Commit Graph
3304 Commits
Author SHA1 Message Date
Martin Gross 7eec8186cd Add label-overrides to contact_form_fields_overrides and question_form_fields_overrides (Z#23244154) 2026-08-28 15:34:50 +02:00
Richard Schreiber 6d4aba6e3d Questions: add min-length to string/text type questions (#6488)
* Questions: add min-length to string/text type questions

* fix test
2026-08-25 09:37:37 +02:00
Raphael Michel b74371bef1 Fix typos 2026-08-24 17:26:37 +02:00
b809d93bdc Do not hide subevent list if filtered list is empty (#6460)
* Do not hide subevent list if filtered list is empty

* Event calendar: Allow to show a message if no events are found

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Fix failures on org level

* add aria-hidden if no subevents

* Update src/pretix/base/settings.py

* Update src/pretix/base/settings.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-08-24 14:42:41 +02:00
Kara Engelhardt 0593172146 Transmit invoices generated due to paymentprovider changes (Z#23242806) 2026-08-24 13:45:54 +02:00
Raphael Michelandluelista 58f331ba1f Allow to set payment term per sales channel (#6459)
* Allow to set payment term per sales channel

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2026-08-24 09:09:47 +02:00
Richard Schreiber 1c17c35b16 Add event_begin_time & event_end_time to scheduledmail templates (Z#23241932) (#6484) 2026-08-18 16:19:15 +02:00
luelista 4dd6e1a19f Fix attendee addresses for country requiring state in address (#6480) 2026-08-14 17:06:41 +02:00
Richard Schreiber 4cb9d76281 Fix typo in event’s default download reminder attendee (#6473) 2026-08-14 16:47:39 +02:00
luelistaandRichard Schreiber f8cc31b120 Order-level questions (#6471)
* New CheckoutSession model, created and deleted throught cart lifetime but only used for order-level question answers so far
* Order-level QuestionAnswers (relations to CheckoutSession / Order)
* New container_type field on Question model to specify whether Question belongs to order or orderposition
* Order-level questions are currently experimental, UI is hidden behind feature flag

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-08-14 14:56:45 +02:00
Lukas Bockstallerandpajowu c4a5a9a84d BasePaymentProvider & PayPal2: allow to cancel pending payments on a per payment basis (Z#23240966) (#6472)
* move payment into pending on PENDING_REVIEW webhook

* mark approved payment as pending

* extend BasePaymentProvider to gate aborting pending payments on a payment per payment basis

* add timeout to paypal after which a pending payment can be canceled

* formatting

* add missing negation

* cleanup abort_pending_allowed methods

* Apply suggestions from code review

Co-authored-by: pajowu <pajowu@pajowu.de>

* check all capture elements

* rename method and change defaults

* remove left over Constant

* flake8 .

---------

Co-authored-by: pajowu <pajowu@pajowu.de>
2026-08-13 17:28:54 +02:00
Kara Engelhardt 4e5fbacf6d Replace deprecated redis setex call 2026-08-13 16:59:42 +02:00
7fe31634e6 Allow RelativeDate in relation to a moment of order (#6160)
* initial implementation

* factor out _resolve_base_date

* add js to prevent illegal inputs

* fix tests

* Update src/pretix/base/reldate.py

Co-authored-by: Raphael Michel <michel@pretix.eu>

* Apply suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* move js includes of to fragment_js.html

* add type annotations

* moves logic from RelativeDateWrapper into RelativeDate and adds BaseChoice for configuring which models attributes support which relationship

* fix tests

* test upgrade behaviour

* Apply suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* move reldate.js include in correct file

* add OptionAttrsSelect to allow select options with their own attributes per value

* add a little bit of information to the tests for future reference

* rewrite reldate.js use data-attributes

* general cleanup

* add test for order.subevents cases

* use correct choice format

* remove order.subevent variants

* various cleanup

* Apply suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* remove empty docstrings

