Commit Graph
1323 Commits
Author SHA1 Message Date
Raphael MichelandGitHub ed1459b1dd Order change form: Allow to add multiple identical positions (Z#23227479) (#6044)
* Order change form: Allow to add multiple identical positions (Z#23227479)

* New implementation
2026-04-01 11:54:48 +02:00
luelistaandGitHub 4c0c775baa Improve 2fa type selection UI (#6031) 2026-03-27 13:47:10 +01:00
Kara Engelhardtandpajowu e63bc09216 Use correct first page number in control pagination
This worked accidentally because page_obj.num_pages does not exists (page_obj.paginator.num_pages does) which made url_replace remove the page parameter
2026-03-19 13:19:10 +01:00
df0b580dd6 Pluggable permissions (#5728)
* Data model draft

* Refactor query and assignment usages of old permissions

* Backend UI

* API serializer

* Big string replace

* Docs, tests and fixes for teams api

* Update docs for device auth

* Eliminate old names

* Make tests pass

* Use new permissions, remove inconsistencies

* Add test for translations

* Show plugin permissions

* Add permission for seating plans

* Fix plugin activation

* Fix failing test

* Refactor to permission groups

* Update doc/api/resources/devices.rst

Co-authored-by: luelista <weller@rami.io>

* Update doc/api/resources/events.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/api/serializers/organizer.py

Co-authored-by: luelista <weller@rami.io>

* Fix typo

* Fix python version compat

* Replacement after rebase

* Add proper permission handling for exports

* Docs for exporters

* Runtime linting of permission names

* Fix typos

* Show export page even without orders permission

* More legacy compat

* Do not strongly validate before plugins are loaded

* Rebase migration

* Add permission for outgoing mails

* Review notes

* Update doc/api/resources/teams.rst

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Clean up logic around exporters

* Review and failures

* Fix migration leading to forbidden combination

* Handle permissions on event copying

* Remove print-statements

* Make test clearer

* Review feedback

* Add AnyPermissionOf

* migration safety

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-03-17 14:43:56 +01:00
Raphael MichelandGitHub bf80dc37c5 Navigation and dashboard: Hide useless items (#5995)
* Navigation and dashboard: Hide useless items

If a user has access to *no organizer teams*, hide a number of things
from navigation and dashboard. This happens e.g. if a user only has
permissions in scope of the pretix-resellers or pretix-scheduling
plugins.

* New mechanism
2026-03-17 10:26:22 +01:00
c39f1bfcc2 handle gift card payment via create order api endpoint (Z#23224691) (#5968)
* adds safeguard to prevent empty giftcard transactions on giftcards of value 0.00

* implement giftcard payment via order create

* styling

* let create_transactions() handle all the mailing

* docs

* provide more context for failed transactions

* documentation lectoring

* reject duplicate gift card secrets

* make payment_provider and use_gift_cards exclusive

* handle unknown gift cards

* Apply suggestion from @pajowu

Co-authored-by: pajowu <engelhardt@pretix.eu>

* Update src/pretix/control/templates/pretixcontrol/giftcards/payment.html

Co-authored-by: pajowu <engelhardt@pretix.eu>

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
2026-03-16 08:51:27 +01:00
Raphael MichelandGitHub 5a7e7fbde3 Event lists: Show sales channels (Z#23225483) (#5967) 2026-03-10 09:56:29 +01:00
Raphael MichelandGitHub 4f449ce6b4 Mail: Handle all rendering in mail.py, return values for log (#5895)
* Mail: Handle all rendering in mail.py, return values for log

* Apply suggestions from code review
2026-03-10 09:53:09 +01:00
Raphael MichelandGitHub dc4556d428 PDF editor: add file size to label (Z#23226663) (#5965) 2026-03-09 18:10:57 +01:00
Richard SchreiberandGitHub a25bca7471 Fix static instance name in emails (Z#23224360) (#5914) 2026-02-25 13:19:53 +01:00
eab7d81a51 Waiting list: Add edit view for entry (Z#23215496) (#5712)
* add edit view for waitinglist entry

