Commit Graph

760 Commits

Author SHA1 Message Date
Lukas Bockstaller
99c257d392 adds webhooks for giftcards (Z#23205473) (#5834)
* adds giftcard webhook events

* maps issuer_id of giftcard to organizer_id for logging

* adds new giftcard logtypes for transactions that aren't manual

* log_action calls cleanup

* drop acceptance webhook

* add acceptor_id to the giftcard transaction webhook event

* add missing log_action statements

* add new webhooks to docs

* fix tests

* fix linting
2026-02-11 12:51:09 +01:00
Raphael Michel
d58a6e2503 Tax rounding: Allow to apply only for B2B (Z#23220106) (#5810)
* Tax rounding: Allow to apply only for B2B (Z#23220106)

Most effective in combination with #5807

* Update src/pretix/base/settings.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-01-30 11:53:38 +01:00
Raphael Michel
c40e34af57 Model-based mail queuing 2026-01-30 10:43:02 +01:00
Raphael Michel
8058461f10 Invoices: Allow issuing invoices only to businesses (Z#23220397) (#5807)
* Invoices: Allow issuing invoices only to businesses

In situations where every invoice has a significant accounting cost and
consumers usually do not need invoices, this can save a lot of money or
effort.

* Improve backend UI if not qualified for invoice
2026-01-26 09:52:19 +01:00
Raphael Michel
c84bd4046d Invoice address: Make Peppol required in Belgium if available (Z#23220397) (#5808)
* Invoice address: Make Peppol required in Belgium if available (Z#23220397)

* Fix failing test, remove template bit that's now impossible
2026-01-26 09:52:06 +01:00
Phin Wolkwitz
0d6e1e2271 Prefetch program times, add test for query count (#5822) 2026-01-26 08:38:44 +01:00
Raphael Michel
0af011eed4 Web check-in: Show addons of ticket (Z#23220213) (#5827)
* Web check-in: Show addons of ticket (Z#23220213)

* Update src/pretix/plugins/webcheckin/static/pretixplugins/webcheckin/components/app.vue

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2026-01-26 08:37:54 +01:00
Raphael Michel
baac963fa8 API: Fix crash in check-in API (PRETIXEU-CT1) (#5806) 2026-01-23 11:17:21 +01:00
Raphael Michel
0259899e00 Discount: Respect addon grouping in line selection (Z#23220058) (#5782)
* Discount: Respect addon grouping in line selection (Z#23220058)

* Update src/pretix/base/models/discount.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-01-16 15:23:59 +01:00
Kian Cross
0fc2d6134f Add option to restrict anonymous access to order URLs (#4735)
* Add option to restrict anonymous access to order URLs

By default, users who place orders while logged in can still access
their order URLs without authentication. This raises potential
security risks, particularly if order confirmation emails are
forwarded.

This commit introduces an organiser-level setting to disable anonymous
access for such orders. When enabled, unauthenticated attempts to access
URLs starting with `/order/`, which are intended for the customer, are
redirected to the login page. Upon successful authentication, the user
is redirected back to the original order URL.

It is important to note that this change does not impact routes intended
for attendees (e.g., `/ticket/*`), which remain accessible without
authentication.

* Change name of setting for future clarity

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Update message wording

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Eliminate database query

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Rename feature flag to fix breaking tests

* Refactor order access verification code into `OrderDetailsMixin`

* Add test for logged-in customer accessing another customer's order

* Refactor order access conditions to remove nesting

* Handle case where customer is not yet verified

* Add additional information to help message

* Fix multidomain issue

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Merge order/position variants into single tests

* Add docstring explaining return type of `order` property

* Apply suggestion from @raphaelm

* Fix indentation

---------

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
Co-authored-by: Raphael Michel <michel@rami.io>
2026-01-16 13:46:08 +01:00
Luca Sorace "Stranck
c78365ce43 API: Fix race conditions in OrderChangeSerializer (#5756)
* OrderPositionCreateForExistingOrderSerializer.create: Fix race condition

* OrderFeeCreateForExistingOrderSerializer.create: Fix race condition

* OrderChange API serializers: Fix import orders
2026-01-06 15:46:41 +01:00
Raphael Michel
aa9c478c30 [SECURITY] Prevent access to arbitrary cached files by UUID (CVE-2025-14881) 2025-12-19 12:59:21 +01:00
Raphael Michel
5a1bcae085 Invoice address: Improve VAT ID input (#5647)
* Remove unmaintained depdendency vat_moss

