Commit Graph
12 Commits
Author SHA1 Message Date
df0b580dd6 Pluggable permissions (#5728)
* Data model draft

* Refactor query and assignment usages of old permissions

* Backend UI

* API serializer

* Big string replace

* Docs, tests and fixes for teams api

* Update docs for device auth

* Eliminate old names

* Make tests pass

* Use new permissions, remove inconsistencies

* Add test for translations

* Show plugin permissions

* Add permission for seating plans

* Fix plugin activation

* Fix failing test

* Refactor to permission groups

* Update doc/api/resources/devices.rst

Co-authored-by: luelista <weller@rami.io>

* Update doc/api/resources/events.rst

Co-authored-by: luelista <weller@rami.io>

* Update src/pretix/api/serializers/organizer.py

Co-authored-by: luelista <weller@rami.io>

* Fix typo

* Fix python version compat

* Replacement after rebase

* Add proper permission handling for exports

* Docs for exporters

* Runtime linting of permission names

* Fix typos

* Show export page even without orders permission

* More legacy compat

* Do not strongly validate before plugins are loaded

* Rebase migration

* Add permission for outgoing mails

* Review notes

* Update doc/api/resources/teams.rst

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

* Clean up logic around exporters

* Review and failures

* Fix migration leading to forbidden combination

* Handle permissions on event copying

* Remove print-statements

* Make test clearer

* Review feedback

* Add AnyPermissionOf

* migration safety

---------

Co-authored-by: luelista <weller@rami.io>
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
2026-03-17 14:43:56 +01:00
Raphael Michel aa9c478c30 [SECURITY] Prevent access to arbitrary cached files by UUID (CVE-2025-14881) 2025-12-19 12:59:21 +01:00
Raphael Michel 177a7d07fc Update license header (#5540) 2025-10-10 15:32:46 +02:00
Raphael MichelandMartin Gross b415393ccf Data shredder optimizations (#3429)
Co-authored-by: Martin Gross <gross@rami.io>
2023-06-23 16:56:19 +02:00
Raphael Michel dd10bdd433 Shredder: Fix redirect to broken page on error 2023-06-16 15:58:38 +02:00
Raphael Michel a93287207b pretix Community Edition moves to AGPLv3-based license (#2023) 2021-04-12 10:33:47 +02:00
Maico Timmerman b1cffe9f72 Shredder: Only force download for tax-relevant data (#1801) 2021-01-01 20:20:42 +01:00
Raphael Michel c60a25f2bc [SECURITY] Bind relevant cached file downloads to the current session 2020-12-22 10:47:47 +01:00
Raphael Michel af23d6e4bf Upgrade to Django 3.0 and other dependencies (#1568)
* Upgrade Django to 3.0 and other dependencies to recent versions

* Fix otp version contsraint

* Remove six dependency

* Resolve some warnings

* Fix failing tests

* Update django-countries

* Resolve all RemovedInDjango31Warnings in test suite

* Run isort

* Fix import

* Update PostgreSQL version on travis
2020-03-23 15:02:20 +01:00
Maico Timmerman 82feca6e38 Fix #1521 -- External authenticated users cannot delete events (#1523)
* Remove check password for event deletion, instead require recent login.

* Reauthenticate for backends using authentication_url.

* Require recent login for data shredder and prompt slug instead of password.

* Fix tests for recent login required on event delete and data shred.

* Pull request remarks for recent login required for event delete and data shred.

* Remove unused imported check_password.
2019-12-16 10:45:01 +01:00
Felix Rindt 8183648902 Rename module async to tasks (#994)
Fixes #993
2018-08-21 10:53:40 +02:00
Raphael Michel 7bccd62a4f Fix #678 -- Data shredders for personally identifiable information (#817)
* Add data shredders for PII

* First working shredder

* Add more shredders

* Add new shredders and download confirmation

* tmp

* PayPal, Stripe, banktransfer

* Add icon to logs

* Untested payment log shredders

* Add waiting list shredder

* First tests

* Add tests for shredders

* Improve templats, link to shredder

* Test payment info shredders

* More tests

* Documentation

* Fix enabled flag in payment provider overview

* Fix minor issues
2018-05-02 15:59:59 +02:00