* Fix crash in rebooking if addon has hidden_if_item_available
* Move get_grouped_items into its own file and rename to prepare_item_list_for_shop
(but keep a reference under original name for plugin compatibility)
* Make Item[Variation].unavailability_reason helper functions next to get_grouped_items
* Use current_unavailability_reason attribute instead of unavailability_reason()
* Add test case for:
Order has product with addon 1; Addon 1 is hidden if Addon 2 is available; When order is changed, Addon 1 should not be removable
* Fix special case if addon product is now set to require a voucher (vouchers for addons are not supported)
---------
Co-authored-by: Kara Engelhardt <engelhardt@pretix.eu>
* Add proper CSP policy for HTML email preview
* Handle safe types centrally
* Precompile schema validation function to get rid of ajv2020
* Fix tests
* adjust more tests
* Fix customer views using wrong csrf middleware
This lead to persistent csrf validation errors if the token from the cookie expired, which could only be solved by clearing cookies.
* Remove unneccesary csrf_protect decorators
* Fix typo
Co-authored-by: Raphael Michel <michel@pretix.eu>
---------
Co-authored-by: Raphael Michel <michel@pretix.eu>
This is a follow-up for #6318, basically the same problem but in a
neighboring query.
Performance comparison for real-world event with 13k subevents:
In [15]: %time get_grouped_items(e, subevent=se, channel=e.organizer.sales_channels.get(identifier="web"))
CPU times: user 49.1 ms, sys: 3.79 ms, total: 52.9 ms
Wall time: 1.12 s
Out[15]: ([<Item: xxx>], True
In [16]: %time get_grouped_items_patched(e, subevent=se, channel=e.organizer.sales_channels.get(identifier="web"))
CPU times: user 30.2 ms, sys: 445 μs, total: 30.6 ms
Wall time: 45.3 ms
Out[16]: ([<Item: xxx>], True)
* Add event placeholder support to more fields
I found it useful to be able to use the `{event}` placeholder in
some fields such as the "End of presale text" because I don't need
to fix the texts creating a new event by cloning another event.
I made placeholders available to the other fields as well (where not too
difficult). Specifically `presale_has_ended_text`, `voucher_explanation_text`
`banner_text`, `banner_text_bottom` and `event_info_text`.
In addition, I grouped them under a new `texts` variable in the `context`
(including `frontpage_text` which was part of the root `context` previously).
* change compute location
---------
Co-authored-by: Raphael Michel <michel@rami.io>
* Improve SSO one-time token error message
Replace the generic 'invalid one-time token' message shown after failed
SSO login attempts with a clearer, user-facing explanation of what went
wrong and how to recover.
* Remove unneeded classes from headings
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* Apply suggestions from code review
Added `trimmed` to translation blocks
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* Reword SSO error template for improved translation clarity
---------
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
We initially didn't do this for two reasons:
- Performance implications of calling the settings store for every event
that shows up in the calendar. As of d43e85da, we need that anyways.
- Performance implications of filtering in Python except SQL but... it
can't really be worse than not filtering at all.
- We don't easily know if it's valid for all events so we can't stop
rendering the unused calendar rows. That's an acceptable issue for
now, still better than nothing. We can always optimize later.
So we might as well implement it.