* VAT ID normalization: Auto-add country codes

* VAT ID: County-specific labels

* Invoice address: Allow to set VAT ID as required per country

* Fix failing tests

* Update src/pretix/base/settings.py

Co-authored-by: luelista <weller@rami.io>

* Review fixes

---------

Co-authored-by: luelista <weller@rami.io>
2025-12-03 16:48:19 +01:00
Richard Schreiber
1a40215e91 Fix N+1 queries in API (#5684)
* Fix N+1 query in API quotas list

* fix membership N+1

* fix vouchers N+1 budget_used

* rename and reuse Voucher.annotate_budget_used_orders to budget_used

* fix flake8
2025-12-03 15:37:40 +01:00
Raphael Michel
bdd94b1f8a Add prioritization to webhook/notifications queue (#5513)
* Add prioritization to webhook/notifications queue

* Add missing code

* Missing license header

* Fix argument

* Use redis pipeline

* Update license header
2025-12-02 09:13:01 +01:00
Raphael Michel
2669afa1f8 Webhooks: Allow longer URLs (fixes #5443) (#5622) 2025-11-18 14:42:48 +01:00
Richard Schreiber
d7b6856322 Fix not allowing program times on event series (API/copy) (#5595)
* Fix not allowing program times on event series (API/copy)

* Return 400 when reading endpoint in event series

* add docs program times not available on event series

* fix isort
2025-11-17 15:36:53 +01:00
Raphael Michel
eb740204d4 Invoice issuer address: Add state field (#5603)
* Invoice issuer address: Add state field

* Update src/pretix/base/settings.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/base/models/invoices.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-11-14 09:56:46 +01:00
Phin Wolkwitz
fd9d03786b Add program times for items (Z#23178639)
* Add program times for items

* Fix frontend date validation

* Add ical data for program times [wip]

* Improve ical data for program times

* Remove duplicate code and add comments

* Adjust migration

* Remove program times form for event series

* Add pdf placeholder [wip]

* Improve explanation text with suggestion

Co-authored-by: Raphael Michel <michel@pretix.eu>

* Fix import sorting

* Improve ical generation

* Improve ical entry description

* Fix migration

* Add copyability for program times fot items and events

* Update migration

* Add API endpoints/functions, fix isort

* Improve variable name

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Remove todo comment

* Add documentation, Change endpoint name

* Change related name

* Remove unnecessary code block

* Add program times to item API

* Fix imports

* Add log text

* Use daterange helper

* Add and update API tests

* Add another API test

* Add program times to cloning tests

* Update query count because of program times query

* Invalidate cached tickets on program time changes

* Reduce invalidation calls

* Update migration after rebase

* Apply improvements to invalidation from review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* remove unneccessary attr=item param

* remove unnecessary kwargs for formset_factory

* fix local var name being overwritten in for-loop

* fix empty formset being saved

* Use subevent if available

* make code less verbose

* remove double event-label in ical desc

* fix unnecessary var re-assign

* fix ev vs p.subevent

---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-11-06 12:24:47 +01:00
Raphael Michel
3e972eddbf Allow to round taxes on order-level (#5019)
* Allow to round taxes on order-level

* Rename get_cart_total

* Persist rounding mode with order

* Add general docs

* Order creation API

* Update fee algorithm

* Rounding on payment method change

* Round when splitting order

* Fix failing tests

* Add settings page

* Add tests

* Replace algorithm

* Add test case for currency rounding

* Improve order change

* Update flowchart

* Update discount logic (more hypothetical, we don't store rounding on cart positions atm)

* Rename internal method

* Fix typo

* Update help text

* Apply suggestions from code review

Co-authored-by: luelista <weller@rami.io>

* Order rounding refactor (#5571)

* Add RoundingCorrectionMixin providing before-rounding-values as properties

* Use gross_price_before_rounding in more places

* Update doc/development/algorithms/pricing.rst

Co-authored-by: Martin Gross <gross@rami.io>

* Allow to override on perform_order

* Rebase migration

* Fix event cancellation

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Martin Gross <gross@rami.io>
2025-10-30 11:49:31 +01:00
Raphael Michel
9a69b76880 API: Expose history of check-ins (Z#23206049) 2025-10-30 10:45:01 +01:00
Raphael Michel
40db7d939f API: Trust discounts assigned by pretixPOS, do not assign differently (#5531) 2025-10-21 18:35:06 +02:00
Raphael Michel
ac09b56a2c Fix crash in API validation (Z#23211224) 2025-10-15 11:06:19 +02:00
Raphael Michel
177a7d07fc Update license header (#5540) 2025-10-10 15:32:46 +02:00
Raphael Michel
2dc772cfcc API: Allow to psas comment when issuing refund 2025-10-10 09:31:47 +02:00
Raphael Michel
15cbb3a416 Do not crash if generate_invoice fails (#5483)
* Do not crash if generate_invoice fails

