Commit Graph
2598 Commits
Author SHA1 Message Date
Raphael Michel cb15559ac6 Scheduled export: Fix copying of email subject and text (Z#23221224) (#6616) 2026-09-29 16:44:42 +02:00
Mira Weller b1ae638394 [SECURITY] Escape help texts (CVE-2026-101270) 2026-09-29 14:30:53 +02:00
Raphael Michel 48f5a7c8cc [SECURITY] Fix information leak in widgets.json on dashboard (CVE-2026-101267, Z#23247172)
Thanks to Wenhao Wu, Southeast University
2026-09-29 14:30:53 +02:00
Aodhán Burke 4b320b6dab Fix typo: then -> than (#6615) 2026-09-29 10:16:54 +02:00
Richard Schreiber df74cbf5fc Remove Vue2-based widget (#6610)
* Remove Vue2-based widget

* move floatformat.js

* Delete docready.js

* Update widget.py
2026-09-29 10:14:21 +02:00
Richard Schreiber b06c9ef463 Control: do not fail on missing reason when user confirm (#6602) 2026-09-28 11:43:52 +02:00
9aeb4b9731 Organizer API: Add endpoint for event-meta-properties
* Add API-endpoint for event-meta-properties

* Add new doc-file to index, fix spelling and description

* Fix logentry

* Fix logentry again

* validate and add tests

* add meta_properties from organizer only

* fix choices validation

* filter unknown keys from choices due to django-formsets

* Apply batched suggestions from code review

Co-authored-by: Richard Schreiber <wiffbi@gmail.com>

* add safe-guard normalization to None to to_representation

* Apply batched suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* update tests to check for error-messages as well

* fix flake8

* fix permission tests

* Make ObjectListField more flexibel for re-use

* fix validation result

* Improve validation

* Change to I18nField for validation

* update MetaPropertyDictField

* fix docs for i18n strings

* make label_child configurable if MetaPropertyDictField should contain non-localized stuff

* undo test changes in events test

* fix flake8

* Apply batched suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* improve code formatting

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
Co-authored-by: Richard Schreiber <wiffbi@gmail.com>
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
2026-09-24 10:51:23 +02:00
Minding 9324887790 Translate OAuth buttons (#6590)
* Translate OAuth buttons

* Revert .po changes
2026-09-24 09:52:47 +02:00
Raphael Michel 806d0a5748 User details: Show list of 2FA devices and allow to reset drift (#6569)
* User details: Show list of 2FA devices

* Add reset button

* Reset throttle

* Refactoring

* Fix delete paths in tests
2026-09-23 17:51:10 +02:00
Raphael Michel 81764278ae Email settings: Collapse attendee texts if unused (Z#23243417) (#6535) 2026-09-23 14:00:56 +02:00
Raphael Michel 7d7474c07d Refund form: Do not allow individual negative amounts (#6579) 2026-09-22 12:47:06 +02:00
Raphael Michel 58023381b9 Merge branch 'refund-offset-perm-check' into 'master'
Offset refund: Do not allow to offset to order without access to

See merge request pretix/pretix!52
2026-09-22 12:46:20 +02:00
Raphael Michel e5c44e7aed Offset refund: Do not allow to offset to order without access to 2026-09-22 12:46:20 +02:00
Raphael Michel d77a179606 2FA: Show info on throttled request (#6581)
* 2FA: Show info on throttled request

* Round up the time
2026-09-22 10:38:26 +02:00
Raphael Michel 365051cc21 Event metadata: Fix server-side validation of write protection (#6578) 2026-09-22 10:00:15 +02:00
Raphael Michel 5c6b0eef6f Plugin configuration: Allow organizers to see all events (#6576) 2026-09-22 09:51:18 +02:00
Raphael Michel bcacff2ee7 Voucher list: Add budget and budget used to CSV export (Z#23237857) (#6520)
* Voucher list: Add budget and budget used to CSV export (Z#23237857)

