Commit Graph
1295 Commits
Author SHA1 Message Date
Raphael Michel faa97026e1 Tests 2026-07-03 12:14:08 +02:00
Raphael Michel e1736e8d2a Mail setup: Add DKIM + DMARC validation 2026-07-03 11:57:00 +02:00
Raphael Michel 120317a8f2 Fix linter issue 2026-07-03 11:00:48 +02:00
Mira Weller 7a5f96369a Harden StaffSession handling 2026-07-03 10:41:39 +02:00
Raphael MichelandMira Weller 6eebaaa563 [SECURITY] Hardening for user impersonation feature (CVE-2026-13602)
---------

Co-authored-by: Mira Weller <weller@pretix.eu>
2026-07-01 15:15:43 +02:00
Raphael Michel 7e077bdd7e Subevent detail: Fix incorrect ticket count (Z#23238481) 2026-06-28 17:43:22 +02:00
Mira Weller f88c24863d [SECURITY] Fix XSS in ticket layout JSON (CVE-2026-57532) 2026-06-25 16:46:13 +02:00
luelista 1521c0cfcd Fix URL matching in EventQRCode (Z#23237781) (#6304) 2026-06-23 18:34:31 +02:00
Raphael Michelandpajowu d14dc4c5ff Test order deletion: Improve bulk performance (Z#23237160) (#6274)
* Test order deletion: Improve bulk performance (Z#23237160)

* Apply suggestion from @pajowu

Co-authored-by: pajowu <engelhardt@pretix.eu>

* Fix style issue

---------

Co-authored-by: pajowu <engelhardt@pretix.eu>
2026-06-22 09:49:27 +02:00
Raphael Michel 5db1a5b8af Rename confusingly named helpers for URL generation (#6280)
* Rename confusingly named helpers for URL generation

* new name

* fix old call

* Revert "new name"

This reverts commit a6e9a488b6.

* New name
2026-06-22 09:11:55 +02:00
luelista c4b9cc4143 Allow search by partial giftcard secret with organizer.giftcards:read (#6263) 2026-06-11 16:26:05 +02:00
luelista 63ebe16fd3 Fix count in order bulk delete success message (#6270) 2026-06-11 16:25:38 +02:00
775fdd1ccb Check-in API: Add reusable media exchange (#6115)
* Add Reusable Media Exchange to Checkin API

* isort

* Remove debugging leftover

* Apply suggestions from code review

Co-authored-by: robbi5 <maxi@richt.name>

* Add media_exchange_supported to CheckinRPCRedeemInputSerializer

* SecurityProfiles: Add api-v1:reusablemedia-lookup and -detail for SCAN

* Simplify media exchange checks

* Apply suggestions from code review

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Wording: re-usable --> reusable

* Deny checkins if media-exchange is required but device does not support it.

* Remove media_exchange_supported-Flag: Checkin will always be denied if media needs to be exchanged; apps will fall back to explanation text

* CheckinRPC: Also perform media exchange

* Use media_policy from item, not as a checkinrpc parameter

* my own review notes

* Fixes, cleanup, rebase

* block expired media

* Fix query

* add logging

* Refactor link_action into media policy, gift card support

* Block illegal policy-type combination

* Drop add_to_reusable_medium, decide all by policy

* Fix test failure

* fix test on postgres

* Expose reusable_media_usage_enforced to devies

* Explicitly set update view

---------

Co-authored-by: robbi5 <maxi@richt.name>
Co-authored-by: Maximilian Richt <richt@pretix.eu>
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
Co-authored-by: Raphael Michel <michel@rami.io>
Co-authored-by: Raphael Michel <michel@pretix.eu>
2026-06-11 16:25:13 +02:00
luelista edf97a13cd Don't show warning if inactive products are used in checkin-rules (Z#23236197) (#6242) 2026-06-09 12:48:03 +02:00
Raphael Michel 748054de56 Add read-only details page for subevents (#6151)
* Add read-only details page for subevents

* Document signal

* Review notes

* Fix incorrect subquery
2026-06-04 11:19:04 +02:00
721b179521 Add support for multiple linked_orderpositions on reusable media (#5666)
* change linked orderpositions to many-to-many

