Commit Graph
228 Commits
Author SHA1 Message Date
Raphael MichelandRaphael Michel f50548cd02 Fix crash on build 2026-04-10 10:34:15 +02:00
Raphael MichelandRaphael Michel bb450e1be9 Add default protection for SSRF 2026-04-10 10:34:15 +02:00
Phin WolkwitzandGitHub c143d50290 Update django to 5.2 2026-03-24 16:33:28 +01:00
df0b580dd6 Pluggable permissions (#5728)
* Data model draft

* Refactor query and assignment usages of old permissions

* Backend UI

* API serializer

* Big string replace

* Docs, tests and fixes for teams api

* Update docs for device auth

* Eliminate old names

* Make tests pass

* Use new permissions, remove inconsistencies

* Add test for translations

* Show plugin permissions

* Add permission for seating plans

* Fix plugin activation

* Fix failing test

* Refactor to permission groups

* Update doc/api/resources/devices.rst

Co-authored-by: luelista <weller@rami.io>

* Update doc/api/resources/events.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/api/serializers/organizer.py

Co-authored-by: luelista <weller@rami.io>

* Fix typo

* Fix python version compat

* Replacement after rebase

* Add proper permission handling for exports

* Docs for exporters

* Runtime linting of permission names

* Fix typos

* Show export page even without orders permission

* More legacy compat

* Do not strongly validate before plugins are loaded

* Rebase migration

* Add permission for outgoing mails

* Review notes

* Update doc/api/resources/teams.rst

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Clean up logic around exporters

* Review and failures

* Fix migration leading to forbidden combination

* Handle permissions on event copying

* Remove print-statements

* Make test clearer

* Review feedback

* Add AnyPermissionOf

* migration safety

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-03-17 14:43:56 +01:00
dfaa4c3359 Add session_login function (#5955)
* Add session_login function

* Make helper do more things and use it

---------

Co-authored-by: Raphael Michel <michel@rami.io>
2026-03-16 17:39:04 +01:00
Raphael Michel 769e1312d4 Revert "Disable partitioned cookies for Safari due to WebKit bugs (#5843)"
This reverts commit fbd8bbbeaa.
2026-02-20 10:08:51 +01:00
Kian CrossandGitHub fbd8bbbeaa Disable partitioned cookies for Safari due to WebKit bugs (#5843)
Safari currently exhibits a bug where Partitioned cookies (CHIPS) are not
sent back to the originating site after multi-hop cross-site redirects,
breaking SSO login flows in pretix.

Partitioned cookies were initially introduced in Safari 18.4, removed
again in 18.5 due to a bug, and reintroduced in Safari 26.2, where the
current issue is present.

As a mitigation, disable sending the `Partitioned` attribute for Safari
user agents. This is intentionally conservative; once the Safari issue
is fixed, this check should be refined to be conditional on the affected
versions only.

WebKit issues:

  - https://bugs.webkit.org/show_bug.cgi?id=292975
  - https://bugs.webkit.org/show_bug.cgi?id=306194
2026-02-18 09:19:14 +01:00
Raphael Michel 43c6c33bd8 SafeFormatter: Ignore conversion spec 2026-02-13 12:35:49 +01:00
Raphael Michel 2d2663f15f Mark strings as formatted to prevent double-formatting 2026-02-13 12:28:32 +01:00
Richard SchreiberandGitHub 3a3ae6e66c Fix custom pycountry_add index handling (#5869) 2026-02-02 09:41:32 +01:00
Raphael MichelandGitHub c40e34af57 Model-based mail queuing 2026-01-30 10:43:02 +01:00
Raphael MichelandGitHub 4edc7d95c6 Address form: Add missing province Aosta for Italy (#5796) (#5800) 2026-01-26 10:00:11 +01:00
Raphael Michel 62bc16f963 Translation status: Properly account for plurals 2026-01-07 09:20:37 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Raphael Michel
59c09e27fd Update django-phonenumber-field requirement from ==7.3.* to ==8.3.* (#5522)
* Update django-phonenumber-field requirement from ==7.3.* to ==8.3.*

Updates the requirements on [django-phonenumber-field](https://github.com/stefanfoulis/django-phonenumber-field) to permit the latest version.
- [Release notes](https://github.com/stefanfoulis/django-phonenumber-field/releases)
- [Changelog](https://github.com/stefanfoulis/django-phonenumber-field/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/stefanfoulis/django-phonenumber-field/compare/7.3.0...8.3.0)

---
updated-dependencies:
- dependency-name: django-phonenumber-field
  dependency-version: 8.3.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Remove invalid geo codes

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Raphael Michel <michel@rami.io>
2026-01-05 17:31:39 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Raphael Michel
cc5693017e Update django-countries requirement from ==7.6.* to ==8.2.* (#5660)
* Update django-countries requirement from ==7.6.* to ==8.2.*

