Commit Graph

231 Commits

Author SHA1 Message Date
rash
f04df7a6ee Migrate vue2 control components and widget to vue3 and vite (#5989)
* setup vite and integrate fully with django

- vite starts with `python manage.py runserver`
- add templatetags to simply load vite hmr and entry points
- add eslint (recheck rules)
- enable non-strict ts

* better syntax for cors header setting

* migrate checkin rules editor to vue3

- move constants to a module
- move reading from and writing to non-vue html to django interop module
- switch to composition api and script setup sfc with pug
- use optional chaining operators a lot to simplify code

* migrate webcheckin plugin to vite+vue3

- migrate vue sfcs to script setup and pug
- move fetch calls into a api.ts module
- move common formatting and i18n strings into module

* fix migration error

* first draft migrating widget to vue3/vite

* first couple widget e2e tests

courtesy of claude
most of the tests don't work yet

* test file is not actually used

* drop widget_ prefix from e2e test fixtures

* add test for complete widget journey for simple event

* switch timezone in e2e tests to Europe/Berlin

* make dates in e2e tests relative

* migrate widget bugfix #5886

* start testing event series widget

* working vite widget setup for prod (untested), local dev (with or without dev server) and pytests, with flags for running the old version or the vite version

* simplify e2e test iframe check

* less flaky e2e tests

* top level await in iife build mode is not supported, so let's do import.meta.glob instead (we just need the build step not to see await, the code doesn't actually ever get loaded because it's DEV only)

* fix inconsistencies from automatic migration

* Allow gradual rollout of new vite-based widget by adding urls to an allowlist that gets checked against the "Origin" http header of request fetching the widget js

* add e2e tests for widget button, testing empty cart, adding specific items, and subevents

* remove janky claude testts again

* resolve migration TODOs: properly refocus parent on navigations

* use `npm run dev:control` for the vite dev server for admin components

* upgrade npm dependencies

* fix js linter errors

* fix python linter errors

* build all control vue components

* add new js config files to check-manifest ignore

* working prod build

acutal serving of built assets not tested yet

* fix templatetag paths to match what's in the vite mantifest

* add missing quotes around 'unsafe-eval' cors value

* remove now unused old vue2 tooling

* try fixing e2e test ci

* fix flake8 error

* check if vite build artefacts are in the wheel

* add license headers

* remove dom manipilation code necessary for `div.pretix-widget-compat` to work. No longer needed for vue3

* remove superfluous `createElement` calls

They might have been there because of IE, which is no longer relevant

* make widget dev mode parametizable through query params and document the usage and those params

* fix rst syntax

* remove migration todos file

Co-authored-by: luelista <mira@teamwiki.de>

* rearrange dockerfile commands for smaller image, thanks @luelista

* Update .gitignore, adding .vite

Co-authored-by: luelista <mira@teamwiki.de>

* add eslint CI

* make vue dev work in plugins

* fix docker build

* rebuild vite setup to support static prod plugins and dynamic hmr plugin development

* use toml for vite plugin config instead of standalone json file

* Add widget changes from #6047, #6149

* Allow buttons to reuse cart (Z#23226853)

* Always keep cart of buttons with items set

* widget: handle cart if not same-site (#6149)

---------

Co-authored-by: luelista <mira@teamwiki.de>
Co-authored-by: Kara Engelhardt <engelhardt@pretix.eu>
2026-05-11 15:05:06 +02:00
Raphael Michel
0aee73a9bd Quotas: Add bulk-edit, bulk-delete and filter form (#6080)
* Quotas: Add bulk-edit, bulk-delete and filter form

* Fix GroupConcat

* Apply suggestions from code review

Co-authored-by: Richard Schreiber <wiffbi@gmail.com>

* Review notes

* Fix handling of required fields

---------

Co-authored-by: Richard Schreiber <wiffbi@gmail.com>
2026-05-04 12:44:22 +02:00
Raphael Michel
921fd801e5 Thumbnails: Perform color space transform before resizing (Z#23232101) (#6120) 2026-04-28 15:35:27 +02:00
Raphael Michel
f50548cd02 Fix crash on build 2026-04-10 10:34:15 +02:00
Raphael Michel
bb450e1be9 Add default protection for SSRF 2026-04-10 10:34:15 +02:00
Phin Wolkwitz
c143d50290 Update django to 5.2 2026-03-24 16:33:28 +01:00
Raphael Michel
df0b580dd6 Pluggable permissions (#5728)
* Data model draft

