Commit Graph
41 Commits
Author SHA1 Message Date
Raphael MichelandMira Weller deee2c9f66 [SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602)
- Add central framebreaker page via safelink helper
- Update paypal, paypal2 and stripe plugins to use central framebreaker
- Add CSP header to cookies.html

---------

Co-authored-by: Mira Weller <weller@pretix.eu>
2026-07-01 14:02:48 +02:00
df0b580dd6 Pluggable permissions (#5728)
* Data model draft

* Refactor query and assignment usages of old permissions

* Backend UI

* API serializer

* Big string replace

* Docs, tests and fixes for teams api

* Update docs for device auth

* Eliminate old names

* Make tests pass

* Use new permissions, remove inconsistencies

* Add test for translations

* Show plugin permissions

* Add permission for seating plans

* Fix plugin activation

* Fix failing test

* Refactor to permission groups

* Update doc/api/resources/devices.rst

Co-authored-by: luelista <weller@rami.io>

* Update doc/api/resources/events.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/api/serializers/organizer.py

Co-authored-by: luelista <weller@rami.io>

* Fix typo

* Fix python version compat

* Replacement after rebase

* Add proper permission handling for exports

* Docs for exporters

* Runtime linting of permission names

* Fix typos

* Show export page even without orders permission

* More legacy compat

* Do not strongly validate before plugins are loaded

* Rebase migration

* Add permission for outgoing mails

* Review notes

* Update doc/api/resources/teams.rst

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Clean up logic around exporters

* Review and failures

* Fix migration leading to forbidden combination

* Handle permissions on event copying

* Remove print-statements

* Make test clearer

* Review feedback

* Add AnyPermissionOf

* migration safety

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-03-17 14:43:56 +01:00
Raphael MichelandGitHub 177a7d07fc Update license header (#5540) 2025-10-10 15:32:46 +02:00
Raphael Michel 12a898476e Replace redirect() with redirect_to_url() if we don't need Django's resolution 2023-12-08 15:38:50 +01:00
925b8334a9 PayPal: Migrate to Order v2 API and ISU authentication (#2493) (#2614)
Co-authored-by: Raphael Michel <michel@rami.io>
Co-authored-by: Martin Gross <gross@rami.io>
2022-05-30 15:44:22 +02:00
Raphael Michel 3fc8e12d9a Revert "PayPal: Migrate to Order v2 API and ISU authentication (#2493)"
This reverts commit 9af1565db1.
2022-04-28 20:58:39 +02:00
9af1565db1 PayPal: Migrate to Order v2 API and ISU authentication (#2493)
Co-authored-by: Raphael Michel <michel@rami.io>
2022-04-28 18:42:19 +02:00
5bde98e349 PayPal: Fail early on invalid webhook payload (#2528)
Co-authored-by: Raphael Michel <michel@rami.io>
2022-03-17 16:50:58 +01:00
Raphael MichelandGitHub a93287207b pretix Community Edition moves to AGPLv3-based license (#2023) 2021-04-12 10:33:47 +02:00
Raphael Michel 9eacd38ec7 PayPal: Improve handling of exceptions form paypalrestsdk 2020-06-12 13:21:44 +02:00
Raphael MichelandGitHub af23d6e4bf Upgrade to Django 3.0 and other dependencies (#1568)
* Upgrade Django to 3.0 and other dependencies to recent versions

* Fix otp version contsraint

* Remove six dependency

* Resolve some warnings

* Fix failing tests

* Update django-countries

* Resolve all RemovedInDjango31Warnings in test suite

* Run isort

* Fix import

* Update PostgreSQL version on travis
2020-03-23 15:02:20 +01:00
Raphael Michel 93cca34eab PayPal: Add scopes decorator to oauth_return 2019-06-20 19:29:23 +02:00
Raphael MichelandGitHub d85ddb5bda Integrate django-scopes (#1319)
* Install django-scopes

* Fix tests.api

* Update tasks and cronjobs

* Fix remaining tests

* Remove unused import

* Fix tests after rebase

* Disable scopes for get_Events_with_any_permission

* Disable scopes for a management command
2019-06-17 10:46:55 +02:00
Raphael Michel 87c7a3d26f PayPal: Even a canceled payment can still succeed 2019-03-08 11:33:03 +01:00
Martin GrossandRaphael Michel a3a63def55 Fix #369 -- Connect with PayPal (#1084)
* Connect with PayPal

