CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-29 13:44:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602)

Browse Source 
- Add central framebreaker page via safelink helper
- Update paypal, paypal2 and stripe plugins to use central framebreaker
- Add CSP header to cookies.html

---------

Co-authored-by: Mira Weller <weller@pretix.eu>
This commit is contained in:
Raphael Michel
2026-07-01 15:15:43 +02:00
co-authored by Mira Weller
parent 000bf54105
commit c9781f012b
17 changed files with 63 additions and 206 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/plugins/paypal/urls.py
+1 -2
View File
@@ -21,13 +21,12 @@
#
from django.urls import include, re_path
from .views import abort, oauth_disconnect, redirect_view, success
from .views import abort, oauth_disconnect, success
event_patterns = [
re_path(r'^paypal/', include([
re_path(r'^abort/$', abort, name='abort'),
re_path(r'^return/$', success, name='return'),
re_path(r'^redirect/$', redirect_view, name='redirect'),
re_path(r'w/(?P<cart_namespace>[a-zA-Z0-9]{16})/abort/', abort, name='abort'),
re_path(r'w/(?P<cart_namespace>[a-zA-Z0-9]{16})/return/', success, name='return'),