From ce8c4c649d9ea2bea80f892958d128e67bd59a34 Mon Sep 17 00:00:00 2001
From: Mira Weller <weller@rami.io>
Date: Mon, 29 Jun 2026 22:15:16 +0200
Subject: [PATCH] Replace |safe with |escapejson where appropriate

---
 .../control/templates/pretixcontrol/auth/login_2fa.html   | 4 ++--
 .../templates/pretixcontrol/user/2fa_confirm_totp.html    | 8 ++------
 .../pretixcontrol/user/2fa_confirm_webauthn.html          | 5 ++---
 .../control/templates/pretixcontrol/user/reauth.html      | 3 ++-
 src/pretix/helpers/escapejson.py                          | 2 +-
 .../stripe/static/pretixplugins/stripe/pretix-stripe.js   | 4 ++--
 .../stripe/templates/pretixplugins/stripe/sca.html        | 2 +-
 7 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html b/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html
index 760769b3a5..d5370a45a7 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html
@@ -3,6 +3,7 @@
 {% load i18n %}
 {% load static %}
 {% load compress %}
+{% load escapejson %}
 {% block content %}
     <form class="form-signin" action="" method="post" id="webauthn-form">
         {% csrf_token %}
@@ -30,8 +31,7 @@
     </form>
     {% if jsondata %}
         <script type="text/json" id="webauthn-login">
-            {{ jsondata|safe }}
-
+            {{ jsondata|escapejson }}
         </script>
     {% endif %}
     {% compress js %}
diff --git a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html
index a25ca03cf7..a0b4489f3e 100644
--- a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html
+++ b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html
@@ -1,6 +1,7 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% load escapejson %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Add a two-factor authentication device" %}</h1>
@@ -32,7 +33,7 @@
         </li>
         <li>
             {% trans "Add a new account to the app by scanning the following barcode:" %}
-            <div class="qrcode-canvas" data-qrdata="#qrdata"></div>
+            <script type="application/json" data-replace-with-qr>{{ qrdata|escapejson_dumps }}</script>
             <p>
                 <a data-toggle="collapse" href="#no_scan">
                     {% trans "Can't scan the barcode?" %}
@@ -81,9 +82,4 @@
         </li>
     </ol>
 
-    <script type="text/json" id="qrdata">
-        {{ qrdata|safe }}
-
-
-    </script>
 {% endblock %}
diff --git a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html
index 1b064b8aab..f03b03fe5f 100644
--- a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html
+++ b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html
@@ -3,6 +3,7 @@
 {% load bootstrap3 %}
 {% load static %}
 {% load compress %}
+{% load escapejson %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Add a two-factor authentication device" %}</h1>
@@ -26,9 +27,7 @@
         {% trans "Device registration failed." %}
     </div>
     <script type="text/json" id="webauthn-enroll">
-        {{ jsondata|safe }}
-
-
+        {{ jsondata|escapejson }}
     </script>
     {% compress js %}
         <script type="text/javascript" src="{% static "pretixcontrol/js/base64js.js" %}"></script>
diff --git a/src/pretix/control/templates/pretixcontrol/user/reauth.html b/src/pretix/control/templates/pretixcontrol/user/reauth.html
index 797e5ef58d..caa61ed0ae 100644
--- a/src/pretix/control/templates/pretixcontrol/user/reauth.html
+++ b/src/pretix/control/templates/pretixcontrol/user/reauth.html
@@ -3,6 +3,7 @@
 {% load bootstrap3 %}
 {% load compress %}
 {% load static %}
+{% load escapejson %}
 {% block content %}
     <form class="form-signin" id="webauthn-form" action="" method="post">
         {% csrf_token %}
@@ -43,7 +44,7 @@
 
         {% if jsondata %}
             <script type="text/json" id="webauthn-login">
-            {{ jsondata|safe }}
+                {{ jsondata|escapejson }}
             </script>
         {% endif %}
         {% compress js %}
diff --git a/src/pretix/helpers/escapejson.py b/src/pretix/helpers/escapejson.py
index 1df8cd1689..d5dd9f6c96 100644
--- a/src/pretix/helpers/escapejson.py
+++ b/src/pretix/helpers/escapejson.py
@@ -47,5 +47,5 @@ def escapejson(value):
 
 @keep_lazy(str, SafeText)
 def escapejson_attr(value):
-    """Hex encodes characters for use in a html attributw script."""
+    """Hex encodes characters for use in a html attribute."""
     return mark_safe(force_str(value).translate(_json_escapes_attr))
diff --git a/src/pretix/plugins/stripe/static/pretixplugins/stripe/pretix-stripe.js b/src/pretix/plugins/stripe/static/pretixplugins/stripe/pretix-stripe.js
index cf71266f80..8aaf942675 100644
--- a/src/pretix/plugins/stripe/static/pretixplugins/stripe/pretix-stripe.js
+++ b/src/pretix/plugins/stripe/static/pretixplugins/stripe/pretix-stripe.js
@@ -323,7 +323,7 @@ $(function () {
             }
         }
     } else if ($("#stripe_payment_intent_next_action_redirect_url").length) {
-        let payment_intent_next_action_redirect_url = $.trim($("#stripe_payment_intent_next_action_redirect_url").html());
+        let payment_intent_next_action_redirect_url = JSON.parse($("#stripe_payment_intent_next_action_redirect_url").html());
         pretixstripe.handlePaymentRedirectAction(payment_intent_next_action_redirect_url);
     } else if ($.trim($("#stripe_payment_intent_action_type").html()) === "promptpay_display_qr_code") {
         waitingDialog.hide();
@@ -432,4 +432,4 @@ $(function () {
             }
         }
     );
-});
\ No newline at end of file
+});
diff --git a/src/pretix/plugins/stripe/templates/pretixplugins/stripe/sca.html b/src/pretix/plugins/stripe/templates/pretixplugins/stripe/sca.html
index 7f4cd530c7..9182be6d3f 100644
--- a/src/pretix/plugins/stripe/templates/pretixplugins/stripe/sca.html
+++ b/src/pretix/plugins/stripe/templates/pretixplugins/stripe/sca.html
@@ -9,7 +9,7 @@
     <script type="text/plain" id="stripe_payment_intent_action_type">{{ payment_intent_action_type }}</script>
     <script type="text/plain" id="stripe_payment_intent_client_secret">{{ payment_intent_client_secret }}</script>
     {% if payment_intent_next_action_redirect_url %}
-        <script type="text/plain" id="stripe_payment_intent_next_action_redirect_url">{{ payment_intent_next_action_redirect_url|safe }}</script>
+        {{ payment_intent_next_action_redirect_url|json_script:"stripe_payment_intent_next_action_redirect_url" }}
     {% endif %}
     {% if payment_intent_redirect_action_handling %}
         <script type="text/plain" id="stripe_payment_intent_redirect_action_handling">{{ payment_intent_redirect_action_handling }}</script>