From f38b4a668c7d4b44bfb89c1fcac50563cee14d0c Mon Sep 17 00:00:00 2001
From: Mira Weller <weller@rami.io>
Date: Mon, 29 Jun 2026 22:18:11 +0200
Subject: [PATCH] Use JSON encoding for data-replace-with-qr

---
 .../pretixcontrol/organizers/device_connect.html      |  3 ++-
 .../pretixpresale/event/payment_qr_codes.html         |  2 +-
 src/pretix/static/pretixcontrol/js/ui/main.js         | 11 ++---------
 src/pretix/static/pretixpresale/js/ui/main.js         |  9 +++++----
 4 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/src/pretix/control/templates/pretixcontrol/organizers/device_connect.html b/src/pretix/control/templates/pretixcontrol/organizers/device_connect.html
index 63ba0d2015..a8a1fcdd4a 100644
--- a/src/pretix/control/templates/pretixcontrol/organizers/device_connect.html
+++ b/src/pretix/control/templates/pretixcontrol/organizers/device_connect.html
@@ -2,6 +2,7 @@
 {% load i18n %}
 {% load static %}
 {% load bootstrap3 %}
+{% load escapejson_dumps %}
 {% block inner %}
     <h1>{% trans "Connect to device:" %} {{ device.name }}</h1>
 
@@ -18,7 +19,7 @@
                 {% trans "Open the app that you want to connect and optionally reset it to the original state." %}
             </li>
             <li>{% trans "Scan the following configuration code:" %}<br><br>
-                <script type="text/json" data-replace-with-qr>{{ qrdata|safe }}</script><br>
+                <script type="application/json" data-replace-with-qr>{{ qrdata|escapejson_dumps }}</script><br>
                 {% trans "If your app/device does not support scanning a QR code, you can also enter the following information:" %}
                 <br>
                 <strong>{% trans "System URL:" %}</strong> <code id="system_url">{{ settings.SITE_URL }}</code>
diff --git a/src/pretix/presale/templates/pretixpresale/event/payment_qr_codes.html b/src/pretix/presale/templates/pretixpresale/event/payment_qr_codes.html
index 9c1500f082..0fa39b58f1 100644
--- a/src/pretix/presale/templates/pretixpresale/event/payment_qr_codes.html
+++ b/src/pretix/presale/templates/pretixpresale/event/payment_qr_codes.html
@@ -14,7 +14,7 @@
                     {% if code_info.link %}<a aria-label="{{ code_info.link_aria_label }}" href="{{ code_info.link }}">{% endif %}
                     <div class="{{ code_info.css_class }}" role="figure" aria-labelledby="banktransfer_qrcodes_{{ code_info.id }}_tab banktransfer_qrcodes_label">
                         {{ code_info.html_prefix }}
-                        <script type="text/plain" data-size="150" data-replace-with-qr data-desc="{% trans 'Scan this image with your banking app’s QR-Reader to start the payment process.' %}">{{ code_info.qr_data }}</script>
+                        <script type="application/json" data-size="150" data-replace-with-qr data-desc="{% trans 'Scan this image with your banking app’s QR-Reader to start the payment process.' %}">{{ code_info.qr_data|escapejson_dumps }}</script>
                     </div>
                     {% if code_info.link %}</a>{% endif %}
                 </div>
diff --git a/src/pretix/static/pretixcontrol/js/ui/main.js b/src/pretix/static/pretixcontrol/js/ui/main.js
index 9b48016b53..73c9d0def0 100644
--- a/src/pretix/static/pretixcontrol/js/ui/main.js
+++ b/src/pretix/static/pretixcontrol/js/ui/main.js
@@ -667,9 +667,10 @@ var form_handlers = function (el) {
     el.find("script[data-replace-with-qr]").each(function () {
         var $div = $("<div>");
         $div.insertBefore($(this));
+				var text = (this.getAttribute("type") || "").indexOf("json") !== -1 ? JSON.parse($(this).html()) : $(this).html();
         $div.qrcode(
             {
-                text: $(this).html(),
+                text: text,
                 correctLevel: 0,  // M
                 width: $(this).attr("data-size") ? parseInt($(this).attr("data-size")) : 256,
                 height: $(this).attr("data-size") ? parseInt($(this).attr("data-size")) : 256,
@@ -871,14 +872,6 @@ function setup_basics(el) {
         });
     });
 
-    el.find(".qrcode-canvas").each(function () {
-        $(this).qrcode(
-            {
-                text: $.trim($($(this).attr("data-qrdata")).html())
-            }
-        );
-    });
-
     el.find(".propagated-settings-box").find("input, textarea, select").not("[readonly]")
         .attr("data-propagated-locked", "true").prop("readonly", true);
 
diff --git a/src/pretix/static/pretixpresale/js/ui/main.js b/src/pretix/static/pretixpresale/js/ui/main.js
index f4f66f70c4..9324ab8e7b 100644
--- a/src/pretix/static/pretixpresale/js/ui/main.js
+++ b/src/pretix/static/pretixpresale/js/ui/main.js
@@ -132,9 +132,10 @@ var form_handlers = function (el) {
     el.find("script[data-replace-with-qr]").each(function () {
         var $div = $("<div>");
         $div.insertBefore($(this));
+				var text = (this.getAttribute("type") || "").indexOf("json") !== -1 ? JSON.parse($(this).html()) : $(this).html();
         $div.qrcode(
             {
-                text: $(this).html(),
+                text: text,
                 correctLevel: 0,  // M
                 width: $(this).attr("data-size") ? parseInt($(this).attr("data-size")) : 256,
                 height: $(this).attr("data-size") ? parseInt($(this).attr("data-size")) : 256,
@@ -345,7 +346,7 @@ function setup_basics(el) {
         }).on('click', function (event) {
             setCurrentTab(this);
         });
-        
+
         var firstTab = tabs.first().get(0);
         var lastTab = tabs.last().get(0);
         setCurrentTab(tabs.filter('[aria-selected=true]').get(0));
@@ -658,7 +659,7 @@ $(function () {
         var currentTimeDisplayParts = [];
         timeFormatParts.forEach(function(format) {
             currentTimeDisplayParts.push([format, $("<span></span>").appendTo(currentTimeDisplay)])
-        }); 
+        });
         var duration = this.getAttribute("data-duration").split(":").reduce(function(previousValue, currentValue, currentIndex) {
             return previousValue + (currentIndex ? parseInt(currentValue, 10) * 60 : parseInt(currentValue, 10) * 60 * 60);
         }, 0);
@@ -671,7 +672,7 @@ $(function () {
                 currentTimeBar.remove();
                 return;
             }
-            
+
             var offset = thisCalendar.querySelector("h3").getBoundingClientRect().width;
             var dx = Math.round(offset + (thisCalendar.scrollWidth-offset)*(currentTimeDelta/duration));
             currentTimeDisplayParts.forEach(function(part) {