* Refactor query and assignment usages of old permissions

* Backend UI

* API serializer

* Big string replace

* Docs, tests and fixes for teams api

* Update docs for device auth

* Eliminate old names

* Make tests pass

* Use new permissions, remove inconsistencies

* Add test for translations

* Show plugin permissions

* Add permission for seating plans

* Fix plugin activation

* Fix failing test

* Refactor to permission groups

* Update doc/api/resources/devices.rst

Co-authored-by: luelista <weller@rami.io>

* Update doc/api/resources/events.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/api/serializers/organizer.py

Co-authored-by: luelista <weller@rami.io>

* Fix typo

* Fix python version compat

* Replacement after rebase

* Add proper permission handling for exports

* Docs for exporters

* Runtime linting of permission names

* Fix typos

* Show export page even without orders permission

* More legacy compat

* Do not strongly validate before plugins are loaded

* Rebase migration

* Add permission for outgoing mails

* Review notes

* Update doc/api/resources/teams.rst

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Clean up logic around exporters

* Review and failures

* Fix migration leading to forbidden combination

* Handle permissions on event copying

* Remove print-statements

* Make test clearer

* Review feedback

* Add AnyPermissionOf

* migration safety

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-03-17 14:43:56 +01:00
George Hickman
dfaa4c3359 Add session_login function (#5955)
* Add session_login function

* Make helper do more things and use it

---------

Co-authored-by: Raphael Michel <michel@rami.io>
2026-03-16 17:39:04 +01:00
Raphael Michel
769e1312d4 Revert "Disable partitioned cookies for Safari due to WebKit bugs (#5843)"
This reverts commit fbd8bbbeaa.
2026-02-20 10:08:51 +01:00
Kian Cross
fbd8bbbeaa Disable partitioned cookies for Safari due to WebKit bugs (#5843)
Safari currently exhibits a bug where Partitioned cookies (CHIPS) are not
sent back to the originating site after multi-hop cross-site redirects,
breaking SSO login flows in pretix.

Partitioned cookies were initially introduced in Safari 18.4, removed
again in 18.5 due to a bug, and reintroduced in Safari 26.2, where the
current issue is present.

As a mitigation, disable sending the `Partitioned` attribute for Safari
user agents. This is intentionally conservative; once the Safari issue
is fixed, this check should be refined to be conditional on the affected
versions only.

WebKit issues:

  - https://bugs.webkit.org/show_bug.cgi?id=292975
  - https://bugs.webkit.org/show_bug.cgi?id=306194
2026-02-18 09:19:14 +01:00
Raphael Michel
43c6c33bd8 SafeFormatter: Ignore conversion spec 2026-02-13 12:35:49 +01:00
Raphael Michel
2d2663f15f Mark strings as formatted to prevent double-formatting 2026-02-13 12:28:32 +01:00
Richard Schreiber
3a3ae6e66c Fix custom pycountry_add index handling (#5869) 2026-02-02 09:41:32 +01:00
Raphael Michel
c40e34af57 Model-based mail queuing 2026-01-30 10:43:02 +01:00
Raphael Michel
4edc7d95c6 Address form: Add missing province Aosta for Italy (#5796) (#5800) 2026-01-26 10:00:11 +01:00
Raphael Michel
62bc16f963 Translation status: Properly account for plurals 2026-01-07 09:20:37 +01:00
dependabot[bot]
59c09e27fd Update django-phonenumber-field requirement from ==7.3.* to ==8.3.* (#5522)
* Update django-phonenumber-field requirement from ==7.3.* to ==8.3.*

Updates the requirements on [django-phonenumber-field](https://github.com/stefanfoulis/django-phonenumber-field) to permit the latest version.
- [Release notes](https://github.com/stefanfoulis/django-phonenumber-field/releases)
- [Changelog](https://github.com/stefanfoulis/django-phonenumber-field/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/stefanfoulis/django-phonenumber-field/compare/7.3.0...8.3.0)

---
updated-dependencies:
- dependency-name: django-phonenumber-field
  dependency-version: 8.3.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Remove invalid geo codes

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Raphael Michel <michel@rami.io>
2026-01-05 17:31:39 +01:00
dependabot[bot]
cc5693017e Update django-countries requirement from ==7.6.* to ==8.2.* (#5660)
* Update django-countries requirement from ==7.6.* to ==8.2.*

