CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-09-30 19:04:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
14,568 Commits 423 Branches 218 Tags
6687d475f230c19a97cfe09a6628d1d38d1b1111
Commit Graph
14568 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Raphael Michel 6687d475f2 Bump hierarkey to 2.0.2 2026-09-29 13:52:11 +02:00
Raphael Michel 7ef22971c6 [SECURITY] API: Fix session validation for uploaded files (CVE-2026-101269, Z#23247174) 2026-09-29 13:40:38 +02:00
Mira Weller d2ba4b7733 Block out of bounds image crop dimensions (Z#23245937 / PRT-009) 2026-09-29 13:40:18 +02:00
Mira Weller 81e004e6c8 Prevent parsing non-standard-compliant JSON float values (Z#23245937 / PRT-021) 2026-09-29 13:40:18 +02:00
Mira Weller d8fe665798 Fix potential infinite loop in pdf render (Z#23245937 / PRT-021) 2026-09-29 13:40:18 +02:00
Mira Weller b7117bb3a3 Fix inefficient loop in compute_validity (Z#23245937 / PRT-013) 2026-09-29 13:40:18 +02:00
Raphael Michel 912851aa87 [SECURITY] OAuth: Disable existing tokens when deactivating Application (CVE-2026-101271, Z#23247296) 2026-09-29 13:40:18 +02:00
Mira Weller 5440508be0 [SECURITY] Escape help texts (CVE-2026-101270) 2026-09-29 13:40:17 +02:00
Raphael Michel 7025159f6b [SECURITY] Fix customer session fixation on cross-domain login (CVE-2026-101268, Z#23247268) 2026-09-29 13:39:39 +02:00
Raphael Michel 42cedc7306 [SECURITY] Fix information leak in widgets.json on dashboard (CVE-2026-101267, Z#23247172) 
Thanks to Wenhao Wu, Southeast University
 2026-09-29 13:39:38 +02:00
Raphael Michel 11ac2cc91c [SECURITY] Fix checkout validation bypass (CVE-2026-101266, Z#23245008) 2026-09-29 13:38:58 +02:00
Raphael Michel 2bd0a341d6 Bump to 2026.6.1 v2026.6.1 2026-07-28 12:25:38 +02:00
Raphael Michel 6bec15d12a [SECURITY] Add missing permission check for view (CVE-2026-57532) 2026-07-28 12:25:31 +02:00
Raphael Michel fd565ecdb2 Bump version to 2026.6.0 v2026.6.0 2026-07-01 16:33:07 +02:00
Nikita Mitasov f35b13b686 Translations: Update Russian 
Currently translated at 18.9% (1200 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ru/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-es 550bb675f5 Translations: Update Spanish 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/es/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-es adc9c9d514 Translations: Update Spanish 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/es/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-es 8441c4bc7a Translations: Update French 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/fr/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-es 97ff252c09 Translations: Update French 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/fr/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-es d3ca2ac1e5 Translations: Update German 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-07-01 16:32:06 +02:00
Raphael MichelandMira Weller 6eebaaa563 [SECURITY] Hardening for user impersonation feature (CVE-2026-13602) 
---------

Co-authored-by: Mira Weller <weller@pretix.eu>
 2026-07-01 15:15:43 +02:00
Raphael MichelandMira Weller c9781f012b [SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602) 
- Add central framebreaker page via safelink helper
- Update paypal, paypal2 and stripe plugins to use central framebreaker
- Add CSP header to cookies.html

---------

Co-authored-by: Mira Weller <weller@pretix.eu>
 2026-07-01 15:15:43 +02:00
Mira WellerandRaphael Michel 000bf54105 [SECURITY] Allowlisting and changed salts for safelink and safelink_callback (CVE-2026-13602) 
---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
 2026-07-01 15:15:43 +02:00
Lukas Bockstaller e42d3d632f filter out the 404 log records from django.request (#6324) 2026-07-01 11:33:04 +02:00
Lukas Bockstaller 3bf5a5e478 include settings attribute during type checking (#6323) 
* include settings attribute during type checking