- Add central framebreaker page via safelink helper
- Update paypal, paypal2 and stripe plugins to use central framebreaker
- Add CSP header to cookies.html
---------
Co-authored-by: Mira Weller <weller@pretix.eu>
* setup vite and integrate fully with django
- vite starts with `python manage.py runserver`
- add templatetags to simply load vite hmr and entry points
- add eslint (recheck rules)
- enable non-strict ts
* better syntax for cors header setting
* migrate checkin rules editor to vue3
- move constants to a module
- move reading from and writing to non-vue html to django interop module
- switch to composition api and script setup sfc with pug
- use optional chaining operators a lot to simplify code
* migrate webcheckin plugin to vite+vue3
- migrate vue sfcs to script setup and pug
- move fetch calls into a api.ts module
- move common formatting and i18n strings into module
* fix migration error
* first draft migrating widget to vue3/vite
* first couple widget e2e tests
courtesy of claude
most of the tests don't work yet
* test file is not actually used
* drop widget_ prefix from e2e test fixtures
* add test for complete widget journey for simple event
* switch timezone in e2e tests to Europe/Berlin
* make dates in e2e tests relative
* migrate widget bugfix #5886
* start testing event series widget
* working vite widget setup for prod (untested), local dev (with or without dev server) and pytests, with flags for running the old version or the vite version
* simplify e2e test iframe check
* less flaky e2e tests
* top level await in iife build mode is not supported, so let's do import.meta.glob instead (we just need the build step not to see await, the code doesn't actually ever get loaded because it's DEV only)
* fix inconsistencies from automatic migration
* Allow gradual rollout of new vite-based widget by adding urls to an allowlist that gets checked against the "Origin" http header of request fetching the widget js
* add e2e tests for widget button, testing empty cart, adding specific items, and subevents
* remove janky claude testts again
* resolve migration TODOs: properly refocus parent on navigations
* use `npm run dev:control` for the vite dev server for admin components
* upgrade npm dependencies
* fix js linter errors
* fix python linter errors
* build all control vue components
* add new js config files to check-manifest ignore
* working prod build
acutal serving of built assets not tested yet
* fix templatetag paths to match what's in the vite mantifest
* add missing quotes around 'unsafe-eval' cors value
* remove now unused old vue2 tooling
* try fixing e2e test ci
* fix flake8 error
* check if vite build artefacts are in the wheel
* add license headers
* remove dom manipilation code necessary for `div.pretix-widget-compat` to work. No longer needed for vue3
* remove superfluous `createElement` calls
They might have been there because of IE, which is no longer relevant
* make widget dev mode parametizable through query params and document the usage and those params
* fix rst syntax
* remove migration todos file
Co-authored-by: luelista <mira@teamwiki.de>
* rearrange dockerfile commands for smaller image, thanks @luelista
* Update .gitignore, adding .vite
Co-authored-by: luelista <mira@teamwiki.de>
* add eslint CI
* make vue dev work in plugins
* fix docker build
* rebuild vite setup to support static prod plugins and dynamic hmr plugin development
* use toml for vite plugin config instead of standalone json file
* Add widget changes from #6047, #6149
* Allow buttons to reuse cart (Z#23226853)
* Always keep cart of buttons with items set
* widget: handle cart if not same-site (#6149)
---------
Co-authored-by: luelista <mira@teamwiki.de>
Co-authored-by: Kara Engelhardt <engelhardt@pretix.eu>
* Display invoice and tickets inline in browser (Z#23225892)
* Use FileResponse filename for AnswerDownload
* Use inline for PDF-view in pretix-control editor
* use as_attachment for API FileResponses
* do not ignore csp even for disposition=inline
* use as_attachment for file responses in control
* remove unused code
* improve code style
* Invoice preview inline
* do not force download on tickets in backend
* do not force download on AnswerDownload
* imrpove code style
* improve code style
* fix missing int str conversion
* Apply suggestions from code review
Co-authored-by: luelista <mira@teamwiki.de>
---------
Co-authored-by: luelista <mira@teamwiki.de>
* Group waiting list product choices by category
Use optgroups to group products by category in the waiting list selection
dropdown.
Products are normally separated in the UI by category grouping, but this
context is lost in the waiting list form. When multiple products share the
same name, this can make it difficult for customers to distinguish between
them.
* Add tests for waiting list initial selection with optgroups
Verify that the initial product selection (via `?item=` and `?var=`
query parameters) works correctly when choices are grouped by category
into `<optgroup>`s. Covers both plain items and items with variations.