* Update media views to list ops

* return last op as fallback for linked_orderposition

* add multi-op to export

* update media-API

* fix media-view filter

* update control media forms

* fix API orders

* fix API orders matching media

* remove cached_property linked_orderposition - keep only in API

* fix media-issue signal

* adapt checkin API for multiple orderpositions

* remove unneeded comment

* fix create/update logging

* fix tests

* fix more tests

* fix code style

* add label to reusablemedium

* fix migration NOT NULL

* fix tests

* update docs

* clarify docs updating multiple linked_orderpositions

* clarify docs

* no need to prefetch linked_orderpositions

* improve readability

* select_related order instead prefetch

* add filter based on op.valid_from/until

* rename secret to claim_token

* Update docs for claim_token

* unifiy deprecated style

* Update reusablemedia.rst

* Update reusablemedia.rst

* Update reusablemedia.rst

* fix missing claim_token in serializer

* fix flake8

* add add_to_reusable_medium to order-serializer

* fix tests regarding claim_token

* fix flake8

* Clarify docs

* list ops comma-separated in export

* Add test for order-API add_to_reusable_medium

* fix linked_orderpositions filter in checkinrpc

* add test

* Add help-text

* fix multi-op media filter

* fix flake8

* improve check

* Fix sorting of reusable media type in overview

* Add copy and qr button to reusable medium detail view

* Rebase against origin/master

* Add logentrytype reusable_medium.linked_orderposition.removed

* add missing label_from_instance for SafeOrderPositionMultipleChoiceField

* add tests for create with linked_orderposition

* API add test for fallback-values in medium patch

* fix flake8

* Fix indentation

* fix migrations numbering

* fix test

* unify qutation marks

* fix flake8

* micro-improve linked_op-removal-logging

* simplify filter instead of annotate/get

* Do not translate API-errors

Co-authored-by: Raphael Michel <michel@pretix.eu>

* Fix typos in doc

Co-authored-by: Raphael Michel <mail@raphaelmichel.de>

* Update versionchanged in docs

Co-authored-by: Raphael Michel <michel@pretix.eu>

* Change log to always added not changed

* Add test for checkinrpc for ops out of timerang or canceled

* improve tests mixing ops from different organizers

* Fix logging of changed order_positions

* properly log added/removed when using UI

* refactor logging code

* unify logging adding/removing ops via API

* fix flake8

* remove unnecessary prefetch as already prefetched

* optimize fetching ops

* combine addon match and time-based validity match

* fix combined valid and product check

* re-number migrations

* Apply suggestion from @raphaelm

Co-authored-by: Raphael Michel <michel@pretix.eu>

* fix flake8

* New attempt at logic

* Improve op_candidate-selection for error message if no op matches check-in

* Fix typo

* fix valid_from start time being included

* use the datetime parameter for the comparison time so that the simulator works too

---------

Co-authored-by: Maximilian Richt <richt@pretix.eu>
Co-authored-by: Martin Gross <gross@rami.io>
Co-authored-by: Raphael Michel <michel@pretix.eu>
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
2026-06-03 09:12:24 +02:00
Phin Wolkwitz 6f1512f200 Fix #6232 - Remove pagination on categories and discounts (#6237) 2026-06-02 15:58:41 +02:00
Richard Schreiberandluelista d555b23275 Add _none-option to ModelChoiceField and filters for organizer and event-permission in event-typeahead (#6224)
* Add optional filters for organizer and event-permission on event-typeahead

* include _none option only if no search query given

Co-authored-by: luelista <weller@rami.io>

* allow _none in Select2, add ModelChoiceFieldWithNone

* fix flake8

---------

Co-authored-by: luelista <weller@rami.io>
2026-06-02 12:23:25 +02:00
Raphael Michel c7b82fdc97 Subevent update: Save SubEvent model before saving plugin forms (#6209) 2026-05-22 13:22:04 +02:00
pajowu da380ed75e Show invoice_dirty status on order details page (Z#23230731) (#6174) 2026-05-22 10:25:30 +02:00
Raphael MichelandRichard Schreiber 0aee73a9bd Quotas: Add bulk-edit, bulk-delete and filter form (#6080)
* Quotas: Add bulk-edit, bulk-delete and filter form

* Fix GroupConcat

* Apply suggestions from code review

Co-authored-by: Richard Schreiber <wiffbi@gmail.com>

* Review notes

* Fix handling of required fields

---------

Co-authored-by: Richard Schreiber <wiffbi@gmail.com>
2026-05-04 12:44:22 +02:00
luelista 27183a26ee Respect per-event plugin availability in OrganizerPluginEvents view (#5983)
* Allow plugins to declare their availability per event