* add test and fix behaviour when name isn't asked for

* fix linting

* add testcases for new edit view

* fix test

* fix linting

* add search to the waitinglist view

* repair settings check

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* make name and phone field optional by removing them

* remove item and variation fields from form

rather set those values during clean

* change label from "Item and Variation" to "Product"

* include only products with an enabled waitinglist in the product field

* combine edit.html and transfer.html

* change transfer to edit

* add tests

* code style

* Update src/pretix/control/forms/waitinglist.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/forms/waitinglist.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/urls.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/templates/pretixcontrol/waitinglist/edit.html

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/templates/pretixcontrol/waitinglist/index.html

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/views/waitinglist.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/views/waitinglist.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/views/waitinglist.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* remove validations

* remove validations

* replace widget

* implement small review items

* add better assertions

* add test for the different edit form variations

* add queryset to prefetch only active ItemVariations

* add queryset to prefetch only active ItemVariations

* propper use of WrappedPhoneNumberPrefixWidget

* cleanup

* add validation tests

* small review changes

* handle products with only inactive variations

* styling

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-02-23 16:35:24 +01:00
Raphael MichelandGitHub 3b49e77722 Login: Detect redirect loop and give users useful advice (#5911) 2026-02-22 16:59:14 +01:00
luelistaandGitHub 7e45837295 Security hardening for 2FA configuration (#5685)
* reduce default RecentAuthenticationRequiredMixin timeout to 15 min
* never cache pages with RecentAuthenticationRequiredMixin
* show emergency codes only once after generating
2026-02-19 12:43:23 +01:00
Raphael MichelandGitHub 47f409171d Customer accounts: Add security notices (#5705)
* Customer accounts: Add security notices

* Apply suggestions from code review
2026-02-10 17:55:53 +01:00
Raphael MichelandGitHub 9879e99c59 Outgoing mail: Decode unicode in From headers (#5864) 2026-02-03 18:12:12 +01:00
Raphael MichelandGitHub c40e34af57 Model-based mail queuing 2026-01-30 10:43:02 +01:00
Raphael MichelandGitHub 8058461f10 Invoices: Allow issuing invoices only to businesses (Z#23220397) (#5807)
* Invoices: Allow issuing invoices only to businesses

In situations where every invoice has a significant accounting cost and
consumers usually do not need invoices, this can save a lot of money or
effort.

* Improve backend UI if not qualified for invoice
2026-01-26 09:52:19 +01:00
Raphael MichelandGitHub c84bd4046d Invoice address: Make Peppol required in Belgium if available (Z#23220397) (#5808)
* Invoice address: Make Peppol required in Belgium if available (Z#23220397)

* Fix failing test, remove template bit that's now impossible
2026-01-26 09:52:06 +01:00
Raphael MichelandGitHub c3fd3a0838 Scheduled exports: Add copy button (Z#23221224) (#5823)
* Scheduled exports: Add copy button (Z#23221224)

* Update button label
2026-01-26 08:46:25 +01:00
0fc2d6134f Add option to restrict anonymous access to order URLs (#4735)
* Add option to restrict anonymous access to order URLs

By default, users who place orders while logged in can still access
their order URLs without authentication. This raises potential
security risks, particularly if order confirmation emails are
forwarded.

This commit introduces an organiser-level setting to disable anonymous
access for such orders. When enabled, unauthenticated attempts to access
URLs starting with `/order/`, which are intended for the customer, are
redirected to the login page. Upon successful authentication, the user
is redirected back to the original order URL.

It is important to note that this change does not impact routes intended
for attendees (e.g., `/ticket/*`), which remain accessible without
authentication.