* Do not create useless cart session accessing invoice address
* Skip useless code paths in CartMixin
* Do not create cart session on view with active session
* Create regression tests
* Data model draft
* Refactor query and assignment usages of old permissions
* Backend UI
* API serializer
* Big string replace
* Docs, tests and fixes for teams api
* Update docs for device auth
* Eliminate old names
* Make tests pass
* Use new permissions, remove inconsistencies
* Add test for translations
* Show plugin permissions
* Add permission for seating plans
* Fix plugin activation
* Fix failing test
* Refactor to permission groups
* Update doc/api/resources/devices.rst
Co-authored-by: luelista <weller@rami.io>
* Update doc/api/resources/events.rst
Co-authored-by: luelista <weller@rami.io>
* Update src/pretix/api/serializers/organizer.py
Co-authored-by: luelista <weller@rami.io>
* Fix typo
* Fix python version compat
* Replacement after rebase
* Add proper permission handling for exports
* Docs for exporters
* Runtime linting of permission names
* Fix typos
* Show export page even without orders permission
* More legacy compat
* Do not strongly validate before plugins are loaded
* Rebase migration
* Add permission for outgoing mails
* Review notes
* Update doc/api/resources/teams.rst
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
* Clean up logic around exporters
* Review and failures
* Fix migration leading to forbidden combination
* Handle permissions on event copying
* Remove print-statements
* Make test clearer
* Review feedback
* Add AnyPermissionOf
* migration safety
---------
Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
This was reported as a security issue, but we see no security impact or
exploitation path, as the security of PKCE relies on keeping the
verifier secret, not the challenge.
* Tax rounding: Allow to apply only for B2B (Z#23220106)
Most effective in combination with #5807
* Update src/pretix/base/settings.py
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
---------
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
* Order changes: Do not allow to double-book add-ons
* tests
* Update src/pretix/presale/templates/pretixpresale/event/fragment_addon_choice.html
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
---------
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
* Allow to combine language variant with region (fixes#3947, Z#23220951)
This only affects babel-based formatting (currently: currencies and phone numbers),
**not** Django-based formatting (currently: date and time formats).
* Remove tests where I don'T actually know whats right
* Fix lookup order
* Add option to restrict anonymous access to order URLs
By default, users who place orders while logged in can still access
their order URLs without authentication. This raises potential
security risks, particularly if order confirmation emails are
forwarded.
This commit introduces an organiser-level setting to disable anonymous
access for such orders. When enabled, unauthenticated attempts to access
URLs starting with `/order/`, which are intended for the customer, are
redirected to the login page. Upon successful authentication, the user
is redirected back to the original order URL.
It is important to note that this change does not impact routes intended
for attendees (e.g., `/ticket/*`), which remain accessible without
authentication.
* Change name of setting for future clarity
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* Update message wording
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* Eliminate database query
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* Rename feature flag to fix breaking tests
* Refactor order access verification code into `OrderDetailsMixin`
* Add test for logged-in customer accessing another customer's order
* Refactor order access conditions to remove nesting
* Handle case where customer is not yet verified
* Add additional information to help message
* Fix multidomain issue
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* Merge order/position variants into single tests
* Add docstring explaining return type of `order` property
* Apply suggestion from @raphaelm
* Fix indentation
---------
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
Co-authored-by: Raphael Michel <michel@rami.io>
* Product list: Show number of items currently in cart
* Apply suggestions from code review
Co-authored-by: Richard Schreiber <schreiber@rami.io>
* Add display property
---------
Co-authored-by: Richard Schreiber <schreiber@rami.io>
* Allow to round taxes on order-level
* Rename get_cart_total
* Persist rounding mode with order
* Add general docs
* Order creation API
* Update fee algorithm
* Rounding on payment method change
* Round when splitting order
* Fix failing tests
* Add settings page
* Add tests
* Replace algorithm
* Add test case for currency rounding
* Improve order change
* Update flowchart
* Update discount logic (more hypothetical, we don't store rounding on cart positions atm)
* Rename internal method
* Fix typo
* Update help text
* Apply suggestions from code review
Co-authored-by: luelista <weller@rami.io>
* Order rounding refactor (#5571)
* Add RoundingCorrectionMixin providing before-rounding-values as properties
* Use gross_price_before_rounding in more places
* Update doc/development/algorithms/pricing.rst
Co-authored-by: Martin Gross <gross@rami.io>
* Allow to override on perform_order
* Rebase migration
* Fix event cancellation
---------
Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Martin Gross <gross@rami.io>