Updates the requirements on [django-countries](https://github.com/SmileyChris/django-countries) to permit the latest version.
- [Changelog](https://github.com/SmileyChris/django-countries/blob/main/CHANGES.md)
- [Commits](https://github.com/SmileyChris/django-countries/compare/v7.6...v8.2.0)

---
updated-dependencies:
- dependency-name: django-countries
  dependency-version: 8.2.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update our helpers

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Raphael Michel <michel@rami.io>
2026-01-05 16:55:05 +01:00
Raphael Michel
bb5a9bdbf1 PDF rendering: Do not create TTFont if already cached (#5748)
This provides a massive speedup for invoice rendering
2026-01-05 12:15:35 +01:00
luelista
e1f5678d7c Refactor payment QR code generation code and add SPAYD format (#5680)
Move generation of QR code contents out of the HTML template and into Python code, so it can
be reused in plugins and tested with unit tests. Add the SPAYD QR code format which is used in
Czech Republic and Slovakia [1]. Display BezahlCode QR codes only for German IBANs.

[1] https://en.wikipedia.org/wiki/Short_Payment_Descriptor
2025-12-04 14:15:29 +01:00
Raphael Michel
bdd94b1f8a Add prioritization to webhook/notifications queue (#5513)
* Add prioritization to webhook/notifications queue

* Add missing code

* Missing license header

* Fix argument

* Use redis pipeline

* Update license header
2025-12-02 09:13:01 +01:00
Raphael Michel
9f263fbe4f Hotfix linkified placeholders (#5663)
* Fix linkify placeholders

* Add URL test
2025-11-27 13:20:13 +01:00
Raphael Michel
fdd34f387a [SECURITY] Prevent HTML injection through placeholders in emails
Co-authored-by: luelista <weller@pretix.eu>
2025-11-27 11:41:27 +01:00
Raphael Michel
db7518735a Allow admins to inspect invoices (#5641)
This is helpful to debug invoice renderers or non-PDF invoices like
Peppol or other XML formats
2025-11-19 14:42:18 +01:00
Raphael Michel
6190b93f89 Stop using ordinal numbers in English date represenation (Z#23210534) (#5539)
* Stop using ordinal numbers in English date represenation (Z#23210534)

* ADjust more tests
2025-10-15 09:06:54 +02:00
Raphael Michel
177a7d07fc Update license header (#5540) 2025-10-10 15:32:46 +02:00
Raphael Michel
85a9a3caa6 Run exporters in repeatable read by default (Z#23173095) (#5500)
* Run exporters in repeatable read by default (Z#23173095)

* Update src/pretix/helpers/database.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Rename parameter, add test

* Do not run during tests

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-10-06 10:38:19 +02:00
Danny Adair
cd6fbd886c Add support for New Zealand (en-nz) date/time formats (#5449)
- Implement en-NZ specific formatting in daterange.py
- Create en_NZ/formats.py with NZ-compliant formats
2025-09-09 15:05:51 +02:00
Richard Schreiber
24ac588119 Remove unnecessary translation for daterange (Z#23205453) (#5410)
* Remove unnecessary translation for daterange

* fix flake8

* fix isort
2025-09-02 09:22:21 +02:00
Raphael Michel
b9e627a86c PDF: Add font fallback on a pragraph level (Z#23203886) (#5367)
* PDF: Add font fallback on a pragraph level (Z#23203886)

* Fix empty texts
2025-08-13 10:51:23 +02:00
Raphael Michel
99e10adad4 Revert "PDF: Add font fallback on a pragraph level (Z#23203886)"
This reverts commit 10b5f76356.
2025-08-12 15:51:43 +02:00
Raphael Michel
10b5f76356 PDF: Add font fallback on a pragraph level (Z#23203886) 2025-08-12 15:51:13 +02:00
Raphael Michel
89d8ca0fc2 Add two more country translations (Z#23166278) 2025-08-05 09:28:34 +02:00
Raphael Michel
a5b773924c Hotfix for country names (Z#23166278) 2025-08-04 14:39:57 +02:00
Raphael Michel
e2ae553c69 Add Spanish (LatAm) and improve how we count language coverage (Z#23200505) (#5308)
* Add Spanish (LatAm) and improve how we count language coverage

* Apply suggestions from code review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Fix license header

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-07-17 17:06:25 +02:00
luelista
5962536a11 Dialog for cart renewal, async task without page refresh (#5148)
* async_task: deduplicate response handling code

