.slug, self.event.slug)
         )
         assert response.status_code == 404
         response = self.client.get(
-            '/%s/%s/order/%s/pay/confirm' % (self.orga.slug, self.event.slug, self.not_my_order.code)
+            '/%s/%s/order/%s/123/pay/confirm' % (self.orga.slug, self.event.slug, self.not_my_order.code)
         )
         assert response.status_code == 404
         response = self.client.get(
-            '/%s/%s/order/ABCDE/modify' % (self.orga.slug, self.event.slug)
+            '/%s/%s/order/ABCDE/123/modify' % (self.orga.slug, self.event.slug)
         )
         assert response.status_code == 404
         response = self.client.get(
-            '/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.not_my_order.code)
+            '/%s/%s/order/%s/123/modify' % (self.orga.slug, self.event.slug, self.not_my_order.code)
         )
         assert response.status_code == 404
         response = self.client.get(
-            '/%s/%s/order/ABCDE/cancel' % (self.orga.slug, self.event.slug)
+            '/%s/%s/order/ABCDE/123/cancel' % (self.orga.slug, self.event.slug)
         )
         assert response.status_code == 404
         response = self.client.get(
-            '/%s/%s/order/%s/cancel' % (self.orga.slug, self.event.slug, self.not_my_order.code)
+            '/%s/%s/order/%s/123/cancel' % (self.orga.slug, self.event.slug, self.not_my_order.code)
         )
         assert response.status_code == 404
 
     def test_orders_detail(self):
         response = self.client.get(
-            '/%s/%s/order/%s/' % (self.orga.slug, self.event.slug, self.order.code)
+            '/%s/%s/order/%s/%s/' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret)
         )
         assert response.status_code == 200
         doc = BeautifulSoup(response.rendered_content)
@@ -142,7 +127,7 @@ class OrdersTest(TestCase):
         self.order.status = Order.STATUS_REFUNDED
         self.order.save()
         self.client.get(
-            '/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.order.code)
+            '/%s/%s/order/%s/%s/modify' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret)
         )
         self.order = Order.objects.current.get(identity=self.order.identity)
         assert self.order.status == Order.STATUS_REFUNDED
@@ -151,15 +136,19 @@ class OrdersTest(TestCase):
         self.event.settings.set('attendee_names_asked', True)
         self.event.settings.set('attendee_names_required', False)
 
-        response = self.client.get('/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.order.code))
+        response = self.client.get(
+            '/%s/%s/order/%s/%s/modify' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret))
         doc = BeautifulSoup(response.rendered_content)
         self.assertEqual(len(doc.select('input[name=%s-attendee_name]' % self.ticket_pos.identity)), 1)
 
         # Not all fields filled out, expect success
-        response = self.client.post('/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.order.code), {
-            '%s-attendee_name' % self.ticket_pos.identity: '',
-        }, follow=True)
-        self.assertRedirects(response, '/%s/%s/order/%s/' % (self.orga.slug, self.event.slug, self.order.code),
+        response = self.client.post(
+            '/%s/%s/order/%s/%s/modify' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret), {
+                '%s-attendee_name' % self.ticket_pos.identity: '',
+            }, follow=True)
+        self.assertRedirects(response,
+                             '/%s/%s/order/%s/%s/' % (self.orga.slug, self.event.slug, self.order.code,
+                                                      self.order.secret),
                              target_status_code=200)
         self.ticket_pos = OrderPosition.objects.current.get(identity=self.ticket_pos.identity)
         assert self.ticket_pos.attendee_name in (None, '')
@@ -168,21 +157,25 @@ class OrdersTest(TestCase):
         self.event.settings.set('attendee_names_asked', True)
         self.event.settings.set('attendee_names_required', True)
 
-        response = self.client.get('/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.order.code))
+        response = self.client.get(
+            '/%s/%s/order/%s/%s/modify' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret))
         doc = BeautifulSoup(response.rendered_content)
         self.assertEqual(len(doc.select('input[name=%s-attendee_name]' % self.ticket_pos.identity)), 1)
 
         # Not all required fields filled out, expect failure
-        response = self.client.post('/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.order.code), {
-            '%s-attendee_name' % self.ticket_pos.identity: '',
-        }, follow=True)
+        response = self.client.post(
+            '/%s/%s/order/%s/%s/modify' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret), {
+                '%s-attendee_name' % self.ticket_pos.identity: '',
+            }, follow=True)
         doc = BeautifulSoup(response.rendered_content)
         self.assertGreaterEqual(len(doc.select('.has-error')), 1)
 
