Commit Graph
3223 Commits
Author SHA1 Message Date
Richard SchreiberandGitHub 7ea5a2b59e PDF: add placeholder invoice_custom_field (#6298) 2026-06-24 09:46:43 +02:00
luelistaandGitHub 4c373518d0 Fix event meta property handling when cloning across organizers (Z#23231419) (#6306) 2026-06-23 19:01:32 +02:00
d14dc4c5ff Test order deletion: Improve bulk performance (Z#23237160) (#6274)
* Test order deletion: Improve bulk performance (Z#23237160)

* Apply suggestion from @pajowu

Co-authored-by: pajowu <engelhardt@pretix.eu>

* Fix style issue

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
2026-06-22 09:49:27 +02:00
Raphael MichelandGitHub 5db1a5b8af Rename confusingly named helpers for URL generation (#6280)
* Rename confusingly named helpers for URL generation

* new name

* fix old call

* Revert "new name"

This reverts commit a6e9a488b6.

* New name
2026-06-22 09:11:55 +02:00
luelistaandGitHub d0307b9936 Use OrderPosition.all instead of .objects in metrics (#6285) 2026-06-21 12:46:07 +02:00
694b915d89 include errors.js by default and make it coop with async_task_replace_page (Z#23236752) (#6284)
* load errors.js as standard and make it coop with async_task_replace_page

* scope down event

* Update src/pretix/static/pretixbase/js/asynctask.js

Co-authored-by: pajowu <engelhardt@pretix.eu>

* drop the jquery dependency for error.js

Co-authored-by: pajowu <pajowu@pajowu.de>

* include errors.js in error.html

* include errors.js in control base.html

* Update src/pretix/static/pretixbase/js/asynctask.js

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* put errors.js in an IIFE call

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
Co-authored-by: pajowu <pajowu@pajowu.de>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-06-16 15:18:19 +02:00
Raphael Michelandpajowu f0cb451c34 LocaleMiddleware: Correctly reset region for backend views 2026-06-12 15:30:06 +02:00
pajowuandGitHub 8e63fafc62 Devex: Fix vite devserver capturing stdin (#6267)
Pass DEVNULL as stdin to vite, otherwise the vite devserver captures parts of stdin, making things like pasting during debugging impossible
2026-06-11 16:25:48 +02:00
775fdd1ccb Check-in API: Add reusable media exchange (#6115)
* Add Reusable Media Exchange to Checkin API

* isort

* Remove debugging leftover

* Apply suggestions from code review

Co-authored-by: robbi5 <maxi@richt.name>

* Add media_exchange_supported to CheckinRPCRedeemInputSerializer

* SecurityProfiles: Add api-v1:reusablemedia-lookup and -detail for SCAN

* Simplify media exchange checks

* Apply suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Wording: re-usable --> reusable

* Deny checkins if media-exchange is required but device does not support it.

* Remove media_exchange_supported-Flag: Checkin will always be denied if media needs to be exchanged; apps will fall back to explanation text

* CheckinRPC: Also perform media exchange

* Use media_policy from item, not as a checkinrpc parameter

* my own review notes

* Fixes, cleanup, rebase

* block expired media

* Fix query

* add logging

* Refactor link_action into media policy, gift card support

* Block illegal policy-type combination

* Drop add_to_reusable_medium, decide all by policy

* Fix test failure

* fix test on postgres

* Expose reusable_media_usage_enforced to devies

* Explicitly set update view

---------

Co-authored-by: robbi5 <maxi@richt.name>
Co-authored-by: Maximilian Richt <richt@pretix.eu>
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
Co-authored-by: Raphael Michel <michel@rami.io>
Co-authored-by: Raphael Michel <michel@pretix.eu>
2026-06-11 16:25:13 +02:00
luelistaandGitHub 784577d86f Fix markup of error template (#6265) 2026-06-10 14:16:46 +02:00
Richard SchreiberandGitHub b404316dfd [SECURITY] Reusable media export: Respect giftcard permissions (CVE-2026-11764) (#6261) 2026-06-09 13:20:48 +02:00
721b179521 Add support for multiple linked_orderpositions on reusable media (#5666)
* change linked orderpositions to many-to-many

