Commit Graph

1055 Commits

Author SHA1 Message Date
Raphael Michel
df0b580dd6 Pluggable permissions (#5728)
* Data model draft

* Refactor query and assignment usages of old permissions

* Backend UI

* API serializer

* Big string replace

* Docs, tests and fixes for teams api

* Update docs for device auth

* Eliminate old names

* Make tests pass

* Use new permissions, remove inconsistencies

* Add test for translations

* Show plugin permissions

* Add permission for seating plans

* Fix plugin activation

* Fix failing test

* Refactor to permission groups

* Update doc/api/resources/devices.rst

Co-authored-by: luelista <weller@rami.io>

* Update doc/api/resources/events.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/api/serializers/organizer.py

Co-authored-by: luelista <weller@rami.io>

* Fix typo

* Fix python version compat

* Replacement after rebase

* Add proper permission handling for exports

* Docs for exporters

* Runtime linting of permission names

* Fix typos

* Show export page even without orders permission

* More legacy compat

* Do not strongly validate before plugins are loaded

* Rebase migration

* Add permission for outgoing mails

* Review notes

* Update doc/api/resources/teams.rst

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Clean up logic around exporters

* Review and failures

* Fix migration leading to forbidden combination

* Handle permissions on event copying

* Remove print-statements

* Make test clearer

* Review feedback

* Add AnyPermissionOf

* migration safety

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-03-17 14:43:56 +01:00
Raphael Michel
bf80dc37c5 Navigation and dashboard: Hide useless items (#5995)
* Navigation and dashboard: Hide useless items

If a user has access to *no organizer teams*, hide a number of things
from navigation and dashboard. This happens e.g. if a user only has
permissions in scope of the pretix-resellers or pretix-scheduling
plugins.

* New mechanism
2026-03-17 10:26:22 +01:00
Raphael Michel
4f449ce6b4 Mail: Handle all rendering in mail.py, return values for log (#5895)
* Mail: Handle all rendering in mail.py, return values for log

* Apply suggestions from code review
2026-03-10 09:53:09 +01:00
Kara Engelhardt
f3fb1e66dc Fix waiting list availability calculation if WL vouchers have seats (Z#23226856) 2026-03-09 17:18:47 +02:00
Richard Schreiber
a25bca7471 Fix static instance name in emails (Z#23224360) (#5914) 2026-02-25 13:19:53 +01:00
luelista
da43984ad2 Add datasync logging (Z#23225588) (#5928)
* Fix inconsistent log messages

* Add logging for successfully synced orders

(debugging orders that might get silently skipped)
2026-02-25 09:49:52 +01:00
Raphael Michel
8a7f54795e Vouchers: Fix field label inconsistency (Z#23222887) (#5902)
The field Voucher.price_mode is sometimes called "Price mode" and
sometimes "Price effect" in the UI, which is inconsistent. I think
"price effect" is a little clearer, but I don't really care as long as
it is consistent.
2026-02-17 10:16:12 +01:00
Raphael Michel
2d2663f15f Mark strings as formatted to prevent double-formatting 2026-02-13 12:28:32 +01:00
Phin Wolkwitz
db982c9ef4 Presale: Hide adress info from invisible fields in confirmation step (Z#23212149) (#5649)
Not all transmission fields are visible to users at all times, depending on whether they are necessary for users to know/change but they are submitted for the backend. This change hides those fields that were hidden before in the confirmation step as well to avoid confusion.
2026-02-11 13:14:05 +01:00
Lukas Bockstaller
99c257d392 adds webhooks for giftcards (Z#23205473) (#5834)
* adds giftcard webhook events

* maps issuer_id of giftcard to organizer_id for logging

* adds new giftcard logtypes for transactions that aren't manual

* log_action calls cleanup

* drop acceptance webhook

* add acceptor_id to the giftcard transaction webhook event

* add missing log_action statements

* add new webhooks to docs

* fix tests

* fix linting
2026-02-11 12:51:09 +01:00
Raphael Michel
47f409171d Customer accounts: Add security notices (#5705)
* Customer accounts: Add security notices