* extend cart without full page reload

* update dialog markup

* fix error response from CartExtend

* refactor asynctask, make sure waitingDialog.show() re-initializes dialog contents

* add cart expiry notification

* add aria references to other dialogs

* improve error handling

* fix error if max_extend=None

* different message for expiring soon and expired carts

* refactor dialog css

* add classes to further dialog elements

* switch extend-cart-dialog and loadingmodal to <dialog>

* Backport simple_block_tag from Django 5.2

* Use simple_block_tag for {% dialog %} tag

* add alertdialog role

* Update src/pretix/static/pretixbase/scss/_dialogs.scss

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* fix mobile dialog styles not being overwritten

* asynctask dialog: prevent close by escape on chrome

* remove dynamic aria-live from #cart-deadline

dynamic aria-live is generally not well supported and as we have the dialog now anyways, we can remove it

* move continue-button to right

* Update src/pretix/static/pretixpresale/js/ui/cart.js

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Fix CSS for old-style dialog

* fix heading display/level

* align dialogs at the top as they originally were

* fix </div> from merge-conflict

* fix missing grow for dialog-content

* improve cart-extend-button ui

* do not show cart-extend-dialog onload

* improve message if 0 minutes

* do not save messae in session if ajax_dont_redirect

* add ajax_dont_redirect to async_task_check_url

* improve draw_deadline to only update #cart-deadline if necessary

* add renew-confirmation-message

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: Raphael Michel <michel@rami.io>
2025-05-27 07:17:50 +02:00
luelista
d926030bf6 Event list: fix parsing of date query parameter (#5047)
Use the same localization formats as used when generating the value
2025-05-02 10:22:04 +02:00
Richard Schreiber
1a1948e3fa [A11y] Improve HTML-output for date-ranges 2025-03-27 13:21:25 +01:00
Mira
addba1ff57 Display "Order status" correctly in the "Search query" line of advanced search results (#4926) 2025-03-18 14:24:24 +01:00
Martin Gross
148a3b2933 MetricsMiddleware: Do not record pretix_view_duration_seconds for urls with no url.url_name (#4784) 2025-01-27 16:46:58 +01:00
Raphael Michel
045edc7cec Invoice rendering: Remove transparency from logos (Z#23179391) (#4762)
* Invoice rendering: Remove logos from transparency

* Add comment
2025-01-21 15:03:43 +01:00
Raphael Michel
2dc625cf31 Add the option to introduce rich-text placeholders (#4657)
* Add the option to introduce rich-text placeholders

* Add tests in test_format

* Add some css

* Block vs inline

* Some fixed css

* Update src/pretix/control/forms/event.py

Co-authored-by: Mira <weller@rami.io>

* Add missing docstring prat

---------

Co-authored-by: Mira <weller@rami.io>
2024-12-03 11:38:15 +01:00
Mira
91e69f793d Show weekday in subevent dates [Z#23161884] (#4383) 2024-08-27 22:22:44 +02:00
Raphael Michel
4f9297e7d8 Show minimal check-in status in order export (Z#23154920) (#4223)
* Show minimal check-in status in order export (Z#23154920)

* Update src/pretix/helpers/database.py

Co-authored-by: Mira <weller@rami.io>

* Review note

---------

Co-authored-by: Mira <weller@rami.io>
2024-06-24 17:34:10 +02:00
Raphael Michel
39caadb335 Compatibility of safe_openpyxl with openpyxl==3.1.3 2024-06-10 17:19:29 +02:00
Mira
dd6ebd7a48 Improve validation of email templates (#4184)
* Improve validation of email templates

* simplify SafeFormatter (skip attribute access code path altogether instead of blocklisting characters)

* let SafeFormatter optionally raise on missing key

* simplify placeholder validation

* rename parameter

* Remove unused import

---------

Co-authored-by: Raphael Michel <michel@rami.io>
2024-06-10 16:41:52 +02:00
Raphael Michel
7365f165ad Thumbnails: Keep frame durations of GIFs (#4183) 2024-06-04 21:53:20 +02:00
Martin Gross
42f3ca9661 SecHelper: Fix typo in logging statement 2024-04-24 18:13:27 +02:00
Raphael Michel
b2842ec3a0 Checkin: Allow to use presence state in rules (#4061) 2024-04-18 13:15:31 +02:00
Raphael Michel
0c998ca884 Remove special handling of translations in pretix/helpers 2024-04-03 12:43:20 +02:00