* Update media views to list ops

* return last op as fallback for linked_orderposition

* add multi-op to export

* update media-API

* fix media-view filter

* update control media forms

* fix API orders

* fix API orders matching media

* remove cached_property linked_orderposition - keep only in API

* fix media-issue signal

* adapt checkin API for multiple orderpositions

* remove unneeded comment

* fix create/update logging

* fix tests

* fix more tests

* fix code style

* add label to reusablemedium

* fix migration NOT NULL

* fix tests

* update docs

* clarify docs updating multiple linked_orderpositions

* clarify docs

* no need to prefetch linked_orderpositions

* improve readability

* select_related order instead prefetch

* add filter based on op.valid_from/until

* rename secret to claim_token

* Update docs for claim_token

* unifiy deprecated style

* Update reusablemedia.rst

* Update reusablemedia.rst

* Update reusablemedia.rst

* fix missing claim_token in serializer

* fix flake8

* add add_to_reusable_medium to order-serializer

* fix tests regarding claim_token

* fix flake8

* Clarify docs

* list ops comma-separated in export

* Add test for order-API add_to_reusable_medium

* fix linked_orderpositions filter in checkinrpc

* add test

* Add help-text

* fix multi-op media filter

* fix flake8

* improve check

* Fix sorting of reusable media type in overview

* Add copy and qr button to reusable medium detail view

* Rebase against origin/master

* Add logentrytype reusable_medium.linked_orderposition.removed

* add missing label_from_instance for SafeOrderPositionMultipleChoiceField

* add tests for create with linked_orderposition

* API add test for fallback-values in medium patch

* fix flake8

* Fix indentation

* fix migrations numbering

* fix test

* unify qutation marks

* fix flake8

* micro-improve linked_op-removal-logging

* simplify filter instead of annotate/get

* Do not translate API-errors

Co-authored-by: Raphael Michel <michel@pretix.eu>

* Fix typos in doc

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Update versionchanged in docs

Co-authored-by: Raphael Michel <michel@pretix.eu>

* Change log to always added not changed

* Add test for checkinrpc for ops out of timerang or canceled

* improve tests mixing ops from different organizers

* Fix logging of changed order_positions

* properly log added/removed when using UI

* refactor logging code

* unify logging adding/removing ops via API

* fix flake8

* remove unnecessary prefetch as already prefetched

* optimize fetching ops

* combine addon match and time-based validity match

* fix combined valid and product check

* re-number migrations

* Apply suggestion from @raphaelm

Co-authored-by: Raphael Michel <michel@pretix.eu>

* fix flake8

* New attempt at logic

* Improve op_candidate-selection for error message if no op matches check-in

* Fix typo

* fix valid_from start time being included

* use the datetime parameter for the comparison time so that the simulator works too

---------

Co-authored-by: Maximilian Richt <richt@pretix.eu>
Co-authored-by: Martin Gross <gross@rami.io>
Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
2026-06-03 09:12:24 +02:00
Richard SchreiberandGitHub 909ce5b27d Add NoUrlValidator to validators (#6208) 2026-05-22 13:51:28 +02:00
Richard SchreiberandGitHub f60031d67b Make disable_url optional for notifications (#6202) 2026-05-22 07:59:56 +02:00
Richard SchreiberandGitHub f740d46d47 Add template-filter human_readable_locale (#6193) 2026-05-20 12:57:57 +02:00
Richard SchreiberandGitHub ce5af572cc Improve error messages for name-parts inputs (Z#23234440) (#6187)
* Improve error messages for name-parts inputs (Z#23234440)

* fix isort after flake8

* correct spelling of .med in user-provided title/name

* fix search instead of match
2026-05-19 15:23:30 +02:00
luelistaandGitHub 80ed6e76cd Fix failing orderlist export if orders with invalid payment provider identifiers exist (Z#23233440) (#6159)
* Fix orderlist export if orders with invalid payment provider identifiers exist (Z#23233440)
* Performance: Move _get_all_payment_methods out of loop
2026-05-12 11:57:18 +02:00
Richard SchreiberandGitHub 3b70ef8c84 Allow event being optional in LoggingMixin (#6166) 2026-05-12 09:45:42 +02:00
Richard SchreiberandGitHub 8b468c31a5 Fix translation for order import (#6165) 2026-05-12 09:03:34 +02:00
f04df7a6ee Migrate vue2 control components and widget to vue3 and vite (#5989)
* setup vite and integrate fully with django

- vite starts with `python manage.py runserver`
- add templatetags to simply load vite hmr and entry points
- add eslint (recheck rules)
- enable non-strict ts