* Change name of setting for future clarity

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Update message wording

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Eliminate database query

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Rename feature flag to fix breaking tests

* Refactor order access verification code into `OrderDetailsMixin`

* Add test for logged-in customer accessing another customer's order

* Refactor order access conditions to remove nesting

* Handle case where customer is not yet verified

* Add additional information to help message

* Fix multidomain issue

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Merge order/position variants into single tests

* Add docstring explaining return type of `order` property

* Apply suggestion from @raphaelm

* Fix indentation

---------

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
Co-authored-by: Raphael Michel <michel@rami.io>
2026-01-16 13:46:08 +01:00
luelistaandGitHub 9222ce0ecd datasync: Fix configuring value mappings on newly added property mappings (Z#23217990) (#5793) 2026-01-09 16:11:32 +01:00
2e89fc0a94 Questions: filter answers by dateFrame (Z#23216406) (#5706)
* replace manual form with QuestionFilterForm

* move form to form/item.py

* filter using a dateFrameField

* rename QuestionFilterForm to QuestionAnswerFilterForm

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* pass existing `opqs` into `filter_qs`

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* clean up filters

* fix view errors

* add labels

* display validation failures on field/label

* fix linting issues

* adjust datetime comparisons from lte to lt & gte to gt

* Change filter-form layout similar to order-filter-form

* improve label texts

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* use order constants

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* use Order Constants in Form where possible

* Change phrasing from Subevent to Date

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* include product variations in products filter

* repair time zone comparisons

* fix linting

* move filter form to form/filter.py

* remove references to timezone.utc

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* remove manual class statements

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* removes unnecessary check

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* fix datetime comparison

* Add full stop to error message to match style

* unify var-names and code-indent

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-12-15 12:46:06 +01:00
5a1bcae085 Invoice address: Improve VAT ID input (#5647)
* Remove unmaintained depdendency vat_moss

* VAT ID normalization: Auto-add country codes

* VAT ID: County-specific labels

* Invoice address: Allow to set VAT ID as required per country

* Fix failing tests

* Update src/pretix/base/settings.py

Co-authored-by: luelista <weller@rami.io>

* Review fixes

---------

Co-authored-by: luelista <weller@rami.io>
2025-12-03 16:48:19 +01:00
Richard SchreiberandGitHub 1a40215e91 Fix N+1 queries in API (#5684)
* Fix N+1 query in API quotas list

* fix membership N+1

* fix vouchers N+1 budget_used

* rename and reuse Voucher.annotate_budget_used_orders to budget_used

* fix flake8
2025-12-03 15:37:40 +01:00
0f82e1cae6 Update pretix logo to new version (#5651)
* Update pretix logo to new version

* Make favicon transparent

* Update src/pretix/static/pretixcontrol/scss/main.scss

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/static/pretixcontrol/scss/main.scss

Co-authored-by: Richard Schreiber <schreiber@rami.io>

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-11-27 16:05:30 +01:00
Raphael MichelandGitHub db7518735a Allow admins to inspect invoices (#5641)
This is helpful to debug invoice renderers or non-PDF invoices like
Peppol or other XML formats
2025-11-19 14:42:18 +01:00
eb740204d4 Invoice issuer address: Add state field (#5603)
* Invoice issuer address: Add state field

* Update src/pretix/base/settings.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/base/models/invoices.py

Co-authored-by: Richard Schreiber <schreiber@rami.io>

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-11-14 09:56:46 +01:00
Raphael MichelandGitHub 74b06435a0 Meta properties: Add helper to sort values (Z#23213668) (#5597) 2025-11-14 09:49:40 +01:00
luelistaandGitHub 1cb2d443f9 Validation of user email addresses (#5434)
* Validation of user email addresses
* Improve email and password change forms
2025-11-07 11:17:34 +01:00
fd9d03786b Add program times for items (Z#23178639)
* Add program times for items

* Fix frontend date validation

* Add ical data for program times [wip]

* Improve ical data for program times

* Remove duplicate code and add comments

* Adjust migration

* Remove program times form for event series

* Add pdf placeholder [wip]

* Improve explanation text with suggestion

Co-authored-by: Raphael Michel <michel@pretix.eu>

* Fix import sorting

* Improve ical generation

* Improve ical entry description

* Fix migration

* Add copyability for program times fot items and events

* Update migration

* Add API endpoints/functions, fix isort

* Improve variable name

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Remove todo comment

* Add documentation, Change endpoint name

* Change related name

* Remove unnecessary code block

* Add program times to item API

* Fix imports

* Add log text

* Use daterange helper

* Add and update API tests

* Add another API test

* Add program times to cloning tests

* Update query count because of program times query

* Invalidate cached tickets on program time changes

* Reduce invalidation calls

* Update migration after rebase

* Apply improvements to invalidation from review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* remove unneccessary attr=item param

