From 9ebd5d83ca3342a3a0743d7c5eeab3a2a3949bb0 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Thu, 25 Jun 2026 17:42:42 +0200 Subject: [PATCH] RejectInvalidInputMiddleware: Ignore invalid charsets on body --- src/pretix/base/middleware.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/pretix/base/middleware.py b/src/pretix/base/middleware.py index 293b9762ed..191fdba088 100644 --- a/src/pretix/base/middleware.py +++ b/src/pretix/base/middleware.py @@ -370,8 +370,16 @@ class RejectInvalidInputMiddleware(MiddlewareMixin): if "\x00" in request.META['QUERY_STRING'] or "%00" in request.META['QUERY_STRING']: raise BadRequest("Invalid characters in input.") if request.method in ('POST', 'PUT', 'PATCH') and request.content_type == "application/x-www-form-urlencoded": - if any("\x00" in value for key, value_list in request.POST.lists() for value in value_list): - raise BadRequest("Invalid characters in input.") + try: + post_data = request.POST.lists() + except BadRequest: + # Reading request.POST wasn't possible, probably an invalid charset. Django will crash once we actually + # use request.POST, but if we don't, let's not crash it (required for some weird payment provider + # webhooks, e.g. computop). + pass + else: + if any("\x00" in value for key, value_list in post_data for value in value_list): + raise BadRequest("Invalid characters in input.") class CustomCommonMiddleware(CommonMiddleware):