Commit Graph

1253 Commits

Author SHA1 Message Date
Raphael Michel
a7fe43ec01 Add proper permission handling for exports 2026-01-29 10:07:14 +01:00
Raphael Michel
426f3db805 Refactor to permission groups 2026-01-27 14:56:23 +01:00
Raphael Michel
8a603dd4c9 Fix plugin activation 2026-01-27 14:56:23 +01:00
Raphael Michel
18d3df4736 Use new permissions, remove inconsistencies 2026-01-27 14:56:23 +01:00
Raphael Michel
2c8b545ed1 Make tests pass 2026-01-27 14:56:23 +01:00
Raphael Michel
f78af94e35 Eliminate old names 2026-01-27 14:56:23 +01:00
Raphael Michel
8dc241934d Big string replace 2026-01-27 14:56:23 +01:00
Raphael Michel
a5f4aebba8 Refactor query and assignment usages of old permissions 2026-01-27 14:56:22 +01:00
Raphael Michel
5767f15709 Data model draft 2026-01-27 14:56:22 +01:00
Raphael Michel
3e0ff1e6ed Send security notification when recovery code is used or created by admin (#5719)
* Send security notification when recovery code is used or created by admin

"Where to store recovery codes" is one of these problems there is no
right answer to, so many people store them in a less-than-optimal place.
If that's the reality we live in, this PR adds at least a little
security so one notices when they get used :)

* Add sentence
2026-01-26 10:01:07 +01:00
Raphael Michel
8058461f10 Invoices: Allow issuing invoices only to businesses (Z#23220397) (#5807)
* Invoices: Allow issuing invoices only to businesses

In situations where every invoice has a significant accounting cost and
consumers usually do not need invoices, this can save a lot of money or
effort.

* Improve backend UI if not qualified for invoice
2026-01-26 09:52:19 +01:00
Raphael Michel
5c8e785a6f Fix typo from merge conflict resolving 2026-01-26 09:29:22 +01:00
Raphael Michel
c3fd3a0838 Scheduled exports: Add copy button (Z#23221224) (#5823)
* Scheduled exports: Add copy button (Z#23221224)

* Update button label
2026-01-26 08:46:25 +01:00
Raphael Michel
23559e0711 Scheduled export: Move error message for missing permissions
This error message mostly occurs when working in admin mode and this
change allows our support team to still see what the form looks like to
guide users through, even if they can't save.
2026-01-22 21:26:33 +01:00
Raphael Michel
815e31d9a0 Resolve syntax warning in Pyton 3.14 2026-01-20 12:15:49 +01:00
Raphael Michel
ca23f7ebc2 License check: Recognize license keywords (fixes #5812) (#5815) 2026-01-16 15:33:03 +01:00
George Hickman
1e0e16642d Add more log entry types to the org-level logs page (#5787)
* Add more log entry types to the org-level logs page

all_logentries() limits the QuerySet to LogEntrys whose content object
is an Organizer.

This change expands that to get any LogEntry linked to the current
Organization.  It removes those that are linked directly to an Event,
since they are already served by the event-level logs page.

* Check active plugins with either Event or Organizer
2026-01-16 13:36:23 +01:00
Raphael Michel
308e14bab3 Mail settings: Correctly declare plaintext email (Z#23218835) (#5738)
* Mail settings: Correctly declare plaintext email (Z#23218835)

* Apply suggestions from code review

Co-authored-by: luelista <weller@rami.io>

* Update escaping

* Escaping update

---------

Co-authored-by: luelista <weller@rami.io>
2026-01-05 12:33:43 +01:00
Raphael Michel
ebbd18bb26 Category selection: Search internal names 2025-12-22 11:29:23 +01:00
Raphael Michel
aa9c478c30 [SECURITY] Prevent access to arbitrary cached files by UUID (CVE-2025-14881) 2025-12-19 12:59:21 +01:00
Alexander Schwartz
4c3584c788 Pick the failed order count from value parameter for the message (#5722)
Closes #5721
2025-12-17 17:23:11 +01:00
Lukas Bockstaller
2e89fc0a94 Questions: filter answers by dateFrame (Z#23216406) (#5706)
* replace manual form with QuestionFilterForm

* move form to form/item.py

* filter using a dateFrameField

* rename QuestionFilterForm to QuestionAnswerFilterForm

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* pass existing `opqs` into `filter_qs`

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* clean up filters

* fix view errors

* add labels

* display validation failures on field/label

* fix linting issues

* adjust datetime comparisons from lte to lt & gte to gt

* Change filter-form layout similar to order-filter-form

* improve label texts

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* use order constants

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* use Order Constants in Form where possible

* Change phrasing from Subevent to Date

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* include product variations in products filter

* repair time zone comparisons

* fix linting

* move filter form to form/filter.py

* remove references to timezone.utc

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* remove manual class statements