* better syntax for cors header setting

* migrate checkin rules editor to vue3

- move constants to a module
- move reading from and writing to non-vue html to django interop module
- switch to composition api and script setup sfc with pug
- use optional chaining operators a lot to simplify code

* migrate webcheckin plugin to vite+vue3

- migrate vue sfcs to script setup and pug
- move fetch calls into a api.ts module
- move common formatting and i18n strings into module

* fix migration error

* first draft migrating widget to vue3/vite

* first couple widget e2e tests

courtesy of claude
most of the tests don't work yet

* test file is not actually used

* drop widget_ prefix from e2e test fixtures

* add test for complete widget journey for simple event

* switch timezone in e2e tests to Europe/Berlin

* make dates in e2e tests relative

* migrate widget bugfix #5886

* start testing event series widget

* working vite widget setup for prod (untested), local dev (with or without dev server) and pytests, with flags for running the old version or the vite version

* simplify e2e test iframe check

* less flaky e2e tests

* top level await in iife build mode is not supported, so let's do import.meta.glob instead (we just need the build step not to see await, the code doesn't actually ever get loaded because it's DEV only)

* fix inconsistencies from automatic migration

* Allow gradual rollout of new vite-based widget by adding urls to an allowlist that gets checked against the "Origin" http header of request fetching the widget js

* add e2e tests for widget button, testing empty cart, adding specific items, and subevents

* remove janky claude testts again

* resolve migration TODOs: properly refocus parent on navigations

* use `npm run dev:control` for the vite dev server for admin components

* upgrade npm dependencies

* fix js linter errors

* fix python linter errors

* build all control vue components

* add new js config files to check-manifest ignore

* working prod build

acutal serving of built assets not tested yet

* fix templatetag paths to match what's in the vite mantifest

* add missing quotes around 'unsafe-eval' cors value

* remove now unused old vue2 tooling

* try fixing e2e test ci

* fix flake8 error

* check if vite build artefacts are in the wheel

* add license headers

* remove dom manipilation code necessary for `div.pretix-widget-compat` to work. No longer needed for vue3

* remove superfluous `createElement` calls

They might have been there because of IE, which is no longer relevant

* make widget dev mode parametizable through query params and document the usage and those params

* fix rst syntax

* remove migration todos file

Co-authored-by: luelista <mira@teamwiki.de>

* rearrange dockerfile commands for smaller image, thanks @luelista

* Update .gitignore, adding .vite

Co-authored-by: luelista <mira@teamwiki.de>

* add eslint CI

* make vue dev work in plugins

* fix docker build

* rebuild vite setup to support static prod plugins and dynamic hmr plugin development

* use toml for vite plugin config instead of standalone json file

* Add widget changes from #6047, #6149

* Allow buttons to reuse cart (Z#23226853)

* Always keep cart of buttons with items set

* widget: handle cart if not same-site (#6149)

---------

Co-authored-by: luelista <mira@teamwiki.de>
Co-authored-by: Kara Engelhardt <engelhardt@pretix.eu>
2026-05-11 15:05:06 +02:00
sweenuandGitHub 14708eef80 Invoice: fix issuer details rendering when address missing (#6139) 2026-05-05 17:58:02 +02:00
Daniel MusketaandGitHub 994e4b410a Fix gettext singular forms in cart error_messages (#6147) 2026-05-05 17:15:14 +02:00
luelistaandGitHub 27183a26ee Respect per-event plugin availability in OrganizerPluginEvents view (#5983)
* Allow plugins to declare their availability per event

* Fix message type

* small optimization of PluginsField serializer
2026-05-04 11:34:05 +02:00
Raphael MichelandGitHub f4fcca19a4 Orders API: Fix race condition in voucher redemption (Z#23230391) (#6067)
The old code relied on the `Voucher.redeemed` value obtained *before*
the lock was taken, not afterwards.

The change in services/orders.py is functionally pointless, but it makes
the pattern of "fill availability only after lock" clearer and might
avoid introducing similar bugs in the future.
2026-04-29 19:57:08 +02:00
Phin WolkwitzandGitHub 589f51454e Add locations to program times (Z#23221129)
Add location for program time slots and extend .ical and PDF placeholder
2026-04-29 11:59:06 +02:00
Kara Engelhardtandpajowu 2d31c62812 Allow dash character in pdf placeholders 2026-04-28 13:10:08 +02:00
Richard SchreiberandGitHub 1c7ce4b1ca Validate id for async tasks 2026-04-28 08:56:32 +02:00
Raphael MichelandGitHub 8426a68760 Prevent nullbytes in input data globally (#6071)
* Prevent nullbytes in input data globally

* Only on urlencoded POST

* Split middleware
2026-04-27 17:28:36 +02:00
771f4f5d1e Turn attendee emails on by default for new events (Z#23213656) (#5598)
* Turn attendee emails on by default for new events (Z#23213656)

I think the thing that makes me most unhappy is that *most* organizers will
probably want to turn off mail_send_order_paid_attendee when they set
ticket_download_pending and I don't think organizers will remember that, but
it also seems complex and weird to create an automatism for it?

