[SECURITY] Escape help texts (CVE-2026-101270)

src/pretix/control/forms/event.py

@@ -830,9 +830,10 @@ class CancelSettingsForm(SettingsForm):
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         if self.obj.settings.giftcard_expiry_years is not None:
-            self.fields['cancel_allow_user_paid_refund_as_giftcard'].help_text = gettext(
-                'You have configured gift cards to be valid {} years plus the year the gift card is issued in.'
-            ).format(self.obj.settings.giftcard_expiry_years)
+            self.fields['cancel_allow_user_paid_refund_as_giftcard'].help_text = format_html(
+                gettext('You have configured gift cards to be valid {} years plus the year the gift card is issued in.'),
+                self.obj.settings.giftcard_expiry_years
+            )
 
 
 class PaymentSettingsForm(EventSettingsValidationMixin, SettingsForm):

src/pretix/control/forms/modelimport.py

@@ -22,7 +22,7 @@
 from django import forms
 from django.core.exceptions import ValidationError
 from django.utils.functional import lazy
-from django.utils.html import format_html
+from django.utils.html import conditional_escape, format_html
 from django.utils.translation import gettext_lazy as _
 
 from pretix.base.modelimport_orders import get_order_import_columns
@@ -66,7 +66,7 @@ class ProcessForm(forms.Form):
                 widget=forms.Select(
                     attrs={'data-static': 'true'}
                 ),
-                help_text=c.help_text,
+                help_text=conditional_escape(c.help_text),
             )
 
     def get_columns(self):

src/pretix/control/forms/organizer.py

@@ -355,7 +355,7 @@ class TeamForm(forms.ModelForm):
                     for opt in pg.options
                 ],
                 label=pg.label,
-                help_text=pg.help_text,
+                help_text=conditional_escape(pg.help_text),
                 initial=initial,
                 widget=forms.RadioSelect,
             )
@@ -380,7 +380,7 @@ class TeamForm(forms.ModelForm):
                     for opt in pg.options
                 ],
                 label=pg.label,
-                help_text=pg.help_text,
+                help_text=conditional_escape(pg.help_text),
                 initial=initial,
                 widget=forms.RadioSelect,
             )

src/pretix/control/forms/vouchers.py

@@ -41,6 +41,7 @@ from django.core.exceptions import ObjectDoesNotExist, ValidationError
 from django.core.validators import EmailValidator
 from django.db.models.functions import Upper
 from django.urls import reverse
+from django.utils.html import escape
 from django.utils.translation import gettext_lazy as _
 from django_scopes.forms import SafeModelChoiceField
 
@@ -161,7 +162,7 @@ class VoucherForm(I18nModelForm):
                 required=False,
                 widget=forms.TextInput(attrs={'data-seat-guid-field': '1'}),
                 initial=self.instance.seat.seat_guid if self.instance.seat else '',
-                help_text=str(self.instance.seat) if self.instance.seat else '',
+                help_text=escape(str(self.instance.seat) if self.instance.seat else ''),
             )
 
     def clean(self):

src/pretix/presale/forms/customer.py

@@ -33,7 +33,7 @@ from django.contrib.auth.password_validation import (
 from django.contrib.auth.tokens import PasswordResetTokenGenerator
 from django.core import signing
 from django.utils.functional import cached_property
-from django.utils.html import escape
+from django.utils.html import escape, format_html
 from django.utils.translation import gettext_lazy as _
 from phonenumber_field.formfields import PhoneNumberField
 
@@ -83,7 +83,8 @@ class AuthenticationForm(forms.Form):
         self.request = request
         self.customer_cache = None
         super().__init__(*args, **kwargs)
-        self.fields['password'].help_text = "<a target='_blank' href='{}'>{}</a>".format(
+        self.fields['password'].help_text = format_html(
+            "<a target='_blank' href='{}'>{}</a>",
             build_absolute_uri(False, 'presale:organizer.customer.resetpw', kwargs={
                 'organizer': request.organizer.slug,
             }),