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* removes unnecessary check

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* fix datetime comparison

* Add full stop to error message to match style

* unify var-names and code-indent

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-12-15 12:46:06 +01:00
Raphael Michel
b895d9bbca Import large package lazily to speed up startup (#5636)
* Import large package lazily to speed up startup

* Make all jsonschema imports lazy
2025-12-09 09:52:53 +01:00
luelista
324eeb8d40 Fix crash when imported CSV has invalid syntax (#5702) 2025-12-09 08:09:34 +01:00
luelista
609b7c82ee Handle duplicate column names in CSV import (#5681)
- display a warning message to the user
- automatically rename columns by adding "__1", "__2", ... suffixes
2025-12-04 14:03:27 +01:00
Richard Schreiber
1a40215e91 Fix N+1 queries in API (#5684)
* Fix N+1 query in API quotas list

* fix membership N+1

* fix vouchers N+1 budget_used

* rename and reuse Voucher.annotate_budget_used_orders to budget_used

* fix flake8
2025-12-03 15:37:40 +01:00
Raphael Michel
db7518735a Allow admins to inspect invoices (#5641)
This is helpful to debug invoice renderers or non-PDF invoices like
Peppol or other XML formats
2025-11-19 14:42:18 +01:00
Raphael Michel
5583298322 Auto-verify user email addresses on accepting invites (#5609)
* Auto-verify user email addresses on accepting invites

* Update src/pretix/control/views/auth.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-11-14 09:55:18 +01:00
luelista
0256ee76db Optionally show organizer slug in select2 (#5605) 2025-11-12 13:28:31 +01:00
luelista
1cb2d443f9 Validation of user email addresses (#5434)
* Validation of user email addresses
* Improve email and password change forms
2025-11-07 11:17:34 +01:00
Phin Wolkwitz
fd9d03786b Add program times for items (Z#23178639)
* Add program times for items

* Fix frontend date validation

* Add ical data for program times [wip]

* Improve ical data for program times

* Remove duplicate code and add comments

* Adjust migration

* Remove program times form for event series

* Add pdf placeholder [wip]

* Improve explanation text with suggestion

Co-authored-by: Raphael Michel <michel@pretix.eu>

* Fix import sorting

* Improve ical generation

* Improve ical entry description

* Fix migration

* Add copyability for program times fot items and events

* Update migration

* Add API endpoints/functions, fix isort

* Improve variable name

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Remove todo comment

* Add documentation, Change endpoint name

* Change related name

* Remove unnecessary code block

* Add program times to item API

* Fix imports

* Add log text

* Use daterange helper

* Add and update API tests

* Add another API test

* Add program times to cloning tests

* Update query count because of program times query

* Invalidate cached tickets on program time changes

* Reduce invalidation calls

* Update migration after rebase

* Apply improvements to invalidation from review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* remove unneccessary attr=item param

* remove unnecessary kwargs for formset_factory

* fix local var name being overwritten in for-loop

* fix empty formset being saved

* Use subevent if available

* make code less verbose

* remove double event-label in ical desc

* fix unnecessary var re-assign

* fix ev vs p.subevent

---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-11-06 12:24:47 +01:00
Richard Schreiber
0b46982e6d Allow blocked seats to be booked in backend (#5585) 2025-11-06 08:02:42 +01:00
Raphael Michel
3e972eddbf Allow to round taxes on order-level (#5019)
* Allow to round taxes on order-level

* Rename get_cart_total

* Persist rounding mode with order

* Add general docs

* Order creation API

* Update fee algorithm

* Rounding on payment method change

* Round when splitting order

* Fix failing tests

* Add settings page

* Add tests

* Replace algorithm

* Add test case for currency rounding

* Improve order change

* Update flowchart

* Update discount logic (more hypothetical, we don't store rounding on cart positions atm)

* Rename internal method

* Fix typo

* Update help text

* Apply suggestions from code review

Co-authored-by: luelista <weller@rami.io>

* Order rounding refactor (#5571)

* Add RoundingCorrectionMixin providing before-rounding-values as properties

* Use gross_price_before_rounding in more places

* Update doc/development/algorithms/pricing.rst

Co-authored-by: Martin Gross <gross@rami.io>

* Allow to override on perform_order

* Rebase migration

* Fix event cancellation

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Martin Gross <gross@rami.io>
2025-10-30 11:49:31 +01:00
Raphael Michel
04fae9ea14 Fix code style issue 2025-10-29 10:17:43 +01:00
Raphael Michel
1e0ede529c Event cancellation: Add safety and security checks (#5565)
* Event cancellation: Add safety and security checks

When cancelling an event, a large sum of money might be refunded
instantly. This PR adds safety features around this by

- doing a dry-run first that shows a preview of the expected refund sum

- sending a confirmation mode via email for any automatic refunds of more than 100 currency units