* Fix failing test
2026-09-14 10:31:07 +02:00
Raphael Michel 1aea5633eb Discounts: Fix ManyToMany fields when cloning (#6547) 2026-09-11 18:35:37 +02:00
Richard Schreiber 86cc719651 Widget: serve vite by default, origin-whitelist for vue2 (#6403) 2026-09-11 08:53:42 +02:00
Kara Engelhardt 2aadfa2ce4 RRuleForm: allow selecting the fourth occurence of a weekday of a month (Z#23245893)
The fourth often is the same as the last, but not always. A weekday can appear five times in a month
2026-09-09 12:21:42 +02:00
Raphael Michel dd0d78242e PDF editor: Harden cached file access for background (Z#23242291) (#6446) 2026-09-09 11:13:29 +02:00
Raphael Michelandluelista 42c5de895c CachedFileField: Bind file access to session (Z#23242301) (#6447)
* CachedFileField: Bind file access to session (Z#23242301)

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2026-09-09 09:52:40 +02:00
Raphael Michelandluelista e91718e73b Password reset: Prevent race condition that uses token twice (Z#23242132) (#6448)
* Password reset: Prevent race condition that uses token twice

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2026-09-09 09:52:38 +02:00
Raphael MichelandLukas Bockstaller edb4069e18 Payment step: Allow to postpone payment choice on some sales channels (#6516)
* Payment step: Allow to postpone payment choice on some sales channels

* Add tests

* handle payment provider (de-)selection and partial payments (#6526)

---------

Co-authored-by: Lukas Bockstaller <bockstaller@pretix.eu>
2026-09-08 09:32:15 +02:00
Raphael Michel caa6fb187b VAT ID validation: Alternative API for German shops (#6507) 2026-09-02 17:48:38 +02:00
Richard Schreiber 6d4aba6e3d Questions: add min-length to string/text type questions (#6488)
* Questions: add min-length to string/text type questions

* fix test
2026-08-25 09:37:37 +02:00
b809d93bdc Do not hide subevent list if filtered list is empty (#6460)
* Do not hide subevent list if filtered list is empty

* Event calendar: Allow to show a message if no events are found

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Fix failures on org level

* add aria-hidden if no subevents

* Update src/pretix/base/settings.py

* Update src/pretix/base/settings.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-08-24 14:42:41 +02:00
Raphael Michelandluelista 58f331ba1f Allow to set payment term per sales channel (#6459)
* Allow to set payment term per sales channel

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2026-08-24 09:09:47 +02:00
Martin Gross 91a3993cef Seating: Set subevents to None if event has no subevents for _seat_allowed annotation (Z#23243880) (#6487) 2026-08-19 14:12:05 +02:00
luelistaandRichard Schreiber f8cc31b120 Order-level questions (#6471)
* New CheckoutSession model, created and deleted throught cart lifetime but only used for order-level question answers so far
* Order-level QuestionAnswers (relations to CheckoutSession / Order)
* New container_type field on Question model to specify whether Question belongs to order or orderposition
* Order-level questions are currently experimental, UI is hidden behind feature flag

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-08-14 14:56:45 +02:00
7fe31634e6 Allow RelativeDate in relation to a moment of order (#6160)
* initial implementation

* factor out _resolve_base_date

* add js to prevent illegal inputs

* fix tests

* Update src/pretix/base/reldate.py

Co-authored-by: Raphael Michel <michel@pretix.eu>

* Apply suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* move js includes of to fragment_js.html

* add type annotations

* moves logic from RelativeDateWrapper into RelativeDate and adds BaseChoice for configuring which models attributes support which relationship

* fix tests

* test upgrade behaviour

* Apply suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* move reldate.js include in correct file

* add OptionAttrsSelect to allow select options with their own attributes per value

* add a little bit of information to the tests for future reference

* rewrite reldate.js use data-attributes

* general cleanup

* add test for order.subevents cases

* use correct choice format

* remove order.subevent variants

* various cleanup

* Apply suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* remove empty docstrings

* add depreciation warning

* change event listener to pretix:bind-forms

---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
2026-08-12 15:37:29 +02:00
Raphael Michel ea792e76b2 Device list: Show online status (#6455)
* Device list: Show online status