* Fix message type

* small optimization of PluginsField serializer
2026-05-04 11:34:05 +02:00
Richard Schreiber 217744a9f2 Remove unused download of all tickets of an order in pretix-control (#6086)
* Remove unused code for ticket download of whole order in pretix-control

* fix flake8

* fix isort
2026-04-28 09:45:35 +02:00
Raphael Michel 1157e2aeed Events/subevents: Fix missing logging for meta changes (Z#23232443) (#6110)
* Events/subevents: Fix missing logging for meta changes (Z#23232443)

* Fix logging
2026-04-27 15:12:21 +02:00
Raphael Michel 496591bb3b Navigation: suggest event or organizer by domain (Z#23231404) (#6107) 2026-04-27 14:55:59 +02:00
88165c098e Subevents: Allow to skip conflicting dates in bulk-creation (Z#23217384) (#6079)
* Subevents: Allow to skip conflicting dates in bulk-creation

* Update src/pretix/control/templates/pretixcontrol/subevents/bulk.html

* Fix overlap calc for consecutive subevents

* Add test for skipping conflicting dates in bulk-creation

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
Co-authored-by: Richard Schreiber <schreiber@rami.io>
Co-authored-by: Kara Engelhardt <engelhardt@pretix.eu>
2026-04-27 14:52:49 +02:00
Raphael Michel a6a9eb6a6a Subevent selection: Order by date before name (Z#23231460) (#6111) 2026-04-27 12:23:17 +02:00
Richard Schreiberandluelista 5682d3ed56 Do not force PDFs to be downloaded (Z#23225892) (#5994)
* Display invoice and tickets inline in browser (Z#23225892)

* Use FileResponse filename for AnswerDownload

* Use inline for PDF-view in pretix-control editor

* use as_attachment for API FileResponses

* do not ignore csp even for disposition=inline

* use as_attachment for file responses in control

* remove unused code

* improve code style

* Invoice preview inline

* do not force download on tickets in backend

* do not force download on AnswerDownload

* imrpove code style

* improve code style

* fix missing int str conversion

* Apply suggestions from code review

Co-authored-by: luelista <mira@teamwiki.de>

---------

Co-authored-by: luelista <mira@teamwiki.de>
2026-04-14 09:12:09 +02:00
Kara Engelhardt fc7e8ea67a Log new properties when changing device 2026-04-07 13:28:38 +02:00
Raphael Michel ed1459b1dd Order change form: Allow to add multiple identical positions (Z#23227479) (#6044)
* Order change form: Allow to add multiple identical positions (Z#23227479)

* New implementation
2026-04-01 11:54:48 +02:00
luelista 88cd715ece Always show Organizers and Events menu entries for staff (#6011) 2026-03-24 11:26:54 +01:00
Raphael Michel e1b8e16a34 Permissions: Fix staff session handling for organizer exports (#6005) 2026-03-18 13:23:26 +01:00
df0b580dd6 Pluggable permissions (#5728)
* Data model draft

* Refactor query and assignment usages of old permissions

* Backend UI

* API serializer

* Big string replace

* Docs, tests and fixes for teams api

* Update docs for device auth

* Eliminate old names

* Make tests pass

* Use new permissions, remove inconsistencies

* Add test for translations

* Show plugin permissions

* Add permission for seating plans

* Fix plugin activation

* Fix failing test

* Refactor to permission groups

* Update doc/api/resources/devices.rst

Co-authored-by: luelista <weller@rami.io>

* Update doc/api/resources/events.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/api/serializers/organizer.py

Co-authored-by: luelista <weller@rami.io>

* Fix typo

* Fix python version compat

* Replacement after rebase

* Add proper permission handling for exports

* Docs for exporters

* Runtime linting of permission names

* Fix typos

* Show export page even without orders permission

* More legacy compat

* Do not strongly validate before plugins are loaded

* Rebase migration

* Add permission for outgoing mails

* Review notes

* Update doc/api/resources/teams.rst

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Clean up logic around exporters

* Review and failures

* Fix migration leading to forbidden combination

* Handle permissions on event copying

* Remove print-statements

* Make test clearer

* Review feedback

* Add AnyPermissionOf

* migration safety

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-03-17 14:43:56 +01:00
George HickmanandRaphael Michel dfaa4c3359 Add session_login function (#5955)
* Add session_login function

