CGM_Public/pretix_original
2
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-07 10:17:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
14,378 Commits 381 Branches 211 Tags
01cb860a75d5741ae44dc58eeb7aa879791667f6
Commit Graph
13194 Commits
Author SHA1 Message Date
Raphael MichelandMira Weller 53f98d9704 [SECURITY] Hardening for user impersonation feature (CVE-2026-13602) 
---------

Co-authored-by: Mira Weller <weller@pretix.eu>
 2026-07-01 14:04:34 +02:00
Raphael MichelandMira Weller 9515b4614e [SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602) 
- Add central framebreaker page via safelink helper
- Update paypal, paypal2 and stripe plugins to use central framebreaker
- Add CSP header to cookies.html

---------

Co-authored-by: Mira Weller <weller@pretix.eu>
 2026-07-01 14:04:33 +02:00
Mira WellerRaphael MichelRaphael Michel
 		50709c1efe [SECURITY] Allowlisting and changed salts for safelink and safelink_callback (CVE-2026-13602) 
---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
 2026-07-01 14:03:18 +02:00
Raphael Michel 2923799b0a Bump to 2026.4.4 2026-06-25 16:38:55 +02:00
Raphael Michel 690c462d95 [SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535) 2026-06-25 16:38:27 +02:00
Raphael MichelandRaphael Michel fb15d5d61d [SECURITY] Prevent reading of any local files in reportlab (CVE-2026-57535) 2026-06-25 16:37:51 +02:00
Raphael MichelandRaphael Michel 721ad93edd [SECURITY] Disable outbound and file access for reportlab (CVE-2026-57535) 2026-06-25 16:37:32 +02:00
Mira WellerandRaphael Michel c96240834b [SECURITY] Fix reflected XSS in redirection page (CVE-2026-57533) 2026-06-25 16:37:32 +02:00
Mira WellerandRaphael Michel 393fc2b73b [SECURITY] Fix stored XSS in ticket confirmation page (CVE-2026-13225) 2026-06-25 16:37:32 +02:00
Mira WellerandRaphael Michel 39ee4f0663 [SECURITY] Hardening: Don't use |safe on confirm_messages 2026-06-25 16:37:32 +02:00
Mira WellerandRaphael Michel 49452db739 [SECURITY] Fix XSS in ticket layout JSON (CVE-2026-57532) 2026-06-25 16:37:32 +02:00
Raphael Michel 327d69f6d3 Bump to 2026.4.3 2026-06-09 13:23:27 +02:00
Richard SchreiberandRaphael Michel d5fa817623 [SECURITY] Reusable media export: Respect giftcard permissions (CVE-2026-11764) (#6261) 2026-06-09 13:23:17 +02:00
Raphael Michel a5f1296934 Bump to 2026.4.2 2026-05-27 16:28:33 +02:00
Raphael Michel 866a5cde42 [SECURITY] Add missing session check for cached files (CVE-2026-9712) 2026-05-27 16:28:09 +02:00
Raphael Michel f88a560d5f Bump to 2026.4.1 2026-05-04 11:24:26 +02:00
Raphael Michel c75c847393 Settings: Fix typo in class path to mail backend (#6144) 2026-05-04 11:24:04 +02:00
Raphael Michel 75c8f97080 Bump version to 2026.4.0 2026-04-28 16:47:33 +02:00
Raphael Michel 10789f097d Bump version to 2025.5.0.dev0 2026-04-28 16:39:29 +02:00
Raphael Michel 1adec102e6 Bump version to 2025.4.0 2026-04-28 16:39:24 +02:00
Raphael MichelandGitHub 921fd801e5 Thumbnails: Perform color space transform before resizing (Z#23232101) (#6120) 2026-04-28 15:35:27 +02:00
Kara Engelhardtandpajowu 448d2e70d5 AddOnsStep: Expand selected variants 2026-04-28 14:50:35 +02:00
Kara Engelhardtandpajowu 49f692c666 AddOnsStep: Use post data as initial data if exists (Z#23232311) 2026-04-28 14:50:35 +02:00
Kara Engelhardtandpajowu 2d31c62812 Allow dash character in pdf placeholders 2026-04-28 13:10:08 +02:00
Raphael MichelandRaphael Michel 08df3d828d Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6295 of 6295 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-04-28 12:20:37 +02:00
Raphael MichelandRaphael Michel 96e10bcd71 Translations: Update German 
Currently translated at 100.0% (6295 of 6295 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-04-28 12:20:37 +02:00
Raphael Michel ff434f4384 Translations: Update wordlist 2026-04-28 12:17:11 +02:00
Raphael Michel d6fe29210a Update po files 
[CI skip]