* Apply suggestions from code review
2026-02-10 17:55:53 +01:00
Raphael Michel
c40e34af57 Model-based mail queuing 2026-01-30 10:43:02 +01:00
Lukas Bockstaller
ed618f2f32 add tiered availability by time (Z#23204747) (#5737)
* add tiered availability by time

* replace bitwise operator

* rephrase help text
2026-01-20 10:32:17 +01:00
Lukas Bockstaller
a900e11ce0 Reduce queries for waitinglist autoassign n+1 (PRETIXEU-BJJ) (#5819)
* baseline of 574 queries

* reuse event from wle for locked_wle

reduces amount of queries to 556

* keep event accross refresh from db

drops queries from 556 to 471, halving the amount of queries for direct fetches for the event

* make numbers of queries reproducible by prewarming ContentTypeCache

* fix oversight

* correct number of queries to 335

* remove debug tooling

* remove assert_num_queries
2026-01-20 10:31:58 +01:00
Richard Schreiber
112d5da792 Localize state names (#5744)
* Localize state names in js-helper

* localize statename in address-confirm

* add localized state_name to AbstractPosition and AttendeeProfile

* use state_for_address in order export
2026-01-20 10:13:20 +01:00
Raphael Michel
0259899e00 Discount: Respect addon grouping in line selection (Z#23220058) (#5782)
* Discount: Respect addon grouping in line selection (Z#23220058)

* Update src/pretix/base/models/discount.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-01-16 15:23:59 +01:00
George Hickman
1e0e16642d Add more log entry types to the org-level logs page (#5787)
* Add more log entry types to the org-level logs page

all_logentries() limits the QuerySet to LogEntrys whose content object
is an Organizer.

This change expands that to get any LogEntry linked to the current
Organization.  It removes those that are linked directly to an Event,
since they are already served by the event-level logs page.

* Check active plugins with either Event or Organizer
2026-01-16 13:36:23 +01:00
Lukas Bockstaller
dfd53f0ea2 Waitinglist: lock entry to mitigate race-conditions when creating the voucher 2026-01-15 16:09:41 +01:00
Raphael Michel
aa9c478c30 [SECURITY] Prevent access to arbitrary cached files by UUID (CVE-2025-14881) 2025-12-19 12:59:21 +01:00
Raphael Michel
b895d9bbca Import large package lazily to speed up startup (#5636)
* Import large package lazily to speed up startup

* Make all jsonschema imports lazy
2025-12-09 09:52:53 +01:00
Richard Schreiber
1a40215e91 Fix N+1 queries in API (#5684)
* Fix N+1 query in API quotas list

* fix membership N+1

* fix vouchers N+1 budget_used

* rename and reuse Voucher.annotate_budget_used_orders to budget_used

* fix flake8
2025-12-03 15:37:40 +01:00
Raphael Michel
bdd94b1f8a Add prioritization to webhook/notifications queue (#5513)
* Add prioritization to webhook/notifications queue

* Add missing code

* Missing license header

* Fix argument

* Use redis pipeline

* Update license header
2025-12-02 09:13:01 +01:00
Richard Schreiber
313f4f326b Fix program times having no item in clean (#5635)
This error occurs only when adding a program-time form in the frontend and not saving it, but removing it again and then saving the item.
2025-11-18 14:59:31 +01:00
Richard Schreiber
d7b6856322 Fix not allowing program times on event series (API/copy) (#5595)
* Fix not allowing program times on event series (API/copy)

* Return 400 when reading endpoint in event series

* add docs program times not available on event series

* fix isort
2025-11-17 15:36:53 +01:00
Raphael Michel
7741e9f936 Remove misleading helptext (fixes #3555) 2025-11-14 17:45:55 +01:00
Raphael Michel
ef9863518b Fix syntax error 2025-11-14 09:57:29 +01:00
Raphael Michel
eb740204d4 Invoice issuer address: Add state field (#5603)
* Invoice issuer address: Add state field

* Update src/pretix/base/settings.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/base/models/invoices.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-11-14 09:56:46 +01:00
luelista
1cb2d443f9 Validation of user email addresses (#5434)
* Validation of user email addresses
* Improve email and password change forms
2025-11-07 11:17:34 +01:00
Phin Wolkwitz
fd9d03786b Add program times for items (Z#23178639)
* Add program times for items

* Fix frontend date validation

* Add ical data for program times [wip]