* Add logging

* Add cancellation to try block

* One last thing…
2025-10-07 11:20:31 +02:00
Raphael Michel
301191e4bd Notification queues: Optimize order for less queries (#5512)
* Notification queues: Optimize order for less queries

* Update src/pretix/api/webhooks.py

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2025-10-06 09:24:51 +02:00
luelista
9d5563018e Add "bulk" argument to order_placed signal (#5505)
* datasync: add immediate parameter to enqueue_order

* interactive argument for order_placed signal

The ``interactive`` argument specifies whether the order was
placed interactively, by a customer (as opposed to via a bulk
import or the REST API).

* use bulk=True instead of interactive=False to mark bulk imports
2025-10-02 09:36:02 +02:00
Raphael Michel
9d2ef94389 Invoicing: Configurable service date 2025-09-29 13:15:42 +02:00
Martin Gross
39e5711e95 API/Organizer: Allow Device-Token access to Organizer settings; expose mf0aes_random_uid (#5326) 2025-09-26 14:41:11 +02:00
Raphael Michel
05c74b7ad6 Pluggable invoice transmission methods (#5020)
* Flexible invoice transmission

* UI work

* Add peppol and output

* API support

* Profile integration

* Simplify form for individuals

* Remove sent_to_customer usage

* more steps

* Revert "Bank transfer: Allow to send the invoice direclty to the accounting department (#2975)"

This reverts commit cea6c340be.

* minor fixes

* Fixes after rebase

* update stati

* Backend view

* Transmit and show status

* status, retransmission

* API retransmission

* More fields

* API docs

* Plugin docs

* Update migration

* Add missing license headers

* Remove dead code, fix current tests

* Run isort

* Update regex

* Rebase migration

* Fix migration

* Add tests, fix bugs

* Rebase migration

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Make migration reversible

* Add TransmissionType.enforce_transmission

* Fix registries API usage after rebase

* Remove code I forgot to delete

* Update transmission status display depending on type

* Add testmode_supported

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* New mechanism for non-required invoice forms

* Update src/pretix/base/invoicing/transmission.py

Co-authored-by: luelista <weller@rami.io>

* Declare testmode_supported for email

* Make transmission_email_other an implementation detail

* Fix failing tests and add new ones

* Update src/pretix/base/services/invoices.py

Co-authored-by: luelista <weller@rami.io>

* Add emails to email history

* Fix comma error

* More generic default email text

* Cleanup

* Remove "email invoices" button and refine logic

* Rebase migration

* Fix edge case

---------

Co-authored-by: luelista <weller@rami.io>
2025-08-19 17:59:45 +02:00
Raphael Michel
0cc8e59bb0 Webhooks: Add vouchers (Z#23203072) (#5360)
* Webhooks: Add vouchers (Z#23203072)

This also requires more consistent usage of webhook types to avoid
vouchers not being known to the external system.

* Update src/pretix/api/webhooks.py

Co-authored-by: luelista <weller@rami.io>

* Fix shredder test

---------

Co-authored-by: luelista <weller@rami.io>
2025-08-19 13:04:22 +02:00
Raphael Michel
a51a6123f5 Organizer-level plugins (#5305)
* Add version notes to the docs

* Adapt signal handling

* Add UI

* Add API

* API and tests

* Fix registry

* Update doc/development/api/plugins.rst

Co-authored-by: Felix Rindt <felix@rindt.me>

* Fix failing tests

* Apply suggestions from code review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugin_events.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugins.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugins.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/navigation.py

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/urls.py

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @wiffbi

* REbase migration

* Fix review note

* Fix test cases

* Remove plugin from all events if disabled on org level

* Update doc/development/api/plugins.rst

* Unify registries

* Rebase migration

---------

Co-authored-by: Felix Rindt <felix@rindt.me>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: luelista <weller@rami.io>
2025-08-19 11:33:34 +02:00
Luca Sorace "Stranck
69e50d35a7 API: Make case insensitive boolean query params (#5382) 2025-08-18 11:17:05 +02:00
Raphael Michel
650b4b461f Voucher: Add creation date (Z#23202621) (#5359)
* Voucher: Add creation date (Z#23202621)