* add depreciation warning

* change event listener to pretix:bind-forms

---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
2026-08-12 15:37:29 +02:00
Raphael MichelandRichard Schreiber f25c233e91 Fix performance issues in download reminder (#6393)
* Fix performance issues in download reminder

* Update src/pretix/base/services/orders.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Fixes after review

* Fix check in loop

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-08-10 16:13:54 +02:00
Raphael Michel d08216d8c5 API: Allow to simulate check-ins (#6360)
* API: Allow to simulate check-ins

* Add missing file
2026-08-07 18:59:01 +02:00
Raphael Michel ea792e76b2 Device list: Show online status (#6455)
* Device list: Show online status

* Fixes post-review
2026-08-06 09:07:20 +02:00
Raphael Michel 8133061fe1 Devices: Store timestamp of last contact (#6453) 2026-08-05 10:57:13 +02:00
Raphael Michel 288ac50600 Merge branch 'html-injection-placeholder' into 'master'
Prevent HTML injection in email preview (Z#23241741)

See merge request pretix/pretix!47
2026-08-05 10:56:46 +02:00
Raphael Michel e7657a3dd3 Prevent HTML injection in email preview (Z#23241741) 2026-08-05 10:56:46 +02:00
pajowu 01d736361d Cart Manager: Round custom price to currency when adding (#6426) 2026-08-03 14:26:57 +02:00
Raphael Michel f3ffce4e5b Question form: Allow to unset required boolean questions (Z#23239887) (#6382)
Proper fix for #6366
2026-07-28 10:59:34 +02:00
Raphael Michel 47b632eabe RejectInvalidInputMiddleware: Ignore invalid charsets on body (#6314) 2026-07-28 09:07:16 +02:00
Raphael Michel 1ff9742a08 Customer export: Add memberships tab (Z#23228422) (#6253) 2026-07-28 09:06:45 +02:00
Kara Engelhardt 6d62284d87 Add global id field to order 2026-07-27 13:22:42 +02:00
Raphael Michel 92e7069a8e Improve performance of overpayment checks (Z#23241035) (#6410)
* Improve performance of overpayment checks

* Upgrade django-scopes
2026-07-24 13:42:33 +02:00
Raphael Michel 9fd570a53d Add cautionary comment about vobject bug 2026-07-22 14:49:53 +02:00
Raphael Michel 003bfb707d Fix scoping for OrderPosition.objects (follow-up to #4278) (#6407) 2026-07-22 14:10:34 +02:00
Richard Schreiber baf3cf04ec fix import and missing license-header 2026-07-21 18:39:07 +02:00
Kara Engelhardt fa2009ed03 Add central helper for ssrf address protection 2026-07-21 18:39:07 +02:00
luelista cc082e2001 Improve CSP handling in vite integration; refactor CSP handling into helper functions (Z#23240534) (#6387) 2026-07-21 13:20:31 +02:00
Raphael Michel d47c435489 LocaleMiddleware: Always render error pages in cookie or browser language (#6277) 2026-07-20 15:18:14 +02:00
Raphael Michel ea819530f9 Escape HTML arguments to translation strings (#6399) 2026-07-20 13:15:09 +02:00
Raphael Michel 09aef94376 Vouchers: Fix race condition that allows budget to be exceeded (#6396) 2026-07-20 13:14:49 +02:00
Kara Engelhardt 214ea5fcd3 Show end time in subevent list (Z#23237612) 2026-07-20 12:00:22 +02:00
Raphael Michel 2de032c2be Fix test failure on PostgreSQL 2026-07-17 19:22:50 +02:00
Raphael Michel 2574b31afd Fix unused import 2026-07-17 18:44:33 +02:00
5f2264daeb User email verifications: Add rate limiting (Z#23232834) (#6219)
* User email verifications: Add rate limiting (Z#23232834)