- keeping a more detailed log of the settings this was executed with

* Update src/pretix/control/views/orders.py

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2025-10-29 08:53:48 +01:00
Phin Wolkwitz
8a3da37b45 Connect giftcards with customer accounts (#5126)
Connect giftcards with customer accounts, show giftcards during checkout and in account , show giftcard list in backend customer view
2025-10-16 13:20:00 +02:00
Raphael Michel
177a7d07fc Update license header (#5540) 2025-10-10 15:32:46 +02:00
luelista
50c1c9c724 Run sync job as soon as possible on clicking "Sync now" (#5526) 2025-10-08 13:15:09 +02:00
Richard Schreiber
15d15f978f Fix logging when changing user notifications (#5470) 2025-09-24 09:58:23 +02:00
✨ Q (it/its) ✨
7037f348bf remove infinite loop when output plugin provides a URI for a whole order (#5474) 2025-09-23 18:26:38 +02:00
Raphael Michel
fb8a8142d9 Scheduled exports: Check permissions on creation 2025-09-22 10:22:12 +02:00
luelista
0fcaeda0e9 Add fields to logdetail to aid debugging (#5426) 2025-09-02 17:50:49 +02:00
Richard Schreiber
09e9273a57 Fix unhandled not found error when manually managing sync jobs (#5412)
* Fix unhandled not found error when manually managing sync jobs

* Improve info text (suggestions from code review)

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2025-09-02 09:22:47 +02:00
Raphael Michel
3f00fa58a0 Subevents: set inactive if non-batch deletion of subevent fails (Z#23204183) (#5374)
* Subevents: Extend fallback for undeletable dates for single deletion (Z#23204183)

* Fix useless writes

* Update src/pretix/control/views/subevents.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/views/subevents.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Fix flow

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-08-22 10:47:47 +02:00
Raphael Michel
fe9a7eaa24 Order overview: Try to make linked filters behave as expected for line-level cancellations (Z#23203500) 2025-08-22 09:30:34 +02:00
Raphael Michel
05c74b7ad6 Pluggable invoice transmission methods (#5020)
* Flexible invoice transmission

* UI work

* Add peppol and output

* API support

* Profile integration

* Simplify form for individuals

* Remove sent_to_customer usage

* more steps

* Revert "Bank transfer: Allow to send the invoice direclty to the accounting department (#2975)"

This reverts commit cea6c340be.

* minor fixes

* Fixes after rebase

* update stati

* Backend view

* Transmit and show status

* status, retransmission

* API retransmission

* More fields

* API docs

* Plugin docs

* Update migration

* Add missing license headers

* Remove dead code, fix current tests

* Run isort

* Update regex

* Rebase migration

* Fix migration

* Add tests, fix bugs

* Rebase migration

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Make migration reversible

* Add TransmissionType.enforce_transmission

* Fix registries API usage after rebase

* Remove code I forgot to delete

* Update transmission status display depending on type

* Add testmode_supported

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* New mechanism for non-required invoice forms

* Update src/pretix/base/invoicing/transmission.py

Co-authored-by: luelista <weller@rami.io>

* Declare testmode_supported for email

* Make transmission_email_other an implementation detail

* Fix failing tests and add new ones

* Update src/pretix/base/services/invoices.py

Co-authored-by: luelista <weller@rami.io>

* Add emails to email history

* Fix comma error

* More generic default email text

* Cleanup

* Remove "email invoices" button and refine logic

* Rebase migration

* Fix edge case

---------

Co-authored-by: luelista <weller@rami.io>
2025-08-19 17:59:45 +02:00
Raphael Michel
0cc8e59bb0 Webhooks: Add vouchers (Z#23203072) (#5360)
* Webhooks: Add vouchers (Z#23203072)

This also requires more consistent usage of webhook types to avoid
vouchers not being known to the external system.

* Update src/pretix/api/webhooks.py

Co-authored-by: luelista <weller@rami.io>

* Fix shredder test

---------

Co-authored-by: luelista <weller@rami.io>
2025-08-19 13:04:22 +02:00
Raphael Michel
7cdccc7d8e Bulk order-refund: Create log entries (Z#23203462) (#5357) 2025-08-19 12:09:23 +02:00
Raphael Michel
727ed67ff4 Orders: Prevent race condition in manual status transition (Z#23203887) (#5385) 2025-08-19 12:01:03 +02:00
Raphael Michel
a51a6123f5 Organizer-level plugins (#5305)
* Add version notes to the docs

* Adapt signal handling

* Add UI

* Add API

* API and tests

* Fix registry

* Update doc/development/api/plugins.rst

Co-authored-by: Felix Rindt <felix@rindt.me>

* Fix failing tests

* Apply suggestions from code review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugin_events.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugins.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugins.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/navigation.py

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/urls.py

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @wiffbi

* REbase migration

* Fix review note

* Fix test cases

* Remove plugin from all events if disabled on org level

* Update doc/development/api/plugins.rst

* Unify registries

* Rebase migration

---------

Co-authored-by: Felix Rindt <felix@rindt.me>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: luelista <weller@rami.io>
2025-08-19 11:33:34 +02:00