-        response = self.client.post('/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.order.code), {
-            '%s-attendee_name' % self.ticket_pos.identity: 'Peter',
-        }, follow=True)
-        self.assertRedirects(response, '/%s/%s/order/%s/' % (self.orga.slug, self.event.slug, self.order.code),
+        response = self.client.post(
+            '/%s/%s/order/%s/%s/modify' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret), {
+                '%s-attendee_name' % self.ticket_pos.identity: 'Peter',
+            }, follow=True)
+        self.assertRedirects(response, '/%s/%s/order/%s/%s/' % (self.orga.slug, self.event.slug, self.order.code,
+                                                                self.order.secret),
                              target_status_code=200)
         self.ticket_pos = OrderPosition.objects.current.get(identity=self.ticket_pos.identity)
         assert self.ticket_pos.attendee_name == 'Peter'
@@ -191,16 +184,20 @@ class OrdersTest(TestCase):
         self.event.settings.set('attendee_names_asked', False)
         self.event.settings.set('attendee_names_required', False)
 
-        response = self.client.get('/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.order.code))
+        response = self.client.get(
+            '/%s/%s/order/%s/%s/modify' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret))
         doc = BeautifulSoup(response.rendered_content)
         self.assertEqual(len(doc.select('input[name=%s-question_%s]' % (
             self.ticket_pos.identity, self.question.identity))), 1)
 
         # Not all fields filled out, expect success
-        response = self.client.post('/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.order.code), {
-            '%s-question_%s' % (self.ticket_pos.identity, self.question.identity): '',
-        }, follow=True)
-        self.assertRedirects(response, '/%s/%s/order/%s/' % (self.orga.slug, self.event.slug, self.order.code),
+        response = self.client.post(
+            '/%s/%s/order/%s/%s/modify' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret), {
+                '%s-question_%s' % (self.ticket_pos.identity, self.question.identity): '',
+            }, follow=True)
+        self.assertRedirects(response,
+                             '/%s/%s/order/%s/%s/' % (self.orga.slug, self.event.slug, self.order.code,
+                                                      self.order.secret),
                              target_status_code=200)
         assert not self.ticket_pos.answers.filter(question=self.question).exists()
 
@@ -210,22 +207,27 @@ class OrdersTest(TestCase):
         self.question.required = True
         self.question.save()
 
-        response = self.client.get('/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.order.code))
+        response = self.client.get('/%s/%s/order/%s/%s/modify' % (self.orga.slug, self.event.slug, self.order.code,
+                                                                  self.order.secret))
         doc = BeautifulSoup(response.rendered_content)
         self.assertEqual(len(doc.select('input[name=%s-question_%s]' % (
             self.ticket_pos.identity, self.question.identity))), 1)
 
         # Not all required fields filled out, expect failure
-        response = self.client.post('/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.order.code), {
-            '%s-question_%s' % (self.ticket_pos.identity, self.question.identity): '',
-        }, follow=True)
+        response = self.client.post(
+            '/%s/%s/order/%s/%s/modify' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret), {
+                '%s-question_%s' % (self.ticket_pos.identity, self.question.identity): '',
+            }, follow=True)
         doc = BeautifulSoup(response.rendered_content)
         self.assertGreaterEqual(len(doc.select('.has-error')), 1)
 
-        response = self.client.post('/%s/%s/order/%s/modify' % (self.orga.slug, self.event.slug, self.order.code), {
-            '%s-question_%s' % (self.ticket_pos.identity, self.question.identity): 'ABC',
-        }, follow=True)
-        self.assertRedirects(response, '/%s/%s/order/%s/' % (self.orga.slug, self.event.slug, self.order.code),
+        response = self.client.post(
+            '/%s/%s/order/%s/%s/modify' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret), {
+                '%s-question_%s' % (self.ticket_pos.identity, self.question.identity): 'ABC',
+            }, follow=True)
+        self.assertRedirects(response,
+                             '/%s/%s/order/%s/%s/' % (self.orga.slug, self.event.slug, self.order.code,
+                                                      self.order.secret),
                              target_status_code=200)
         assert self.ticket_pos.answers.get(question=self.question).answer == 'ABC'
 
@@ -233,67 +235,83 @@ class OrdersTest(TestCase):
         self.order.status = Order.STATUS_PAID
         self.order.save()
         self.client.get(
-            '/%s/%s/order/%s/cancel' % (self.orga.slug, self.event.slug, self.order.code)
+            '/%s/%s/order/%s/%s/cancel' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret)
         )
         self.order = Order.objects.current.get(identity=self.order.identity)
         assert self.order.status == Order.STATUS_PAID
 