* isort
 2026-07-01 11:32:54 +02:00
Raphael Michel a6f31df0d4 Do not assign domain across organizers when copying events 2026-06-30 18:51:49 +02:00
Raphael Michel d40492748a Event product list: Hotfix for pathological performance in large event series (#6318) 
* Event product list: Hotfix for pathological performance

* Stop outputting bullsht numbers to widget
 2026-06-29 19:02:06 +02:00
Richard Schreiber f4ca230af7 Improve voucher import unique code checks (#6311) 
* Check for duplicate codes in import

* Check for existing codes instead of failing on db-level

* as we do not lock, catch IntegrityErrors due to race-conditions on import

* fix flake8
 2026-06-29 14:37:41 +02:00
Richard Schreiber 4fb1748bf6 Fix handling country=None in attendee profiles (#6309) 
* Fix handling country=None in AttendeeProfile describe

* Update checkoutflow.py

* fix more occurences

* handle country=None in InvoiceAddress even if it is not allowed
 2026-06-29 14:32:01 +02:00
Raphael Michel 9d668af102 Discover translatable strings in .ts files (Z#23238475) 2026-06-28 17:51:40 +02:00
Raphael Michel 80fd4a3b2a Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael Michel 65bb2283d4 Translations: Update German 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael Michel 00751e8911 Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael Michel 957a066475 Translations: Update German 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael Michel 7e077bdd7e Subevent detail: Fix incorrect ticket count (Z#23238481) 2026-06-28 17:43:22 +02:00
Raphael Michel e80d84ec3c Update po files 
[CI skip]

Signed-off-by: Raphael Michel <michel@rami.io>
 2026-06-28 16:44:09 +02:00
Kim Lozano dc3b742d8c Translations: Update Catalan 
Currently translated at 29.7% (1875 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ca/

powered by weblate
 2026-06-28 16:42:32 +02:00
Raphael Michelandpajowu 1f5fe1b237 SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468) (#6260) 
* SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468)

* SMTP SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (#6264)

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
 2026-06-26 16:45:20 +02:00
Raphael Michel a8997f8971 [SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Raphael Michel eb068f524c [SECURITY] Prevent reading of any local files in reportlab (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Raphael Michel f615595547 [SECURITY] Disable outbound and file access for reportlab (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Mira Weller 8bd78eefcf [SECURITY] Fix reflected XSS in redirection page (CVE-2026-57533) 2026-06-25 16:46:13 +02:00
Mira Weller 848f7fa0e5 [SECURITY] Fix stored XSS in ticket confirmation page (CVE-2026-13225) 2026-06-25 16:46:13 +02:00
Mira Weller 3442a543c8 [SECURITY] Hardening: Don't use |safe on confirm_messages 2026-06-25 16:46:13 +02:00
Mira Weller f88c24863d [SECURITY] Fix XSS in ticket layout JSON (CVE-2026-57532) 2026-06-25 16:46:13 +02:00
Lukas Bockstaller 79c5160b57 Revert "Update django-countries requirement from ==8.2.* to ==9.0.* (#6269)" (#6310) 
This reverts commit 1e301da26c.
 2026-06-24 10:42:56 +02:00
Richard Schreiber e8492cad3c Seating: fix handling optional position attribute (#6303) 2026-06-24 09:47:08 +02:00
Richard Schreiber 7ea5a2b59e PDF: add placeholder invoice_custom_field (#6298) 2026-06-24 09:46:43 +02:00
luelista 4c373518d0 Fix event meta property handling when cloning across organizers (Z#23231419) (#6306) 2026-06-23 19:01:32 +02:00
luelista 1521c0cfcd Fix URL matching in EventQRCode (Z#23237781) (#6304) 2026-06-23 18:34:31 +02:00