Updates the requirements on [django-countries](https://github.com/SmileyChris/django-countries) to permit the latest version.
- [Changelog](https://github.com/SmileyChris/django-countries/blob/main/CHANGES.md)
- [Commits](https://github.com/SmileyChris/django-countries/compare/v7.6...v8.2.0)

---
updated-dependencies:
- dependency-name: django-countries
  dependency-version: 8.2.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update our helpers

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Raphael Michel <michel@rami.io>
2026-01-05 16:55:05 +01:00
Raphael MichelandGitHub bb5a9bdbf1 PDF rendering: Do not create TTFont if already cached (#5748)
This provides a massive speedup for invoice rendering
2026-01-05 12:15:35 +01:00
luelistaandGitHub e1f5678d7c Refactor payment QR code generation code and add SPAYD format (#5680)
Move generation of QR code contents out of the HTML template and into Python code, so it can
be reused in plugins and tested with unit tests. Add the SPAYD QR code format which is used in
Czech Republic and Slovakia [1]. Display BezahlCode QR codes only for German IBANs.

[1] https://en.wikipedia.org/wiki/Short_Payment_Descriptor
2025-12-04 14:15:29 +01:00
Raphael MichelandGitHub bdd94b1f8a Add prioritization to webhook/notifications queue (#5513)
* Add prioritization to webhook/notifications queue

* Add missing code

* Missing license header

* Fix argument

* Use redis pipeline

* Update license header
2025-12-02 09:13:01 +01:00
Raphael MichelandGitHub 9f263fbe4f Hotfix linkified placeholders (#5663)
* Fix linkify placeholders

* Add URL test
2025-11-27 13:20:13 +01:00
Raphael Michelandluelista fdd34f387a [SECURITY] Prevent HTML injection through placeholders in emails
Co-authored-by: luelista <weller@pretix.eu>
2025-11-27 11:41:27 +01:00
Raphael MichelandGitHub db7518735a Allow admins to inspect invoices (#5641)
This is helpful to debug invoice renderers or non-PDF invoices like
Peppol or other XML formats
2025-11-19 14:42:18 +01:00
Raphael MichelandGitHub 6190b93f89 Stop using ordinal numbers in English date represenation (Z#23210534) (#5539)
* Stop using ordinal numbers in English date represenation (Z#23210534)

* ADjust more tests
2025-10-15 09:06:54 +02:00
Raphael MichelandGitHub 177a7d07fc Update license header (#5540) 2025-10-10 15:32:46 +02:00
85a9a3caa6 Run exporters in repeatable read by default (Z#23173095) (#5500)
* Run exporters in repeatable read by default (Z#23173095)

* Update src/pretix/helpers/database.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Rename parameter, add test

* Do not run during tests

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-10-06 10:38:19 +02:00
Danny AdairandGitHub cd6fbd886c Add support for New Zealand (en-nz) date/time formats (#5449)
- Implement en-NZ specific formatting in daterange.py
- Create en_NZ/formats.py with NZ-compliant formats
2025-09-09 15:05:51 +02:00
Richard SchreiberandGitHub 24ac588119 Remove unnecessary translation for daterange (Z#23205453) (#5410)
* Remove unnecessary translation for daterange

* fix flake8

* fix isort
2025-09-02 09:22:21 +02:00
Raphael MichelandGitHub b9e627a86c PDF: Add font fallback on a pragraph level (Z#23203886) (#5367)
* PDF: Add font fallback on a pragraph level (Z#23203886)

* Fix empty texts
2025-08-13 10:51:23 +02:00
Raphael Michel 99e10adad4 Revert "PDF: Add font fallback on a pragraph level (Z#23203886)"
This reverts commit 10b5f76356.
2025-08-12 15:51:43 +02:00
Raphael Michel 10b5f76356 PDF: Add font fallback on a pragraph level (Z#23203886) 2025-08-12 15:51:13 +02:00
Raphael Michel 89d8ca0fc2 Add two more country translations (Z#23166278) 2025-08-05 09:28:34 +02:00
Raphael Michel a5b773924c Hotfix for country names (Z#23166278) 2025-08-04 14:39:57 +02:00
e2ae553c69 Add Spanish (LatAm) and improve how we count language coverage (Z#23200505) (#5308)
* Add Spanish (LatAm) and improve how we count language coverage

* Apply suggestions from code review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Fix license header

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-07-17 17:06:25 +02:00
5962536a11 Dialog for cart renewal, async task without page refresh (#5148)
* async_task: deduplicate response handling code

* extend cart without full page reload

* update dialog markup

* fix error response from CartExtend

* refactor asynctask, make sure waitingDialog.show() re-initializes dialog contents