* remove unnecessary kwargs for formset_factory

* fix local var name being overwritten in for-loop

* fix empty formset being saved

* Use subevent if available

* make code less verbose

* remove double event-label in ical desc

* fix unnecessary var re-assign

* fix ev vs p.subevent

---------

Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-11-06 12:24:47 +01:00
Raphael MichelandGitHub b02e1a1515 Gift card payment: Clean-up some code (#5574)
* Remove apparently unused code

* Move templates that do not belong in pretixcontrol
2025-11-03 17:38:56 +01:00
Raphael Michel 41780add40 Gift cards: Remove nested form tags 2025-10-30 18:03:47 +01:00
Raphael Michel b07a61e4f1 Remove visible rounding mode 2025-10-30 17:54:06 +01:00
3e972eddbf Allow to round taxes on order-level (#5019)
* Allow to round taxes on order-level

* Rename get_cart_total

* Persist rounding mode with order

* Add general docs

* Order creation API

* Update fee algorithm

* Rounding on payment method change

* Round when splitting order

* Fix failing tests

* Add settings page

* Add tests

* Replace algorithm

* Add test case for currency rounding

* Improve order change

* Update flowchart

* Update discount logic (more hypothetical, we don't store rounding on cart positions atm)

* Rename internal method

* Fix typo

* Update help text

* Apply suggestions from code review

Co-authored-by: luelista <weller@rami.io>

* Order rounding refactor (#5571)

* Add RoundingCorrectionMixin providing before-rounding-values as properties

* Use gross_price_before_rounding in more places

* Update doc/development/algorithms/pricing.rst

Co-authored-by: Martin Gross <gross@rami.io>

* Allow to override on perform_order

* Rebase migration

* Fix event cancellation

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Martin Gross <gross@rami.io>
2025-10-30 11:49:31 +01:00
1e0ede529c Event cancellation: Add safety and security checks (#5565)
* Event cancellation: Add safety and security checks

When cancelling an event, a large sum of money might be refunded
instantly. This PR adds safety features around this by

- doing a dry-run first that shows a preview of the expected refund sum

- sending a confirmation mode via email for any automatic refunds of more than 100 currency units

- keeping a more detailed log of the settings this was executed with

* Update src/pretix/control/views/orders.py

Co-authored-by: luelista <weller@rami.io>

---------

Co-authored-by: luelista <weller@rami.io>
2025-10-29 08:53:48 +01:00
Phin WolkwitzandGitHub 8a3da37b45 Connect giftcards with customer accounts (#5126)
Connect giftcards with customer accounts, show giftcards during checkout and in account , show giftcard list in backend customer view
2025-10-16 13:20:00 +02:00
Raphael MichelandGitHub ebfcb6f7c8 Improve interface to create and edit subevents (Z#23207890) (#5519)
* Use select2 item input in newly added quotas

* Make submit row sticky on really long forms

* Only show product settings that match quotas
2025-10-15 09:13:05 +02:00
Raphael MichelandRaphael Michel 9d2ef94389 Invoicing: Configurable service date 2025-09-29 13:15:42 +02:00
Richard SchreiberandGitHub 34dbbdd82f PDF-Editor: fix missing maxlength for layout name (#5473) 2025-09-24 09:58:02 +02:00
Raphael MichelandGitHub baab35b81f Items: Allow plugins to put forms above a formset (#5460) 2025-09-15 18:11:18 +02:00
luelistaandGitHub 49c0f6b967 Organizer plugins: Do not show plugins as active if they are inactive on org-level (#5396) 2025-08-22 09:31:01 +02:00
Raphael MichelandGitHub fe9a7eaa24 Order overview: Try to make linked filters behave as expected for line-level cancellations (Z#23203500) 2025-08-22 09:30:34 +02:00
Raphael Michel c200072471 Improve string quality and consistency 2025-08-19 18:35:35 +02:00
Raphael Michel cbee131378 Fix typos 2025-08-19 18:01:46 +02:00
05c74b7ad6 Pluggable invoice transmission methods (#5020)
* Flexible invoice transmission

* UI work

* Add peppol and output

* API support

* Profile integration

* Simplify form for individuals

* Remove sent_to_customer usage

* more steps

* Revert "Bank transfer: Allow to send the invoice direclty to the accounting department (#2975)"

This reverts commit cea6c340be.

