* Do not hide subevent list if filtered list is empty
* Event calendar: Allow to show a message if no events are found
* Apply suggestion from @luelista
Co-authored-by: luelista <weller@rami.io>
* Fix failures on org level
* add aria-hidden if no subevents
* Update src/pretix/base/settings.py
* Update src/pretix/base/settings.py
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
---------
Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
* Allow to set payment term per sales channel
* Apply suggestion from @luelista
Co-authored-by: luelista <weller@rami.io>
---------
Co-authored-by: luelista <weller@rami.io>
* New CheckoutSession model, created and deleted throught cart lifetime but only used for order-level question answers so far
* Order-level QuestionAnswers (relations to CheckoutSession / Order)
* New container_type field on Question model to specify whether Question belongs to order or orderposition
* Order-level questions are currently experimental, UI is hidden behind feature flag
---------
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
* initial implementation
* factor out _resolve_base_date
* add js to prevent illegal inputs
* fix tests
* Update src/pretix/base/reldate.py
Co-authored-by: Raphael Michel <michel@pretix.eu>
* Apply suggestions from code review
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* move js includes of to fragment_js.html
* add type annotations
* moves logic from RelativeDateWrapper into RelativeDate and adds BaseChoice for configuring which models attributes support which relationship
* fix tests
* test upgrade behaviour
* Apply suggestions from code review
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* move reldate.js include in correct file
* add OptionAttrsSelect to allow select options with their own attributes per value
* add a little bit of information to the tests for future reference
* rewrite reldate.js use data-attributes
* general cleanup
* add test for order.subevents cases
* use correct choice format
* remove order.subevent variants
* various cleanup
* Apply suggestions from code review
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* remove empty docstrings
* add depreciation warning
* change event listener to pretix:bind-forms
---------
Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* rders: Fix N+1 query issues on order detail and change page
There is one I couldn't fix: Loading the list of tax rules for every
select box on the OrderChange page. Unfortunately, Django has a
cache-breaking .all() in ModelChoiceField and that would need nasty
patching that didn't feel worth it
* Fix isort
* Fix N+1 query in gate call
* Fix leftovers
* Add local cache for objects referenced in log entries
* Update src/pretix/control/views/orders.py
* Event-dashboard: Lazy-load warnings
I don't like this, it's not pretty, but we have no quick way of fixing
the overpaid orders check otherwise and a slow query on the event
dashboard feels really bad, because even if you don't wanna see the
dashboard ou are always going through it in navigation and that can get
very annoying very quickly.
* Update src/pretix/control/templates/pretixcontrol/event/dashboard_partial_warnings.html
Co-authored-by: pajowu <engelhardt@pretix.eu>
---------
Co-authored-by: pajowu <engelhardt@pretix.eu>
This changes the API of pretix.control.signals.event_dashboard_widgets and
pretix.control.signals.user_dashboard_widgets, such that the "content" key of
returned dictionaries must contain a SafeString if HTML therein is to be
rendered.
* Add proper CSP policy for HTML email preview
* Handle safe types centrally
* Precompile schema validation function to get rid of ajv2020
* Fix tests
* adjust more tests
As a security precaution, we change the contract of some signals such that a
SafeString needs to be returned if HTML should be rendered without further
escaping.
Before, the `{% signal ... %}` and `{% eventsignal ... %}` template tags
called mark_safe themselves on all strings returned from signals. That could
lead to unsafe coding practices, where untrusted values are interpolated into
HTML format strings. However, such interpolations should usually be performed
using helpers such Django's format_html, which automatically escapes inputs
and returns a SafeString.
Now, we call conditional_escape on signal results, so that any HTML not explicitly
marked as safe gets escaped.
Most plugins are not affected by this change as they return a SafeString as a
result of Template.render already.
During our [2026-06-27 incident](https://pretix.eu/about/en/blog/20260630-pretix-hosted-outage/),
we noticed that pretix is using redis at import time. This means that
gunicorn and celery process were unable to start on servers who could
currently not reach redis. This is kinda mitigated through auto-restart
on systemd or docker level, but that's not really how it is supposed to
work. Celery even has smart retry/reconnect logic that becomes pointless
this way.
Kara Engelhardt