Issue #449: Display and change order locale (#459)

* Add more security headers (#458)

* Include some missing security headers

This change adds the following security headers:
* X-Content-Type-Options to prevent content type sniffing
* Referrer-Policy to prevent leaking referrer information when navigating away from the instance

* Migrate from Docker sample to manual configuration

Migrate the additional security headers from the Docker configuration sample to the manual configuration guide.

Add DS_Store to gitingore

* Show order locale in order details

* Add OrderLocaleChange view and OrderLocaleForm

Refactor OrderLocaleForm. Add test

src/pretix/control/views/orders.py

@@ -30,7 +30,7 @@ from pretix.base.signals import (
     register_data_exporters, register_payment_providers,
 )
 from pretix.control.forms.orders import (
-    CommentForm, ExporterForm, ExtendForm, OrderContactForm,
+    CommentForm, ExporterForm, ExtendForm, OrderContactForm, OrderLocaleForm,
     OrderPositionChangeForm,
 )
 from pretix.control.permissions import EventPermissionRequiredMixin
@@ -552,6 +552,40 @@ class OrderContactChange(OrderView):
         return self.get(*args, **kwargs)
 
 
+class OrderLocaleChange(OrderView):
+    permission = 'can_change_orders'
+    template_name = 'pretixcontrol/order/change_locale.html'
+
+    def get_context_data(self, **kwargs):
+        ctx = super().get_context_data()
+        ctx['form'] = self.form
+        return ctx
+
+    @cached_property
+    def form(self):
+        return OrderLocaleForm(
+            instance=self.order,
+            data=self.request.POST if self.request.method == "POST" else None
+        )
+
+    def post(self, *args, **kwargs):
+        old_locale = self.order.locale
+        if self.form.is_valid():
+            self.order.log_action(
+                'pretix.event.order.locale.changed',
+                data={
+                    'old_locale': old_locale,
+                    'new_locale': self.form.cleaned_data['locale'],
+                },
+                user=self.request.user,
+            )
+
+            self.form.save()
+            messages.success(self.request, _('The order has been changed.'))
+            return redirect(self.get_order_url())
+        return self.get(*args, **kwargs)
+
+
 class OverView(EventPermissionRequiredMixin, TemplateView):
     template_name = 'pretixcontrol/orders/overview.html'
     permission = 'can_view_orders'