* Update src/pretix/base/models/event.py

Co-authored-by: Martin Gross <gross@rami.io>

---------

Co-authored-by: Martin Gross <gross@rami.io>
2026-04-27 15:00:48 +02:00
Raphael MichelandGitHub b000dff134 Invoices: Allow to use currency rates from National Bank of Poland (#6100) 2026-04-21 15:14:10 +02:00
Martin GrossandMartin Gross 7e457f7430 Set max_length to 70 but for all name fields together and not only every single one. 2026-04-21 10:45:00 +02:00
Martin GrossandMartin Gross 5faa85ed40 isort 2026-04-21 10:45:00 +02:00
Martin GrossandMartin Gross 1b88a84a83 Move validation into form field. 2026-04-21 10:45:00 +02:00
Richard SchreiberandGitHub b7d3e8a80a Add invoice numbers to paymentlist export (Z#23227966) (#6097) 2026-04-20 17:55:44 +02:00
pajowuandGitHub 8690d65e99 Do not show payment text of canceled and failed payments on invoice (Z#23231070) (#6075) 2026-04-14 13:02:12 +02:00
pajowuandGitHub 3473fa738d Fix AttributeError in CheckPrivateNetworkMixin (#6076) 2026-04-10 12:47:53 +02:00
pajowuandRaphael Michel 0bb04ca8f0 Email: Check custom SMTP IP at usage time 2026-04-10 10:57:08 +02:00
Lukas BockstallerandGitHub 5c7104634e Order import: handle mixed endings of last line (Z#23230806) (#6066)
* handle mixed line endings in import

* formatting
2026-04-08 13:25:38 +02:00
Kara Engelhardtandpajowu 12171e0665 Fix copy-and-paste errors 2026-04-07 14:39:33 +02:00
Kara Engelhardtandpajowu 2e2e57d231 Fix typo in test detection, improve check
A non-empty string is truthy, making the the for-loop useless, as the first item in inspect.stack() is always the for-loop itself, which then lead to the function returning immediately.
This commit
* fixes this typo
* changes the loop to ignore the first element of instpect.stack() (which is the loop itself)
* ignores django-internal code

This should create something similar to what I suspect the code was intended to do originally.
2026-04-07 14:39:33 +02:00
Raphael Michel 23d1673403 Fix typo 2026-04-02 21:43:36 +02:00
Raphael Michel 92d1830f3b Exporters: Pass state about staff_session 2026-04-02 21:03:42 +02:00
Raphael MichelandGitHub d411c36414 Exporters: Give access to authentication infos and allow empty permissions (#5979)
* Exporters: Give access to authentication infos

* Allow exporters to have empty permission

* Use a protocol
2026-04-02 15:44:36 +02:00
Kara Engelhardtandpajowu b6518449d6 Add placeholder for checked in addons (Z#23230009) 2026-04-02 12:06:00 +02:00
Raphael MichelandGitHub ed1459b1dd Order change form: Allow to add multiple identical positions (Z#23227479) (#6044)
* Order change form: Allow to add multiple identical positions (Z#23227479)

* New implementation
2026-04-01 11:54:48 +02:00
Kara Engelhardtandpajowu 49893ca9df Fix crash in mail_send_task for nonexistant mails 2026-03-30 14:57:56 +02:00
Kara Engelhardtandpajowu c7437336b4 Add length help text to customer password forms
Also cleans up dead code, as `validate_password` always returns None or raises a ValidationError.
2026-03-30 11:25:14 +02:00
Raphael Michel 1383e967df Hotfix font select in organizer 2026-03-25 15:14:20 +01:00
Richard Schreiber 4fed47fb9b Fix live_receivers for django 5 2026-03-24 17:14:05 +01:00
Phin WolkwitzandGitHub c143d50290 Update django to 5.2 2026-03-24 16:33:28 +01:00