* Make helper do more things and use it

---------

Co-authored-by: Raphael Michel <michel@rami.io>
2026-03-16 17:39:04 +01:00
Raphael Michel 5a7e7fbde3 Event lists: Show sales channels (Z#23225483) (#5967) 2026-03-10 09:56:29 +01:00
Raphael Michel 4f449ce6b4 Mail: Handle all rendering in mail.py, return values for log (#5895)
* Mail: Handle all rendering in mail.py, return values for log

* Apply suggestions from code review
2026-03-10 09:53:09 +01:00
Raphael Michel 547910beec Voucher CSV download: Do not output "any product" (Z#23224795) (#5969) 2026-03-09 18:26:54 +01:00
Raphael Michel dc4556d428 PDF editor: add file size to label (Z#23226663) (#5965) 2026-03-09 18:10:57 +01:00
Kara Engelhardt f3fb1e66dc Fix waiting list availability calculation if WL vouchers have seats (Z#23226856) 2026-03-09 17:18:47 +02:00
Raphael Michel 876ddf1321 Add a log entry on manual VAT ID validation (Z#23223874) (#5939) 2026-02-27 15:22:50 +01:00
Richard Schreiber a25bca7471 Fix static instance name in emails (Z#23224360) (#5914) 2026-02-25 13:19:53 +01:00
Raphael Michel ab447bb85f Fix HTML injection in error message (Z#23225396) (#5921)
We're not treating it as a security issue as there is no vector to
inject the HTML into other people's browser, only one's own.
2026-02-24 12:48:43 +01:00
Lukas BockstallerandRichard Schreiber eab7d81a51 Waiting list: Add edit view for entry (Z#23215496) (#5712)
* add edit view for waitinglist entry

* add test and fix behaviour when name isn't asked for

* fix linting

* add testcases for new edit view

* fix test

* fix linting

* add search to the waitinglist view

* repair settings check

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* make name and phone field optional by removing them

* remove item and variation fields from form

rather set those values during clean

* change label from "Item and Variation" to "Product"

* include only products with an enabled waitinglist in the product field

* combine edit.html and transfer.html

* change transfer to edit

* add tests

* code style

* Update src/pretix/control/forms/waitinglist.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/forms/waitinglist.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/urls.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/templates/pretixcontrol/waitinglist/edit.html

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/templates/pretixcontrol/waitinglist/index.html

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/views/waitinglist.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/views/waitinglist.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Update src/pretix/control/views/waitinglist.py

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* remove validations

* remove validations

* replace widget

* implement small review items

* add better assertions

* add test for the different edit form variations

* add queryset to prefetch only active ItemVariations

* add queryset to prefetch only active ItemVariations

* propper use of WrappedPhoneNumberPrefixWidget

* cleanup

* add validation tests

* small review changes

* handle products with only inactive variations

* styling

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-02-23 16:35:24 +01:00
Raphael Michel 1463ee9227 Fix token message translation 2026-02-22 17:26:19 +01:00
Raphael Michel 3b49e77722 Login: Detect redirect loop and give users useful advice (#5911) 2026-02-22 16:59:14 +01:00
luelista 7e45837295 Security hardening for 2FA configuration (#5685)
* reduce default RecentAuthenticationRequiredMixin timeout to 15 min
* never cache pages with RecentAuthenticationRequiredMixin
* show emergency codes only once after generating
2026-02-19 12:43:23 +01:00
Lukas Bockstaller fd9ed15065 include acceptor slug in log/webhook event (#5906) 2026-02-19 10:00:11 +01:00
Lukas Bockstaller 99c257d392 adds webhooks for giftcards (Z#23205473) (#5834)
* adds giftcard webhook events

* maps issuer_id of giftcard to organizer_id for logging

* adds new giftcard logtypes for transactions that aren't manual

* log_action calls cleanup

* drop acceptance webhook

* add acceptor_id to the giftcard transaction webhook event

* add missing log_action statements

* add new webhooks to docs

* fix tests

* fix linting
2026-02-11 12:51:09 +01:00
Raphael Michel 9879e99c59 Outgoing mail: Decode unicode in From headers (#5864) 2026-02-03 18:12:12 +01:00
Raphael Michel 8c4e0bdb82 Outgoing mails: Fix cross-browser support 2026-01-30 11:37:10 +01:00