CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-09-30 19:04:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
14,572 Commits 423 Branches 218 Tags
e2b28dd81efe6d92cd2743cdd0331c6ea402247e
Commit Graph
13353 Commits
Author SHA1 Message Date
Raphael Michel e2b28dd81e Bump to 2026.6.3 2026-09-29 20:43:41 +02:00
Raphael Michel 169110e741 Hotfix: Perform validation on the selected step, not on all steps before 2026-09-29 20:43:33 +02:00
Raphael Michel 91d7459ecd Bump to 2026.6.2 2026-09-29 14:23:42 +02:00
Raphael Michel 686e4d54b1 Fix tests after hierarkey update 2026-09-29 13:52:12 +02:00
Raphael Michel 7ef22971c6 [SECURITY] API: Fix session validation for uploaded files (CVE-2026-101269, Z#23247174) 2026-09-29 13:40:38 +02:00
Mira Weller d2ba4b7733 Block out of bounds image crop dimensions (Z#23245937 / PRT-009) 2026-09-29 13:40:18 +02:00
Mira Weller 81e004e6c8 Prevent parsing non-standard-compliant JSON float values (Z#23245937 / PRT-021) 2026-09-29 13:40:18 +02:00
Mira Weller d8fe665798 Fix potential infinite loop in pdf render (Z#23245937 / PRT-021) 2026-09-29 13:40:18 +02:00
Mira Weller b7117bb3a3 Fix inefficient loop in compute_validity (Z#23245937 / PRT-013) 2026-09-29 13:40:18 +02:00
Raphael Michel 912851aa87 [SECURITY] OAuth: Disable existing tokens when deactivating Application (CVE-2026-101271, Z#23247296) 2026-09-29 13:40:18 +02:00
Mira Weller 5440508be0 [SECURITY] Escape help texts (CVE-2026-101270) 2026-09-29 13:40:17 +02:00
Raphael Michel 7025159f6b [SECURITY] Fix customer session fixation on cross-domain login (CVE-2026-101268, Z#23247268) 2026-09-29 13:39:39 +02:00
Raphael Michel 42cedc7306 [SECURITY] Fix information leak in widgets.json on dashboard (CVE-2026-101267, Z#23247172) 
Thanks to Wenhao Wu, Southeast University
 2026-09-29 13:39:38 +02:00
Raphael Michel 11ac2cc91c [SECURITY] Fix checkout validation bypass (CVE-2026-101266, Z#23245008) 2026-09-29 13:38:58 +02:00
Raphael Michel 2bd0a341d6 Bump to 2026.6.1 2026-07-28 12:25:38 +02:00
Raphael Michel 6bec15d12a [SECURITY] Add missing permission check for view (CVE-2026-57532) 2026-07-28 12:25:31 +02:00
Raphael Michel fd565ecdb2 Bump version to 2026.6.0 2026-07-01 16:33:07 +02:00
Nikita Mitasov f35b13b686 Translations: Update Russian 
Currently translated at 18.9% (1200 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ru/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-es 550bb675f5 Translations: Update Spanish 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/es/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-es adc9c9d514 Translations: Update Spanish 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/es/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-es 8441c4bc7a Translations: Update French 
Currently translated at 100.0% (260 of 260 strings)

Translation: pretix/pretix (JavaScript parts)
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix-js/fr/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-es 97ff252c09 Translations: Update French 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/fr/

powered by weblate
 2026-07-01 16:32:06 +02:00
CVZ-es d3ca2ac1e5 Translations: Update German 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-07-01 16:32:06 +02:00
Raphael MichelandMira Weller 6eebaaa563 [SECURITY] Hardening for user impersonation feature (CVE-2026-13602) 
---------

Co-authored-by: Mira Weller <weller@pretix.eu>
 2026-07-01 15:15:43 +02:00
Raphael MichelandMira Weller c9781f012b [SECURITY] Centralize framebreaking logic from payment plugins to core (CVE-2026-13602) 
- Add central framebreaker page via safelink helper
- Update paypal, paypal2 and stripe plugins to use central framebreaker
- Add CSP header to cookies.html