Signed-off-by: Raphael Michel <michel@pretix.eu>
 2026-04-28 11:04:18 +02:00
NikolaiandRaphael Michel a13bb630d5 Translations: Update Danish 
Currently translated at 58.4% (3676 of 6287 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/da/

powered by weblate
 2026-04-28 11:03:23 +02:00
NikolaiandRaphael Michel fd0b3bac3c Translations: Update Danish 
Currently translated at 58.9% (151 of 256 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/da/

powered by weblate
 2026-04-28 11:03:23 +02:00
NikolaiandRaphael Michel 7f6b5d7331 Translations: Update Danish 
Currently translated at 56.3% (3542 of 6287 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/da/

powered by weblate
 2026-04-28 11:03:23 +02:00
NikolaiandRaphael Michel 27398c08c7 Translations: Update Danish 
Currently translated at 54.5% (3428 of 6287 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/da/

powered by weblate
 2026-04-28 11:03:23 +02:00
Sandra Rial PérezandRaphael Michel c061179f37 Translations: Update Galician 
Currently translated at 19.1% (1207 of 6287 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/gl/

powered by weblate
 2026-04-28 11:03:23 +02:00
Sandra Rial PérezandRaphael Michel bd90badc54 Translations: Update Galician 
Currently translated at 19.0% (1196 of 6287 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/gl/

powered by weblate
 2026-04-28 11:03:23 +02:00
NikolaiandRaphael Michel 90800f219b Translations: Update Danish 
Currently translated at 54.3% (3414 of 6287 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/da/

powered by weblate
 2026-04-28 11:03:23 +02:00
Sandra Rial PérezandRaphael Michel 4767cb38fc Translations: Update Galician 
Currently translated at 17.6% (1111 of 6287 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/gl/

powered by weblate
 2026-04-28 11:03:23 +02:00
NikolaiandRaphael Michel 8fd366be76 Translations: Update Danish 
Currently translated at 52.2% (3284 of 6287 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/da/

powered by weblate
 2026-04-28 11:03:23 +02:00
NikolaiandRaphael Michel 75660600f4 Translations: Update Danish 
Currently translated at 50.1% (3153 of 6287 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/da/

powered by weblate
 2026-04-28 11:03:23 +02:00
Richard SchreiberandGitHub 217744a9f2 Remove unused download of all tickets of an order in pretix-control (#6086) 
* Remove unused code for ticket download of whole order in pretix-control

* fix flake8

* fix isort
 2026-04-28 09:45:35 +02:00
Richard SchreiberandGitHub 1c7ce4b1ca Validate id for async tasks 2026-04-28 08:56:32 +02:00
Raphael MichelandGitHub 8426a68760 Prevent nullbytes in input data globally (#6071) 
* Prevent nullbytes in input data globally

* Only on urlencoded POST

* Split middleware
 2026-04-27 17:28:36 +02:00
Raphael MichelandGitHub 1157e2aeed Events/subevents: Fix missing logging for meta changes (Z#23232443) (#6110) 
* Events/subevents: Fix missing logging for meta changes (Z#23232443)

* Fix logging
 2026-04-27 15:12:21 +02:00
Raphael MichelGitHubMartin Gross
 		771f4f5d1e Turn attendee emails on by default for new events (Z#23213656) (#5598) 
* Turn attendee emails on by default for new events (Z#23213656)

I think the thing that makes me most unhappy is that *most* organizers will
probably want to turn off mail_send_order_paid_attendee when they set
ticket_download_pending and I don't think organizers will remember that, but
it also seems complex and weird to create an automatism for it?

* Update src/pretix/base/models/event.py

Co-authored-by: Martin Gross <gross@rami.io>

---------

Co-authored-by: Martin Gross <gross@rami.io>
 2026-04-27 15:00:48 +02:00
Raphael MichelandGitHub 496591bb3b Navigation: suggest event or organizer by domain (Z#23231404) (#6107) 2026-04-27 14:55:59 +02:00
Raphael MichelGitHubRichard SchreiberRichard SchreiberKara Engelhardt
 		88165c098e Subevents: Allow to skip conflicting dates in bulk-creation (Z#23217384) (#6079) 
* Subevents: Allow to skip conflicting dates in bulk-creation

* Update src/pretix/control/templates/pretixcontrol/subevents/bulk.html

* Fix overlap calc for consecutive subevents

* Add test for skipping conflicting dates in bulk-creation

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: Kara Engelhardt <engelhardt@pretix.eu>
 2026-04-27 14:52:49 +02:00
Kara Engelhardtandpajowu ff77a2125a Limit widget frame inner height to 100dvh (Z#23231969) 
Fixes a bug where the submit buttons were obscured by the browsers elements on some ios devices
 2026-04-27 12:38:32 +02:00
Raphael MichelandGitHub 97904d8567 Backend: Support are-you-sure for dynamically added form parts (Z#23232506) (#6109) 2026-04-27 12:24:55 +02:00
Raphael MichelandGitHub a6a9eb6a6a Subevent selection: Order by date before name (Z#23231460) (#6111) 2026-04-27 12:23:17 +02:00
Raphael MichelandGitHub b000dff134 Invoices: Allow to use currency rates from National Bank of Poland (#6100) 2026-04-21 15:14:10 +02:00
Kara Engelhardtandpajowu ba75de7e7d Handle existing cart with empty session in presale views (PRETIXEU-D9Y) 2026-04-21 13:05:42 +02:00