* Improve ical data for program times

* Remove duplicate code and add comments

* Adjust migration

* Remove program times form for event series

* Add pdf placeholder [wip]

* Improve explanation text with suggestion

Co-authored-by: Raphael Michel <michel@pretix.eu>

* Fix import sorting

* Improve ical generation

* Improve ical entry description

* Fix migration

* Add copyability for program times fot items and events

* Update migration

* Add API endpoints/functions, fix isort

* Improve variable name

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Remove todo comment

* Add documentation, Change endpoint name

* Change related name

* Remove unnecessary code block

* Add program times to item API

* Fix imports

* Add log text

* Use daterange helper

* Add and update API tests

* Add another API test

* Add program times to cloning tests

* Update query count because of program times query

* Invalidate cached tickets on program time changes

* Reduce invalidation calls

* Update migration after rebase

* Apply improvements to invalidation from review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* remove unneccessary attr=item param

* remove unnecessary kwargs for formset_factory

* fix local var name being overwritten in for-loop

* fix empty formset being saved

* Use subevent if available

* make code less verbose

* remove double event-label in ical desc

* fix unnecessary var re-assign

* fix ev vs p.subevent

---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-11-06 12:24:47 +01:00
Richard Schreiber
0b46982e6d Allow blocked seats to be booked in backend (#5585) 2025-11-06 08:02:42 +01:00
Raphael Michel
3e972eddbf Allow to round taxes on order-level (#5019)
* Allow to round taxes on order-level

* Rename get_cart_total

* Persist rounding mode with order

* Add general docs

* Order creation API

* Update fee algorithm

* Rounding on payment method change

* Round when splitting order

* Fix failing tests

* Add settings page

* Add tests

* Replace algorithm

* Add test case for currency rounding

* Improve order change

* Update flowchart

* Update discount logic (more hypothetical, we don't store rounding on cart positions atm)

* Rename internal method

* Fix typo

* Update help text

* Apply suggestions from code review

Co-authored-by: luelista <weller@rami.io>

* Order rounding refactor (#5571)

* Add RoundingCorrectionMixin providing before-rounding-values as properties

* Use gross_price_before_rounding in more places

* Update doc/development/algorithms/pricing.rst

Co-authored-by: Martin Gross <gross@rami.io>

* Allow to override on perform_order

* Rebase migration

* Fix event cancellation

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Martin Gross <gross@rami.io>
2025-10-30 11:49:31 +01:00
Phin Wolkwitz
8a3da37b45 Connect giftcards with customer accounts (#5126)
Connect giftcards with customer accounts, show giftcards during checkout and in account , show giftcard list in backend customer view
2025-10-16 13:20:00 +02:00
Raphael Michel
a1d078b48e Migrate LogEntry.object_id to bigint (#5520) 2025-10-15 09:06:38 +02:00
Martin Gross
adca856cdb Make item_overrides and var_overrides prefetch_related-able 2025-10-13 11:33:07 +02:00
Raphael Michel
177a7d07fc Update license header (#5540) 2025-10-10 15:32:46 +02:00
Raphael Michel
15cbb3a416 Do not crash if generate_invoice fails (#5483)
* Do not crash if generate_invoice fails

* Add logging

* Add cancellation to try block

* One last thing…
2025-10-07 11:20:31 +02:00
Raphael Michel
7e8da3cef6 Do not sent "payment failed" email if payment is no longer expected (Z#23202699) (#5509) 2025-10-06 09:24:20 +02:00
Raphael Michel
457115f4ca Add refund comment to gift card transaction text (Z#23208349) (#5499)
* Add refund comment to gift card transaction text (Z#23208349)

* Update src/pretix/base/models/giftcards.py

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2025-10-02 09:38:32 +02:00
Raphael Michel
fc4a9406e1 Invoicing: Allow plugins to add data (#5452)
* Allow plugins to add data to invoices

* Add documentation
2025-09-29 13:15:42 +02:00
Raphael Michel
9d2ef94389 Invoicing: Configurable service date 2025-09-29 13:15:42 +02:00
Raphael Michel
5bd08061a1 Organizer: Don't override explicit plugins with default plugins 2025-09-12 11:01:49 +02:00
Raphael Michel
0183f3d40f Invoice email transmission: Handle permanent failures (Z#23205576) (#5420)
* Invoice email transmission: Handle permanent failures (Z#23205576)