* Fixes post-review
2026-08-06 09:07:20 +02:00
Raphael Michel 407728cc55 Bulk refund: Fix only first refund being made (Z#23239965) (#6376) 2026-08-05 11:46:52 +02:00
Raphael Michel 9fe25544c1 Email settings: Fix DMARC warning (#6452) 2026-08-05 11:04:56 +02:00
Raphael Michel e7657a3dd3 Prevent HTML injection in email preview (Z#23241741) 2026-08-05 10:56:46 +02:00
Raphael Michel 16040f70bb [SECURITY] Add missing permission check for view (CVE-2026-57532) 2026-07-28 12:24:59 +02:00
Raphael Michel 9b5ed06b2e Improve handling of reauth during async tasks (Z#23238978) (#6381) 2026-07-28 10:59:42 +02:00
Raphael Michel 163cf85c86 Orders: Fix N+1 query issues on order detail and change page (#6390)
* rders: Fix N+1 query issues on order detail and change page

There is one I couldn't fix: Loading the list of tax rules for every
select box on the OrderChange page. Unfortunately, Django has a
cache-breaking .all() in ModelChoiceField and that would need nasty
patching that didn't feel worth it

* Fix isort

* Fix N+1 query in gate call

* Fix leftovers

* Add local cache for objects referenced in log entries

* Update src/pretix/control/views/orders.py
2026-07-28 09:08:14 +02:00
Raphael Michel d9f8679647 Waiting list: Redirect back after voucher edit (Z#23230178) (#6252) 2026-07-27 23:19:10 +02:00
Raphael Michelandpajowu 1a7e36a144 Event-dashboard: Lazy-load warnings (#6421)
* Event-dashboard: Lazy-load warnings

I don't like this, it's not pretty, but we have no quick way of fixing
the overpaid orders check otherwise and a slow query on the event
dashboard feels really bad, because even if you don't wanna see the
dashboard ou are always going through it in navigation and that can get
very annoying very quickly.

* Update src/pretix/control/templates/pretixcontrol/event/dashboard_partial_warnings.html

Co-authored-by: pajowu <engelhardt@pretix.eu>

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
2026-07-27 14:40:34 +02:00
Raphael Michelandpajowu 9afc71c245 Update src/pretix/control/views/checkin.py
Co-authored-by: pajowu <engelhardt@pretix.eu>
2026-07-27 13:54:06 +02:00
Raphael Michel 1087db9529 Check-in history: Avoid JOINs
On a test dataset, this was a speedup from 18s to 900ms
2026-07-27 13:54:06 +02:00
Raphael Michel 351d2055f8 Log view: Disable counting the number of pages (Z#23241035) (#6414) 2026-07-24 12:17:48 +02:00
Raphael Michelandluelista ca03a2556d Log view: New filter form (#6412)
* Rework filter form for event log view

* Log view: New filter form

* isort

* Update src/pretix/control/forms/filter.py

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2026-07-23 17:35:18 +02:00
luelista cc082e2001 Improve CSP handling in vite integration; refactor CSP handling into helper functions (Z#23240534) (#6387) 2026-07-21 13:20:31 +02:00
5f2264daeb User email verifications: Add rate limiting (Z#23232834) (#6219)
* User email verifications: Add rate limiting (Z#23232834)

Also, refactor rate limiting into a central utility

* Make ip block work in dev

* Review notes

* Update src/pretix/base/forms/user.py

Co-authored-by: luelista <weller@rami.io>

* Apply suggestions from code review

Co-authored-by: luelista <mira@teamwiki.de>

* Add rate limit reset

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: luelista <mira@teamwiki.de>
2026-07-17 18:35:03 +02:00
Raphael Michel 49247062bc Drop second component from many time picker fields (#6150) 2026-07-17 17:42:51 +02:00
luelista 83e607b88d Fix double escaping in dashboard widgets (Z#23240769) (#6394) 2026-07-17 17:03:09 +02:00
Raphael Michel 4372aa6725 Devices: Allow admins to inspect raw info data (#6389) 2026-07-16 19:22:31 +02:00
luelista bf066909a7 Remove more usages of |safe (#6363)
* Replace |safe with |escapejson where appropriate
* Use JSON encoding for data-replace-with-qr
2026-07-16 13:14:37 +02:00