Also, refactor rate limiting into a central utility

* Make ip block work in dev

* Review notes

* Update src/pretix/base/forms/user.py

Co-authored-by: luelista <weller@rami.io>

* Apply suggestions from code review

Co-authored-by: luelista <mira@teamwiki.de>

* Add rate limit reset

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: luelista <mira@teamwiki.de>
2026-07-17 18:35:03 +02:00
Raphael Michel 49247062bc Drop second component from many time picker fields (#6150) 2026-07-17 17:42:51 +02:00
luelista 71488f0a02 Fix migration conflict (#6388) 2026-07-16 17:07:25 +02:00
luelistaandRaphael Michel 52a4381277 Enforce uniqueness of EventMetaProperty names in DB (Z#23231419) (#6106)
After enforcing this on application level in commit 4c37351, we can now also add
a unique constraint on DB level and a migration to fix any left over non-unique entries.

---------

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
2026-07-16 15:44:58 +02:00
luelista bf066909a7 Remove more usages of |safe (#6363)
* Replace |safe with |escapejson where appropriate
* Use JSON encoding for data-replace-with-qr
2026-07-16 13:14:37 +02:00
luelistaandKara Engelhardt 7cff4321e0 Order change: Fix crash if addon has hidden_if_item_available (Z#23236380) (#6357)
* Fix crash in rebooking if addon has hidden_if_item_available
* Move get_grouped_items into its own file and rename to prepare_item_list_for_shop
  (but keep a reference under original name for plugin compatibility)
* Make Item[Variation].unavailability_reason helper functions next to get_grouped_items
* Use current_unavailability_reason attribute instead of unavailability_reason()
* Add test case for:
  Order has product with addon 1; Addon 1 is hidden if Addon 2 is available; When order is changed, Addon 1 should not be removable
* Fix special case if addon product is now set to require a voucher (vouchers for addons are not supported)

---------

Co-authored-by: Kara Engelhardt <engelhardt@pretix.eu>
2026-07-16 12:52:08 +02:00
luelista fe5d095ae7 Prevent changing ticket secret of gift-card-issuing order positions (#6281) 2026-07-16 12:41:27 +02:00
Raphael Michel 2660dfe1bc CSP: Hotfix connect-src to allow static file access for PDF editor 2026-07-16 10:23:44 +02:00
Gerasimos Chourdakis 6901ed8b26 Event settings: Improve wording of help message for is_remote (#6386) 2026-07-15 17:46:15 +02:00
Raphael Michelandrobbi5 eb29101d09 Allow more decimal places for tax rates (#6092)
* Allow more decimal places for tax rates

* Fix normalization

* More tax rate handling

* Add uncommitted tests

* Rebase migration

* Update src/pretix/base/migrations/0304_tax_rate_decimals.py

Co-authored-by: robbi5 <richt@rami.io>

---------

Co-authored-by: robbi5 <richt@rami.io>
2026-07-15 16:20:45 +02:00
Raphael Michel 4a4cff3c41 Drop all csp_ignore statements from core (except stripe, for now) (#6337)
* Add proper CSP policy for HTML email preview

* Handle safe types centrally

* Precompile schema validation function to get rid of ajv2020

* Fix tests

* adjust more tests
2026-07-15 09:39:42 +02:00
Raphael Michel ffca102a8a Question form: Do not store invalid False values for required boolean questions (Z#23239887) (#6366) 2026-07-10 16:42:10 +02:00
pajowuandRaphael Michel 76e6803eac Fix customer views using wrong csrf middleware (#6027)
* Fix customer views using wrong csrf middleware

This lead to persistent csrf validation errors if the token from the cookie expired, which could only be solved by clearing cookies.

* Remove unneccesary csrf_protect decorators

* Fix typo

Co-authored-by: Raphael Michel <michel@pretix.eu>

---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
2026-07-10 13:25:40 +02:00
Raphael Michelandpajowu 15c194c0a3 Add base class for historical payment providers (#6336)
* Add base class for historical payment providers

* Update src/pretix/base/payment.py

Co-authored-by: pajowu <engelhardt@pretix.eu>

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
2026-07-10 11:10:32 +02:00