* Add missing raise branch

* Fix missing file

* Fix missing license header
2025-09-09 10:21:58 +02:00
Raphael Michel
c501066cff Event calendar: Only show "waiting list" if products allow it (Z#23205941) (#5436)
* Event calendar: Only show "waiting list" if products allow it

* Add a simple test

* Review notes

* Update src/pretix/base/models/event.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/base/models/event.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-09-08 09:56:57 +02:00
Raphael Michel
e591c74862 Hotfix crash PRETIXEU-C0F 2025-08-20 08:44:33 +02:00
Raphael Michel
05c74b7ad6 Pluggable invoice transmission methods (#5020)
* Flexible invoice transmission

* UI work

* Add peppol and output

* API support

* Profile integration

* Simplify form for individuals

* Remove sent_to_customer usage

* more steps

* Revert "Bank transfer: Allow to send the invoice direclty to the accounting department (#2975)"

This reverts commit cea6c340be.

* minor fixes

* Fixes after rebase

* update stati

* Backend view

* Transmit and show status

* status, retransmission

* API retransmission

* More fields

* API docs

* Plugin docs

* Update migration

* Add missing license headers

* Remove dead code, fix current tests

* Run isort

* Update regex

* Rebase migration

* Fix migration

* Add tests, fix bugs

* Rebase migration

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Make migration reversible

* Add TransmissionType.enforce_transmission

* Fix registries API usage after rebase

* Remove code I forgot to delete

* Update transmission status display depending on type

* Add testmode_supported

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* New mechanism for non-required invoice forms

* Update src/pretix/base/invoicing/transmission.py

Co-authored-by: luelista <weller@rami.io>

* Declare testmode_supported for email

* Make transmission_email_other an implementation detail

* Fix failing tests and add new ones

* Update src/pretix/base/services/invoices.py

Co-authored-by: luelista <weller@rami.io>

* Add emails to email history

* Fix comma error

* More generic default email text

* Cleanup

* Remove "email invoices" button and refine logic

* Rebase migration

* Fix edge case

---------

Co-authored-by: luelista <weller@rami.io>
2025-08-19 17:59:45 +02:00
Raphael Michel
0cc8e59bb0 Webhooks: Add vouchers (Z#23203072) (#5360)
* Webhooks: Add vouchers (Z#23203072)

This also requires more consistent usage of webhook types to avoid
vouchers not being known to the external system.

* Update src/pretix/api/webhooks.py

Co-authored-by: luelista <weller@rami.io>

* Fix shredder test

---------

Co-authored-by: luelista <weller@rami.io>
2025-08-19 13:04:22 +02:00
Raphael Michel
a51a6123f5 Organizer-level plugins (#5305)
* Add version notes to the docs

* Adapt signal handling

* Add UI

* Add API

* API and tests

* Fix registry

* Update doc/development/api/plugins.rst

Co-authored-by: Felix Rindt <felix@rindt.me>

* Fix failing tests

* Apply suggestions from code review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugin_events.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugins.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugins.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/navigation.py

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/urls.py

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @wiffbi

* REbase migration

* Fix review note

* Fix test cases

* Remove plugin from all events if disabled on org level

* Update doc/development/api/plugins.rst

* Unify registries

* Rebase migration

---------

Co-authored-by: Felix Rindt <felix@rindt.me>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: luelista <weller@rami.io>
2025-08-19 11:33:34 +02:00
Raphael Michel
626d7ecc90 Upgrade to hierarkey 2.0 (#5373)
* Upgrade to hierarkey 2.0

* Fix duplicate setting of timezone

* Rebase migration
2025-08-18 11:41:57 +02:00
Raphael Michel
650b4b461f Voucher: Add creation date (Z#23202621) (#5359)
* Voucher: Add creation date (Z#23202621)

* Migration fix

* Update doc/api/resources/vouchers.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/base/migrations/0285_voucher_created.py

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2025-08-18 10:56:53 +02:00
Raphael Michel
807df01f5d Checkout: Delete invoice address if no longer required (Z#23203488) (#5358) 2025-08-08 15:56:35 +02:00