* Migration fix

* Update doc/api/resources/vouchers.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/base/migrations/0285_voucher_created.py

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2025-08-18 10:56:53 +02:00
Luca Sorace "Stranck
d14f7fb108 Orders API: Add check_quotas to orders/change and PATCH/POST orderpositions query params (#5323)
* Orders API: Add check_quotas to orders/change and PATCH/POST orderpositions query params

* Refs #5323: Checkstyle fix

Forgot tu run fkale8 after implementing unit tests oops

* Refs #5323: Fix unit tests and fix of the previous ones

* Refs #5323: PR review
2025-08-13 16:15:05 +02:00
Raphael Michel
067e11c265 Allow to annul a check-in (#5303)
* Allow to annul a check-in

* Fix locking

* Update doc/api/resources/checkin.rst

Co-authored-by: Phin Wolkwitz <wolkwitz@rami.io>

---------

Co-authored-by: Phin Wolkwitz <wolkwitz@rami.io>
2025-08-08 09:22:19 +02:00
Martin Gross
e1756a1ebb API/Vouchers: Expose "budget" and "budget_used" (Z#286557) (#5325)
Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-07-28 18:53:15 +02:00
Martin Gross
f5b0454e9f API/Quotas: Expose "ignore_for_event_availability" (Z#23202218) (#5324) 2025-07-28 18:22:39 +02:00
Raphael Michel
a381adac33 API: Add transactions (#5292)
* API: Add transactions

* Apply suggestions from code review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-07-08 14:11:53 +02:00
Raphael Michel
14ed6982a5 New data model for default tax rule and new options for cancellation fees (#4962)
* New data model for default tax rule

* Remove misleading empty label when field is not optional

* Allow to split cancellation fee

* Fix API and tests

* Update migration

* Update src/tests/api/test_taxrules.py

Co-authored-by: luelista <weller@rami.io>

* Update src/tests/api/test_taxrules.py

Co-authored-by: luelista <weller@rami.io>

* Review note

* Update src/pretix/base/models/tax.py

Co-authored-by: luelista <weller@rami.io>

* Flip API behaviour for default

* Fix failing tests

* Fix failing test

* Split migration

---------

Co-authored-by: luelista <weller@rami.io>
2025-06-30 16:47:09 +02:00
Raphael Michel
e796dc3a65 Webhooks: Fix typo in retry interval 2025-06-25 16:46:52 +02:00
Raphael Michel
9017128513 Webhooks: Fix retry logic (Z#23197527) (#5250)
* Webhooks: Fix retry logic (Z#23197527)

* Add no-op migration
2025-06-25 08:56:46 +02:00
Raphael Michel
5d3fc62ba4 Questions: Validate type changes (Z#23197118) (#5259)
* Questions: Validate type changes (Z#23197118)

* Update src/pretix/base/forms/questions.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/base/forms/questions.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/base/forms/questions.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/base/models/items.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Fix failing test

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-06-24 17:54:28 +02:00
Raphael Michel
eba5c1b36d API: Fix crash on distributing a fee over tax rates with zero value (Z#23196669) (#5226) 2025-06-12 14:03:25 +02:00
Raphael Michel
7d30ecf527 API: Add items__in filter for quotas (Z#23195926) (#5232)
* API: Add items__in filter for quotas (Z#23195926)

* Update doc/api/resources/quotas.rst

Co-authored-by: Richard Schreiber <schreiber@rami.io>

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-06-12 12:24:45 +02:00
Raphael Michel
e46e689f01 Allow to add declaration of accessibility (#5140)
* Allow to add declaration of accessibility

* add fallback for empty accessibility_title

* unify label format (not "Title for")

* move title to top and set helptext before text

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-05-28 13:23:04 +02:00
Raphael Michel
5522d67f9b API: Fix old meta values being returned when updating event (fixes #5077) (#5080) 2025-05-09 08:59:40 +02:00
Raphael Michel
025ee6710c Fix #4982 -- API: Do not parse decimal input to float (#5012) 2025-04-22 17:36:04 +02:00
luelista
277a5bffa8 Allow changing ticket secret via API (Z#23188201) (#4989) 2025-04-07 13:49:19 +02:00