* Allow to set payment term per sales channel
* Apply suggestion from @luelista
Co-authored-by: luelista <weller@rami.io>
---------
Co-authored-by: luelista <weller@rami.io>
* Fix sendmail/scheduled-mails placeholders
* Add event_or_subevent to context
* Add placeholders to tests
* fix and improve test
* Revert "fix and improve test"
This reverts commit 874a11e982.
* undo placeholder-tests
* add test
* move payment into pending on PENDING_REVIEW webhook
* mark approved payment as pending
* extend BasePaymentProvider to gate aborting pending payments on a payment per payment basis
* add timeout to paypal after which a pending payment can be canceled
* formatting
* add missing negation
* cleanup abort_pending_allowed methods
* Apply suggestions from code review
Co-authored-by: pajowu <pajowu@pajowu.de>
* check all capture elements
* rename method and change defaults
* remove left over Constant
* flake8 .
---------
Co-authored-by: pajowu <pajowu@pajowu.de>
* initial implementation
* factor out _resolve_base_date
* add js to prevent illegal inputs
* fix tests
* Update src/pretix/base/reldate.py
Co-authored-by: Raphael Michel <michel@pretix.eu>
* Apply suggestions from code review
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* move js includes of to fragment_js.html
* add type annotations
* moves logic from RelativeDateWrapper into RelativeDate and adds BaseChoice for configuring which models attributes support which relationship
* fix tests
* test upgrade behaviour
* Apply suggestions from code review
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* move reldate.js include in correct file
* add OptionAttrsSelect to allow select options with their own attributes per value
* add a little bit of information to the tests for future reference
* rewrite reldate.js use data-attributes
* general cleanup
* add test for order.subevents cases
* use correct choice format
* remove order.subevent variants
* various cleanup
* Apply suggestions from code review
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* remove empty docstrings
* add depreciation warning
* change event listener to pretix:bind-forms
---------
Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* store the state of the payment regardless of the state
control.html shows the banner that the payment is in review depending on payment.info
* handle capture ressource
* Update src/pretix/plugins/paypal2/views.py
Co-authored-by: Phin Wolkwitz <wolkwitz@pretix.eu>
* add test
* cleanup logic regarding uninteresting resource_type
* store payment.info during _execute_payment asap
---------
Co-authored-by: Phin Wolkwitz <wolkwitz@pretix.eu>
* Fix crash in rebooking if addon has hidden_if_item_available
* Move get_grouped_items into its own file and rename to prepare_item_list_for_shop
(but keep a reference under original name for plugin compatibility)
* Make Item[Variation].unavailability_reason helper functions next to get_grouped_items
* Use current_unavailability_reason attribute instead of unavailability_reason()
* Add test case for:
Order has product with addon 1; Addon 1 is hidden if Addon 2 is available; When order is changed, Addon 1 should not be removable
* Fix special case if addon product is now set to require a voucher (vouchers for addons are not supported)
---------
Co-authored-by: Kara Engelhardt <engelhardt@pretix.eu>
* Add proper CSP policy for HTML email preview
* Handle safe types centrally
* Precompile schema validation function to get rid of ajv2020
* Fix tests
* adjust more tests
During our [2026-06-27 incident](https://pretix.eu/about/en/blog/20260630-pretix-hosted-outage/),
we noticed that pretix is using redis at import time. This means that
gunicorn and celery process were unable to start on servers who could
currently not reach redis. This is kinda mitigated through auto-restart
on systemd or docker level, but that's not really how it is supposed to
work. Celery even has smart retry/reconnect logic that becomes pointless
this way.
* Improve subject lines for admin-facing emails
A few of the current subjects are ambiguous about the expected
action, and some omit context that would help in an inbox preview
(which event, which address). The rewrites bring them closer to
common conventions in modern transactional email (verb-led,
recipient-addressed, with recipient-meaningful variables). Two
themes:
- Action-required emails lead with the action verb. "Reset your
password", "Confirm event cancellation and bulk refund", and
"Confirm <address> as a sender address" tell the recipient up
front what's expected, where "Password recovery", "Bulk-refund
confirmation" and "Sender address verification" did not.