---------

Co-authored-by: Mira Weller <weller@pretix.eu>
 2026-07-01 15:15:43 +02:00
Mira WellerandRaphael Michel 000bf54105 [SECURITY] Allowlisting and changed salts for safelink and safelink_callback (CVE-2026-13602) 
---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
 2026-07-01 15:15:43 +02:00
Lukas Bockstaller e42d3d632f filter out the 404 log records from django.request (#6324) 2026-07-01 11:33:04 +02:00
Lukas Bockstaller 3bf5a5e478 include settings attribute during type checking (#6323) 
* include settings attribute during type checking

* isort
 2026-07-01 11:32:54 +02:00
Raphael Michel a6f31df0d4 Do not assign domain across organizers when copying events 2026-06-30 18:51:49 +02:00
Raphael Michel d40492748a Event product list: Hotfix for pathological performance in large event series (#6318) 
* Event product list: Hotfix for pathological performance

* Stop outputting bullsht numbers to widget
 2026-06-29 19:02:06 +02:00
Richard Schreiber f4ca230af7 Improve voucher import unique code checks (#6311) 
* Check for duplicate codes in import

* Check for existing codes instead of failing on db-level

* as we do not lock, catch IntegrityErrors due to race-conditions on import

* fix flake8
 2026-06-29 14:37:41 +02:00
Richard Schreiber 4fb1748bf6 Fix handling country=None in attendee profiles (#6309) 
* Fix handling country=None in AttendeeProfile describe

* Update checkoutflow.py

* fix more occurences

* handle country=None in InvoiceAddress even if it is not allowed
 2026-06-29 14:32:01 +02:00
Raphael Michel 9d668af102 Discover translatable strings in .ts files (Z#23238475) 2026-06-28 17:51:40 +02:00
Raphael Michel 80fd4a3b2a Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael Michel 65bb2283d4 Translations: Update German 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael Michel 00751e8911 Translations: Update German (informal) (de_Informal) 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael Michel 957a066475 Translations: Update German 
Currently translated at 100.0% (6343 of 6343 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de/

powered by weblate
 2026-06-28 17:48:28 +02:00
Raphael Michel 7e077bdd7e Subevent detail: Fix incorrect ticket count (Z#23238481) 2026-06-28 17:43:22 +02:00
Raphael Michel e80d84ec3c Update po files 
[CI skip]

Signed-off-by: Raphael Michel <michel@rami.io>
 2026-06-28 16:44:09 +02:00
Kim Lozano dc3b742d8c Translations: Update Catalan 
Currently translated at 29.7% (1875 of 6302 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/ca/

powered by weblate
 2026-06-28 16:42:32 +02:00
Raphael Michelandpajowu 1f5fe1b237 SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468) (#6260) 
* SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468)

* SMTP SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (#6264)

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
 2026-06-26 16:45:20 +02:00
Raphael Michel a8997f8971 [SECURITY] Properly escape HTML tags in PDF generation (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Raphael Michel eb068f524c [SECURITY] Prevent reading of any local files in reportlab (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Raphael Michel f615595547 [SECURITY] Disable outbound and file access for reportlab (CVE-2026-57535) 2026-06-25 16:46:13 +02:00
Mira Weller 8bd78eefcf [SECURITY] Fix reflected XSS in redirection page (CVE-2026-57533) 2026-06-25 16:46:13 +02:00
Mira Weller 848f7fa0e5 [SECURITY] Fix stored XSS in ticket confirmation page (CVE-2026-13225) 2026-06-25 16:46:13 +02:00
Mira Weller 3442a543c8 [SECURITY] Hardening: Don't use |safe on confirm_messages 2026-06-25 16:46:13 +02:00
Mira Weller f88c24863d [SECURITY] Fix XSS in ticket layout JSON (CVE-2026-57532) 2026-06-25 16:46:13 +02:00
Richard Schreiber e8492cad3c Seating: fix handling optional position attribute (#6303) 2026-06-24 09:47:08 +02:00
Richard Schreiber 7ea5a2b59e PDF: add placeholder invoice_custom_field (#6298) 2026-06-24 09:46:43 +02:00