* minor fixes

* Fixes after rebase

* update stati

* Backend view

* Transmit and show status

* status, retransmission

* API retransmission

* More fields

* API docs

* Plugin docs

* Update migration

* Add missing license headers

* Remove dead code, fix current tests

* Run isort

* Update regex

* Rebase migration

* Fix migration

* Add tests, fix bugs

* Rebase migration

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @luelista

Co-authored-by: luelista <weller@rami.io>

* Make migration reversible

* Add TransmissionType.enforce_transmission

* Fix registries API usage after rebase

* Remove code I forgot to delete

* Update transmission status display depending on type

* Add testmode_supported

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/static/pretixbase/js/addressform.js

Co-authored-by: luelista <weller@rami.io>

* New mechanism for non-required invoice forms

* Update src/pretix/base/invoicing/transmission.py

Co-authored-by: luelista <weller@rami.io>

* Declare testmode_supported for email

* Make transmission_email_other an implementation detail

* Fix failing tests and add new ones

* Update src/pretix/base/services/invoices.py

Co-authored-by: luelista <weller@rami.io>

* Add emails to email history

* Fix comma error

* More generic default email text

* Cleanup

* Remove "email invoices" button and refine logic

* Rebase migration

* Fix edge case

---------

Co-authored-by: luelista <weller@rami.io>
2025-08-19 17:59:45 +02:00
a51a6123f5 Organizer-level plugins (#5305)
* Add version notes to the docs

* Adapt signal handling

* Add UI

* Add API

* API and tests

* Fix registry

* Update doc/development/api/plugins.rst

Co-authored-by: Felix Rindt <felix@rindt.me>

* Fix failing tests

* Apply suggestions from code review

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugin_events.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugins.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/templates/pretixcontrol/organizers/plugins.html

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/navigation.py

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/control/urls.py

Co-authored-by: luelista <weller@rami.io>

* Apply suggestion from @wiffbi

* REbase migration

* Fix review note

* Fix test cases

* Remove plugin from all events if disabled on org level

* Update doc/development/api/plugins.rst

* Unify registries

* Rebase migration

---------

Co-authored-by: Felix Rindt <felix@rindt.me>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: luelista <weller@rami.io>
2025-08-19 11:33:34 +02:00
d5bccf8726 Queueing and mapping utilities for outbound data sync (#4881)
Add a registry for datasync providers and an associated sync queue, to be used by 
plugins that transfer data from pretix orders to external systems. 
Additionally, provide a generic data mapping interface to be used in settings pages 
of such plugins, to let users configure which information from pretix to fill into
which data fields of the external system.

---------

Co-authored-by: Raphael Michel <michel@rami.io>
2025-08-06 14:34:04 +02:00
9a119c35a8 Add a system-wide style for admin-only things (#5311)
* Add a system-wide style for admin-only things

* change stripe-color to a red-ish tone

* add stripes to button end-admin-session

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-08-04 16:18:29 +02:00
423f0cbb90 Add button to reset entire check-in stack (Z#23188730) (#5312)
* Show print logs to admins

* Add button to reset entire check-in stack (Z#23188730)

* isort

* Update src/pretix/control/templates/pretixcontrol/checkin/reset.html

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/templates/pretixcontrol/checkin/reset.html

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/templates/pretixcontrol/checkin/reset.html

Co-authored-by: Richard Schreiber <schreiber@rami.io>

* Update src/pretix/control/templates/pretixcontrol/checkin/lists.html

Co-authored-by: Richard Schreiber <schreiber@rami.io>

---------

Co-authored-by: Richard Schreiber <schreiber@rami.io>
2025-07-18 10:02:18 +02:00
Richard SchreiberandGitHub 14d6013292 FormFields: remove placeholders duplicating labels (#5135) 2025-07-10 16:06:36 +02:00