* Improve SSO one-time token error message
Replace the generic 'invalid one-time token' message shown after failed
SSO login attempts with a clearer, user-facing explanation of what went
wrong and how to recover.
* Remove unneeded classes from headings
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* Apply suggestions from code review
Added `trimmed` to translation blocks
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* Reword SSO error template for improved translation clarity
---------
Co-authored-by: Raphael Michel <mail@raphaelmichel.de>
* Add Docker secrets support in config
* ruff format
* Remove gracefully fallback exception handling
* Add support for loading secret fallbacks from environment file
* Fix EPC QR beneficiary escaping
* Fix EPC QR script encoding
Keep EPC QR helper output as a plain string and serialize payment QR payloads as JSON script data before the QR replacement JavaScript parses them. This preserves apostrophes without relying on mark_safe in the helper.
Assisted-by: OpenAI GPT-5 <noreply@openai.com>
* "type safety"
---------
Co-authored-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com>
Co-authored-by: Raphael Michel <michel@rami.io>
* use cookieretry only on presale event pages
* use csrfcookieretry only on event index page
* include static tag
* include csrfcookieretry in order.html as well
* Update src/pretix/static/pretixpresale/js/csrfcookieretry.js
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
---------
Co-authored-by: Richard Schreiber <schreiber@pretix.eu>
We initially didn't do this for two reasons:
- Performance implications of calling the settings store for every event
that shows up in the calendar. As of d43e85da, we need that anyways.
- Performance implications of filtering in Python except SQL but... it
can't really be worse than not filtering at all.
- We don't easily know if it's valid for all events so we can't stop
rendering the unused calendar rows. That's an acceptable issue for
now, still better than nothing. We can always optimize later.
So we might as well implement it.
Knowing what file a string comes from is useful, but the line number is less
useful and changes a lot, causing very unreadable diffs of translation
files. I propose we drop them and only include the file names
- Add central framebreaker page via safelink helper
- Update paypal, paypal2 and stripe plugins to use central framebreaker
- Add CSP header to cookies.html
---------
Co-authored-by: Mira Weller <weller@pretix.eu>
* Check for duplicate codes in import
* Check for existing codes instead of failing on db-level
* as we do not lock, catch IntegrityErrors due to race-conditions on import
* fix flake8
* Fix handling country=None in AttendeeProfile describe
* Update checkoutflow.py
* fix more occurences
* handle country=None in InvoiceAddress even if it is not allowed
* SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (Z#23236468)
* SMTP SSRF protection: Edge case handling for CGNAT and v4/v6 mapping (#6264)
---------
Co-authored-by: pajowu <engelhardt@pretix.eu>