* PayPal connect code-review fixes

* PayPal Connect: Global Env selection; Fix for payee-dict

* Fix missing PayPal Connect indicator for Endpoint

* Fix backwards compatibility
2018-11-21 11:14:33 +01:00
Raphael Michel 18a378976b Fix #571 -- Partial payments and refunds 2018-08-06 12:24:36 +02:00
Raphael Michel 5d9852b72c Fix paypal webhook receiver 2018-05-01 19:20:07 +02:00
Raphael Michel 4ef63d026e Stripe and PayPal: Issue warning on payments for paid orders 2018-04-12 12:55:15 +02:00
Raphael Michel 7baabcef96 Require correct permission for refunds in all cases 2018-04-04 12:52:36 +02:00
Raphael Michel 184c91cfbc Catch PaymentException on paypal return view 2017-11-01 21:28:19 +01:00
Raphael MichelandGitHub 9767243a6d Fix #277 -- Embeddable shop (#622)
* Vendor vue.js

* Refactor item_group_by_category to support vouchers

* Widget: Show product list

* Widget: free prices

* Widget: pictures and loading indicator

* Widget: First iframe steps

* Widget: Do not rerender iframe

* Widget: Error handling

* Improve widget

* Widget: localization tech

* Fix invoice style

* Voucher attribute and waiting list

* Add some iframe chrome

* First step to namespaced carts

* More isolation steps

* More cart isolation things

* More cart isolation things

* Mobile stuff

* Show cart on checkout pages

* PayPal and Stripe support

* Enable downloads

* Locale handling

* change text "save URL to this exact page"

* Widget: voucher redemption

* Widget: CSS

* CSS: Responsive

* Widget: CSS improvements

* Widget: Add embedding code generator

* Widget: Error messages and SSL check

* First tests

* Widget: tests

* Don't use IDs in widgets

* Widget: static files caching
2017-10-28 21:54:27 +02:00
Raphael MichelandGitHub 43b5140754 New handling of plugin URLs (#609) 2017-08-29 10:01:50 +03:00
Raphael Michel 1d2d9d8b99 PayPal: Event-independent webhooks 2017-07-23 12:38:41 +02:00
Raphael Michel 127086a50e Fix bug that lead to wrong payment amount when switching payment method to PayPal later 2017-05-10 19:12:55 +02:00
Raphael Michel 56bf3fe459 PayPal: Different types of webhooks 2017-01-15 21:28:54 +01:00
Raphael Michel b23d95b6c3 Fix #74 -- Warn if quota exceeds after payment 2017-01-04 19:19:58 +01:00
Raphael Michel 847997ea9b Fix #32 -- Add a PayPal webhook listener 2017-01-04 16:45:57 +01:00
Raphael Michel 2efde1669d PayPal: Refactor callback view 2016-11-29 16:33:27 +01:00
Flavia Bastos 8ef6439c44 Unify spelling of 'canceled'
Issue 187
Remove typeahead JS file.
2016-09-21 10:35:41 -06:00
Raphael Michel bc0c171921 Use native payment retrials for PayPal (fixes #33) 2016-03-10 15:58:14 +01:00
Raphael Michel d133d2abff Removed CleanerVersion layer [backwards-incompatible!] 2015-12-12 13:08:33 +01:00
Raphael Michel 3fa0cfb077 Added multi-domain capabilities 2015-10-18 14:01:28 +02:00
Raphael Michel c4638a3402 Enabled asynchronous cart/order actions 2015-10-05 11:33:53 +02:00
Raphael Michel e828d711bd Used isort to order all import statements 2015-07-19 20:46:34 +02:00
Raphael Michel 1f08dfda5c Resolved flake8 warnings 2015-06-28 17:02:12 +02:00
Raphael Michel 8b3eb14d73 Fixed script prefixes in absolute URLs 2015-06-18 15:35:11 +02:00
Raphael Michel 7f6e89213f Fixed #71 -- Consistent building of absolute URIs 2015-06-16 23:04:10 +02:00
Raphael Michel 3df19a7c73 Consistently use messages framework in control
simplify redirect(reserve()) calls
2015-05-22 10:01:33 +02:00
Raphael Michel 747a9e55fd Remove unused imports 2015-04-16 20:00:10 +02:00
Raphael Michel d981998a40 Proper namespaces for plugin URLs 2015-04-16 09:35:18 +02:00
Raphael Michel a67e09215b Add payment provider PayPal 2015-03-15 17:33:50 +01:00