* add cart expiry notification

* add aria references to other dialogs

* improve error handling

* fix error if max_extend=None

* different message for expiring soon and expired carts

* refactor dialog css

* add classes to further dialog elements

* switch extend-cart-dialog and loadingmodal to <dialog>

* Backport simple_block_tag from Django 5.2

* Use simple_block_tag for {% dialog %} tag

* add alertdialog role

* Update src/pretix/static/pretixbase/scss/_dialogs.scss

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* fix mobile dialog styles not being overwritten

* asynctask dialog: prevent close by escape on chrome

* remove dynamic aria-live from #cart-deadline

dynamic aria-live is generally not well supported and as we have the dialog now anyways, we can remove it

* move continue-button to right

* Update src/pretix/static/pretixpresale/js/ui/cart.js

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Fix CSS for old-style dialog

* fix heading display/level

* align dialogs at the top as they originally were

* fix </div> from merge-conflict

* fix missing grow for dialog-content

* improve cart-extend-button ui

* do not show cart-extend-dialog onload

* improve message if 0 minutes

* do not save messae in session if ajax_dont_redirect

* add ajax_dont_redirect to async_task_check_url

* improve draw_deadline to only update #cart-deadline if necessary

* add renew-confirmation-message

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: Raphael Michel <michel@rami.io>
2025-05-27 07:17:50 +02:00
luelistaandGitHub d926030bf6 Event list: fix parsing of date query parameter (#5047)
Use the same localization formats as used when generating the value
2025-05-02 10:22:04 +02:00
Richard SchreiberandGitHub 1a1948e3fa [A11y] Improve HTML-output for date-ranges 2025-03-27 13:21:25 +01:00
MiraandGitHub addba1ff57 Display "Order status" correctly in the "Search query" line of advanced search results (#4926) 2025-03-18 14:24:24 +01:00
Martin GrossandGitHub 148a3b2933 MetricsMiddleware: Do not record pretix_view_duration_seconds for urls with no url.url_name (#4784) 2025-01-27 16:46:58 +01:00
Raphael MichelandGitHub 045edc7cec Invoice rendering: Remove transparency from logos (Z#23179391) (#4762)
* Invoice rendering: Remove logos from transparency

* Add comment
2025-01-21 15:03:43 +01:00
2dc625cf31 Add the option to introduce rich-text placeholders (#4657)
* Add the option to introduce rich-text placeholders

* Add tests in test_format

* Add some css

* Block vs inline

* Some fixed css

* Update src/pretix/control/forms/event.py

Co-authored-by: Mira <weller@rami.io>

* Add missing docstring prat

---------

Co-authored-by: Mira <weller@rami.io>
2024-12-03 11:38:15 +01:00
MiraandGitHub 91e69f793d Show weekday in subevent dates [Z#23161884] (#4383) 2024-08-27 22:22:44 +02:00
4f9297e7d8 Show minimal check-in status in order export (Z#23154920) (#4223)
* Show minimal check-in status in order export (Z#23154920)

* Update src/pretix/helpers/database.py

Co-authored-by: Mira <weller@rami.io>

* Review note

---------

Co-authored-by: Mira <weller@rami.io>
2024-06-24 17:34:10 +02:00
Raphael Michel 39caadb335 Compatibility of safe_openpyxl with openpyxl==3.1.3 2024-06-10 17:19:29 +02:00
dd6ebd7a48 Improve validation of email templates (#4184)
* Improve validation of email templates

* simplify SafeFormatter (skip attribute access code path altogether instead of blocklisting characters)

* let SafeFormatter optionally raise on missing key

* simplify placeholder validation

* rename parameter

* Remove unused import

---------

Co-authored-by: Raphael Michel <michel@rami.io>
2024-06-10 16:41:52 +02:00
Raphael MichelandGitHub 7365f165ad Thumbnails: Keep frame durations of GIFs (#4183) 2024-06-04 21:53:20 +02:00
Martin Gross 42f3ca9661 SecHelper: Fix typo in logging statement 2024-04-24 18:13:27 +02:00
Raphael MichelandGitHub b2842ec3a0 Checkin: Allow to use presence state in rules (#4061) 2024-04-18 13:15:31 +02:00
Raphael Michel 0c998ca884 Remove special handling of translations in pretix/helpers 2024-04-03 12:43:20 +02:00
Raphael MichelandGitHub a3139944f6 Send notifications about login with new client or country (#4032)
* Send notifications about login with new client or country

* Rebase migration

* Remove immediately

* Fix isort

* Text update
2024-04-03 11:19:20 +02:00
Raphael MichelandGitHub 4ea4189e6d Allow team admins to require two-factor authentication (#4034)
* Allow team admins to require two-factor authentication

* Add API tests

* Improve logic

* ADd button tooltip
2024-04-02 17:15:16 +02:00
Raphael MichelandGitHub c68ee56d51 Log discarding a valid session for suspicious reasons (#4025) 2024-04-02 13:52:30 +02:00