CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-10 10:47:00 +00:00
Code Issues Packages Projects Releases Wiki Activity
14,775 Commits 388 Branches 211 Tags
67dcddec33fb8034cca0f746c037ef58273989a2
Commit Graph
28 Commits
Author SHA1 Message Date
Raphael Michel 2574b31afd Fix unused import 2026-07-17 18:44:33 +02:00
Raphael MichelGitHubluelistaluelista
 		5f2264daeb User email verifications: Add rate limiting (Z#23232834) (#6219) 
* User email verifications: Add rate limiting (Z#23232834)

Also, refactor rate limiting into a central utility

* Make ip block work in dev

* Review notes

* Update src/pretix/base/forms/user.py

Co-authored-by: luelista <weller@rami.io>

* Apply suggestions from code review

Co-authored-by: luelista <mira@teamwiki.de>

* Add rate limit reset

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: luelista <mira@teamwiki.de>
 2026-07-17 18:35:03 +02:00
Kara Engelhardtandpajowu c7437336b4 Add length help text to customer password forms 
Also cleans up dead code, as `validate_password` always returns None or raises a ValidationError.
 2026-03-30 11:25:14 +02:00
luelistaandGitHub 1cb2d443f9 Validation of user email addresses (#5434) 
* Validation of user email addresses
* Improve email and password change forms
 2025-11-07 11:17:34 +01:00
Raphael MichelandGitHub 177a7d07fc Update license header (#5540) 2025-10-10 15:32:46 +02:00
Raphael MichelandGitHub 03d3c389da Fix #1674 -- Change spelling of e-mail to email (#4636) 
* Fix #1674 -- Change spelling of e-mail to email

* Conflicts and word list

* Add MobilePay to wordlist

* fix usage in tests
 2024-11-18 17:21:29 +01:00
Raphael Michel f3f42a8a42 Login: Add logging for incorrect JS hostnames 2024-04-02 11:34:43 +02:00
Raphael MichelGitHubMira Weller
 		fb49046ac1 Log and count user logins (#4020) 
* Log and count user logins

* Allow metrics without label

---------

Co-authored-by: Mira Weller <weller@rami.io>
 2024-03-28 17:18:51 +01:00
Raphael Michel 4262bce2b5 Limit maximum length of passwords to 4096 characters 2022-01-25 17:24:48 +01:00
Raphael MichelandGitHub a93287207b pretix Community Edition moves to AGPLv3-based license (#2023) 2021-04-12 10:33:47 +02:00
Raphael Michel 7c0df5b755 [SECURITY] Rate limiting for login 2020-12-22 10:47:47 +01:00
Raphael MichelandGitHub af23d6e4bf Upgrade to Django 3.0 and other dependencies (#1568) 
* Upgrade Django to 3.0 and other dependencies to recent versions

* Fix otp version contsraint

* Remove six dependency

* Resolve some warnings

* Fix failing tests

* Update django-countries

* Resolve all RemovedInDjango31Warnings in test suite

* Run isort

* Fix import

* Update PostgreSQL version on travis
 2020-03-23 15:02:20 +01:00
Maico TimmermanandRaphael Michel 82feca6e38 Fix #1521 -- External authenticated users cannot delete events (#1523) 
* Remove check password for event deletion, instead require recent login.

* Reauthenticate for backends using authentication_url.

* Require recent login for data shredder and prompt slug instead of password.

* Fix tests for recent login required on event delete and data shred.

* Pull request remarks for recent login required for event delete and data shred.

* Remove unused imported check_password.
 2019-12-16 10:45:01 +01:00
Maico TimmermanandRaphael Michel 28242e52aa Fix #1522 -- Login button redirects to authentication url with… (#1525) 2019-12-16 10:42:51 +01:00
Raphael MichelandGitHub 8a6a515b6a Refs #775 -- Pluggable authentication backends (#1447) 
* Drag-and-drop: Force csrf_token to be present

* Rough design

* Missing file

* b.visble

* Forms

* Docs

* Tests

* Fix variable
 2019-10-17 09:11:03 +02:00
SohaltandRaphael Michel 591ed969b8 Autofocus login form (#1346) 2019-07-22 14:31:18 +02:00
Raphael Michel 01a6861453 Always query emails case-insensitively 2019-01-02 15:12:48 +01:00
Lukas BockstallerandRaphael Michel a643abe293 Prevent email enumeration (#1000) 
Here is my attempt to prevent user enumeration. 
I've made the following changes:

**Application:**
- replaces success and failure messages in the form with two (with/without redis) information messages 
- adds logging for attempted password resets of unknown users
- adds logging for failing emails

**Tests:**
- test_unknown asserts a redirect instead of a ok
- adds test_email_reset_twice_redis to assert the correct logging of a twice reset email 
- adds a FakeRedis class similiar to the one implemented in test_metrics.py. I could refactor them into the testutils folder if prefered. 

Please excuse the commit mess. I am currently fighting with my tooling.
 2018-08-31 10:28:39 +02:00
Raphael MichelandGitHub afd766999c Upgrade to Django 2.1 (#710) 
* Upgrade to Django 2.0

* more models

* i18n foo

* Update setup.py

* Fix Sentry exception PRETIXEU-JC

* Enforce slug uniqueness

* Import sorting

* Upgrade to Django 2.1

* Travis config

* Try to fix PostgreSQL failure

* Smaller test matrix

* staticfiles→static

* Include request in all authenticate() calls
 2018-08-06 12:48:46 +02:00
Raphael Michel 2f15d410fe Add optional timeouts for backend sessions 2017-09-04 19:50:32 +02:00
Tobias KunzeandRaphael Michel bfc721978d Fixed minor documentation errors and mistakes (#151) 2016-07-14 20:01:38 +02:00
Raphael Michel 09e5c43c55 Fixed #143 -- Password strength validation errors in the right place 2016-06-10 15:33:32 +02:00
Raphael Michel e5edf53f00 Disable Chrome's autofill for various form fields 2016-06-06 23:07:49 +02:00
Jason EstibeiroandRaphael Michel e685f8e819 Added basic Django password validations and updated .gitignore (#136) 2016-05-11 13:38:31 +02:00
Raphael Michel 79ad8b40ed Added python3.5-style type annotations to pretix.base 2015-11-04 23:39:59 +01:00
Raphael Michel c47008cc18 Added password reset to control.auth 2015-10-04 13:52:08 +02:00
Raphael Michel 264c1e034f Used Django's token generator for passwort resets 2015-09-29 00:59:33 +02:00
Raphael Michel 7def097dcd Refs #96 -- Completely removed local users 2015-09-17 00:55:00 +02:00