- Surface the relevant variable when the email is about something
specific. "Data shredding completed for <event>" is more useful
than the generic version when an admin manages several events.
"You've been invited to join <organizer>" names the inviting
organizer. "Confirm <address> as a sender address" names the
address.
The remaining rewrites are lighter rewordings. "New sign-in to
your account" replaces "Login from new source detected" because
"source" is jargon a non-technical recipient wouldn't recognise.
"Changes to your account" replaces "Account information changed"
because the possessive frames the email as being about the
recipient's own account.
Also fixes a hardcoded "pretix" in the confirmation-code subject.
* Standardise admin email sign-offs as "Thanks, The <instance> Team"
The current sign-offs ("Best regards, Your <instance> team") have
a formal tone. A review of the last ~20 transactional emails in
my inbox showed most senders use something friendlier:
- Thanks: Deliveroo, Starling Bank, GitHub, Cloudflare
- Thank you: AWS
- Sincerely: Google Workspace
A small minority (e.g., Sentry) had no sign-off at all. "Thanks"
was the most common, and among that group "The <instance> Team"
was the consistent phrasing rather than "Your <instance> team".
Two templates (cancel_confirm, export_failed) didn't have a
sign-off; they now get one for consistency. Notification emails
are deliberately excluded: they're system alerts rather than
direct correspondence.
* Add anti-phishing notice to admin emails containing confirmation codes
Three admin emails send the recipient a confirmation code to
enter back into a form: confirmation_code, email_setup, and
cancel_confirm. Only confirmation_code had an anti-phishing
warning, and its wording was awkward ("Please do never give this
code to another person. Our support team will never ask for this
code.").
This commit standardises the warning across all three:
> Don't share this code with anyone. The <instance> team will
> never ask you for it.
* Add structured details to login-notice email
The single-sentence body ("The login was performed using <agent>
on <os> from <country>.") is replaced with a labelled bullet list:
Time, Browser, Operating system, Device, Country.
Time and Device are new fields. Device is omitted when ua-parser
can't identify the device, Country when GeoIP isn't available,
so the user only sees fields with real values.
* Restructure notification.txt for clearer layout
- Attributes: bullet list instead of paragraph-per-attribute.
- Actions: label gets a colon, URL on its own paragraph (was
4-space-indented code block).
- Footer: separated by --- and bulleted (manage / disable
links). "Click here X" phrasing dropped (incidentally moots
a missing-"to" typo).
- Minor whitespace fix: detail-block endif now matches the
placement of the rest of the template.
notification.html's footer text is also updated, only to match
the new .txt wording (link labels and intro line). No
structural changes to the HTML template.
* Improve confirmation-code email reason strings
- Drop the redundant "to confirm" opener.
- Replace hardcoded "your pretix account" in email_verify
with "{instance}".
* Polish admin email body copy
A small wording and formatting pass on the admin email bodies,
in three loosely-grouped themes:
1. Sentence case for body text (previously lowercase after
"Hello,"), matching standard English convention.
2. Light restructuring where helpful: bullet lists for sets
of labelled facts; 4-space-indented code blocks for codes
the recipient is meant to type back.
3. Phrasing polish. Some sentences tightened or shortened.
Largely matters of taste, but generally read smoother.
---------
Co-authored-by: Raphael Michel <michel@pretix.eu>
* Fix EPC QR beneficiary escaping
* Fix EPC QR script encoding
Keep EPC QR helper output as a plain string and serialize payment QR payloads as JSON script data before the QR replacement JavaScript parses them. This preserves apostrophes without relying on mark_safe in the helper.
Assisted-by: OpenAI GPT-5 <noreply@openai.com>
* "type safety"
---------
Co-authored-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com>
Co-authored-by: Raphael Michel <michel@rami.io>
Lukas Bockstaller