This changes the API of pretix.control.signals.event_dashboard_widgets and
pretix.control.signals.user_dashboard_widgets, such that the "content" key of
returned dictionaries must contain a SafeString if HTML therein is to be
rendered.
As a security precaution, we change the contract of some signals such that a
SafeString needs to be returned if HTML should be rendered without further
escaping.
Before, the `{% signal ... %}` and `{% eventsignal ... %}` template tags
called mark_safe themselves on all strings returned from signals. That could
lead to unsafe coding practices, where untrusted values are interpolated into
HTML format strings. However, such interpolations should usually be performed
using helpers such Django's format_html, which automatically escapes inputs
and returns a SafeString.
Now, we call conditional_escape on signal results, so that any HTML not explicitly
marked as safe gets escaped.
Most plugins are not affected by this change as they return a SafeString as a
result of Template.render already.
* First tabs
* Convert more pages
* Convert question page
* Item form
* Add item_formsets signal
* Revert "Add new signal nav_item"
This reverts commit 1ce613ff89.
* Formset is a word!
* Initial work on seating
* Add seat guids
* Add product_list_top
* CartAdd: Ignore item when a seat is passed
* Cart display
* product_list_top → render_seating_plan
* Render seating plan in voucher redemption
* Fix failing tests
* Add tests for extending cart positions with seats
* Add subevent_forms to docs
* Update schema, migrations
* Dealing with expired orders
* steps to order change
* Change order positions
* Allow to add seats
* tests for ocm
* Fix things after rebase
* Seating plans API
* Add more tests for cart behaviour
* Widget support
* Adjust widget tests
* Re-enable CSP
* Update schema
* Api: position.seat
* Add guid to word list
* API: (sub)event.seating_plan
* Vali fixes
* Fix api
* Fix reference in test
* Fix test for real
* [WIP] Implement automatic spell-check for docs
fixes#663
The only thing unclear to me so far is how the output of `make spelling`
should be checked - is there a possibility to check for a file (i.e.
`_build/spelling/output.txt`) to be empty, and report a failed build
otherwise?
* fix typo in requirements.txt
* add enchant library
* travis should report errors, order spelling wordlist
* change travis.yml to easier troubleshoot build issues
* fixed more typos, added more words
* add more words, fix more typos
* added more words
* added more words
* revert changes to .travis.yml