     def test_orders_cancel(self):
         response = self.client.get(
-            '/%s/%s/order/%s/cancel' % (self.orga.slug, self.event.slug, self.order.code)
+            '/%s/%s/order/%s/%s/cancel' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret)
         )
         assert response.status_code == 200
-        response = self.client.post('/%s/%s/order/%s/cancel' % (self.orga.slug, self.event.slug, self.order.code), {
-        }, follow=True)
-        self.assertRedirects(response, '/%s/%s/order/%s/' % (self.orga.slug, self.event.slug, self.order.code),
+        response = self.client.post(
+            '/%s/%s/order/%s/%s/cancel' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret), {
+            }, follow=True)
+        self.assertRedirects(response,
+                             '/%s/%s/order/%s/%s/' % (self.orga.slug, self.event.slug, self.order.code,
+                                                      self.order.secret),
                              target_status_code=200)
         assert Order.objects.current.get(identity=self.order.identity).status == Order.STATUS_CANCELLED
 
     def test_orders_download(self):
         self.event.settings.set('ticket_download', True)
         del self.event.settings['ticket_download_date']
-        response = self.client.get('/%s/%s/order/%s/download/pdf' % (self.orga.slug, self.event.slug, self.order.code),
-                                   follow=True)
-        self.assertRedirects(response, '/%s/%s/order/%s/' % (self.orga.slug, self.event.slug, self.order.code),
+        response = self.client.get(
+            '/%s/%s/order/%s/%s/download/pdf' % (self.orga.slug, self.event.slug, self.order.code, self.order.secret),
+            follow=True)
+        self.assertRedirects(response,
+                             '/%s/%s/order/%s/%s/' % (self.orga.slug, self.event.slug, self.order.code,
+                                                      self.order.secret),
                              target_status_code=200)
 
         response = self.client.get(
-            '/%s/%s/order/ABC/download/testdummy' % (self.orga.slug, self.event.slug)
+            '/%s/%s/order/ABC/123/download/testdummy' % (self.orga.slug, self.event.slug)
         )
         assert response.status_code == 404
 
         response = self.client.get(
-            '/%s/%s/order/%s/download/testdummy' % (self.orga.slug, self.event.slug, self.order.code),
+            '/%s/%s/order/%s/%s/download/testdummy' % (self.orga.slug, self.event.slug, self.order.code,
+                                                       self.order.secret),
             follow=True
         )
-        self.assertRedirects(response, '/%s/%s/order/%s/' % (self.orga.slug, self.event.slug, self.order.code),
+        self.assertRedirects(response,
+                             '/%s/%s/order/%s/%s/' % (self.orga.slug, self.event.slug, self.order.code,
+                                                      self.order.secret),
                              target_status_code=200)
 
         self.order.status = Order.STATUS_PAID
         self.order.save()
         response = self.client.get(
-            '/%s/%s/order/%s/download/testdummy' % (self.orga.slug, self.event.slug, self.order.code),
+            '/%s/%s/order/%s/%s/download/testdummy' % (self.orga.slug, self.event.slug, self.order.code,
+                                                       self.order.secret),
         )
         assert response.status_code == 302
 
         self.event.settings.set('ticket_download_date', now() + datetime.timedelta(days=1))
         response = self.client.get(
-            '/%s/%s/order/%s/download/testdummy' % (self.orga.slug, self.event.slug, self.order.code),
+            '/%s/%s/order/%s/%s/download/testdummy' % (self.orga.slug, self.event.slug, self.order.code,
+                                                       self.order.secret),
             follow=True
         )
-        self.assertRedirects(response, '/%s/%s/order/%s/' % (self.orga.slug, self.event.slug, self.order.code),
+        self.assertRedirects(response,
+                             '/%s/%s/order/%s/%s/' % (self.orga.slug, self.event.slug, self.order.code,
+                                                      self.order.secret),
                              target_status_code=200)
 
         del self.event.settings['ticket_download_date']
         response = self.client.get(
-            '/%s/%s/order/%s/download/testdummy' % (self.orga.slug, self.event.slug, self.order.code),
+            '/%s/%s/order/%s/%s/download/testdummy' % (self.orga.slug, self.event.slug, self.order.code,
+                                                       self.order.secret),
         )
         assert response.status_code == 302
 
         self.event.settings.set('ticket_download', False)
         response = self.client.get(
-            '/%s/%s/order/%s/download/testdummy' % (self.orga.slug, self.event.slug, self.order.code),
+            '/%s/%s/order/%s/%s/download/testdummy' % (self.orga.slug, self.event.slug, self.order.code,
+                                                       self.order.secret),
             follow=True
         )
-        self.assertRedirects(response, '/%s/%s/order/%s/' % (self.orga.slug, self.event.slug, self.order.code),
+        self.assertRedirects(response, '/%s/%s/order/%s/%s/' % (self.orga.slug, self.event.slug, self.order.code,
+                                                                self.order.secret),
                              target_status_code=200)