LocaleMiddleware: Always render error pages in cookie or browser language

src/pretix/base/middleware.py

@@ -65,11 +65,44 @@ def get_supported_language(requested_language, allowed_languages, default_langua
     return language
 
 
-class LocaleMiddleware(MiddlewareMixin):
-
+class BaseLocaleMiddleware(MiddlewareMixin):
     """
-    This middleware sets the correct locale and timezone
-    for a request.
+    This is a reduced LocaleMiddleware that uses only information contained in the WSGI request data
+    to figure out the language (cookie and browser settings). We need it to have a consistent language
+    for error pages that are generated from the middleware stack before we know e.g. which user is logged
+    in or which event is selected.
+    """
+
+    def process_request(self, request: HttpRequest):
+        language = get_language_from_early_request(request)
+        translation.activate(language)
+        set_region(None)
+        request.LANGUAGE_CODE = language
+        timezone.deactivate()
+
+    def process_response(self, request: HttpRequest, response: HttpResponse):
+        language = translation.get_language()
+        patch_vary_headers(response, ('Accept-Language',))
+        if 'Content-Language' not in response:
+            response['Content-Language'] = language
+        return response
+
+
+class LocaleMiddleware(MiddlewareMixin):
+    """
+    This is the full LocaleMiddleware that uses all available information to figure out the correct
+    language for the request using all available sources, in this order of priority:
+
+    - Backend: User settings
+    - Language cookie
+    - Frontend: Customer account settings
+    - Browser settings
+    - Frontend: Event/Organizer settings
+    - System default
+
+    It needs to run late in the middleware stack to have all information available for these steps.
+    For some cases, it is even ran a second time since the event is sometimes only figured out after the
+    middleware stack (can happen for plugin views).
     """
 
     def process_request(self, request: HttpRequest):
@@ -182,6 +215,24 @@ def get_default_language():
         return settings.LANGUAGE_CODE
 
 
+def get_language_from_early_request(request: HttpRequest) -> str:
+    """
+    Analyzes the request to find what language the user wants the system to
+    show using only WSGI-available information. Only languages listed in
+    settings.LANGUAGES are taken into account. If the user requests a sublanguage
+    where we have a main language, we send out the main language.
+    """
+    global _supported
+    if _supported is None:
+        _supported = OrderedDict(settings.LANGUAGES)
+
+    return (
+        get_language_from_cookie(request)
+        or get_language_from_browser(request)
+        or get_default_language()
+    )
+
+
 def get_language_from_request(request: HttpRequest) -> str:
     """
     Analyzes the request to find what language the user wants the system to
@@ -196,7 +247,6 @@ def get_language_from_request(request: HttpRequest) -> str:
     if request.path.startswith(get_script_prefix() + 'control'):
         return (
             get_language_from_user_settings(request)
-            or get_language_from_customer_settings(request)
             or get_language_from_cookie(request)
             or get_language_from_browser(request)
             or get_language_from_event(request)

src/pretix/base/models/orders.py

@@ -354,59 +354,38 @@ class Order(LockModel, LoggedModel):
     def _transaction_key_reset(self):
         self.__initial_status_paid_or_pending = self.status in (Order.STATUS_PENDING, Order.STATUS_PAID) and not self.require_approval
 
-    @classmethod
-    def gracefully_delete_bulk(cls, event, orders, user=None, auth=None):
-        # Expects to be called in a transaction
-        from . import (
-            GiftCard, GiftCardTransaction, LogEntry, Membership, Voucher,
-        )
-
-        if not transaction.get_connection().in_atomic_block:
-            raise Exception('gracefully_delete_bulk should only be called in atomic transaction!')
-
-        logs_create = []
-        for o in orders:
-            if not o.testmode:
-                raise TypeError("Only test mode orders can be deleted.")
-            order_gracefully_delete.send(event, order=o)
-            logs_create.append(o.log_action(
-                'pretix.event.order.deleted', user=user, auth=auth,
-                data={
-                    'code': o.code,
-                },
-                save=False,
-            ))
-        LogEntry.bulk_create_and_postprocess(logs_create)
-
-        vouchers = OrderPosition.objects.filter(
-            order__in=orders,
-            voucher__isnull=False
-        ).exclude(order__status=Order.STATUS_CANCELED).values_list("voucher_id", flat=True)
-        for v_id in vouchers:
-            Voucher.objects.filter(pk=v_id).update(redeemed=Greatest(0, F('redeemed') - 1))
-
-        GiftCardTransaction.objects.filter(payment__order__in=orders).update(payment=None)
-        GiftCardTransaction.objects.filter(refund__order__in=orders).update(refund=None)
-        GiftCardTransaction.objects.filter(order__in=orders).update(order=None)
-        GiftCard.objects.filter(issued_in__order__in=orders).update(issued_in=None)
-        Membership.objects.filter(granted_in__order__in=orders, testmode=True).update(granted_in=None)
-        OrderPosition.all.filter(order__in=orders, addon_to__isnull=False).delete()
-        OrderPosition.all.filter(order__in=orders).delete()
-        OrderFee.all.filter(order__in=orders).delete()
-        Transaction.objects.filter(order__in=orders).delete()
-        OrderRefund.objects.filter(order__in=orders).delete()
-        OrderPayment.objects.filter(order__in=orders).delete()
-        if isinstance(orders, models.QuerySet):
-            orders.delete()
-        else:
-            Order.objects.filter(pk__in=[o.pk for o in orders]).delete()
-        event.cache.delete('complain_testmode_orders')
-
     def gracefully_delete(self, user=None, auth=None):
+        from . import GiftCard, GiftCardTransaction, Membership, Voucher
+
         if not self.testmode:
             raise TypeError("Only test mode orders can be deleted.")
+        self.log_action(
+            'pretix.event.order.deleted', user=user, auth=auth,
+            data={
+                'code': self.code,
+            }
+        )
 
-        Order.gracefully_delete_bulk(self.event, Order.objects.filter(pk=self.pk), user, auth)
+        order_gracefully_delete.send(self.event, order=self)
+
+        if self.status != Order.STATUS_CANCELED:
+            for position in self.positions.all():
+                if position.voucher:
+                    Voucher.objects.filter(pk=position.voucher.pk).update(redeemed=Greatest(0, F('redeemed') - 1))
+
+        GiftCardTransaction.objects.filter(payment__in=self.payments.all()).update(payment=None)
+        GiftCardTransaction.objects.filter(refund__in=self.refunds.all()).update(refund=None)
+        GiftCardTransaction.objects.filter(order=self).update(order=None)
+        GiftCard.objects.filter(issued_in__in=self.positions.all()).update(issued_in=None)
+        Membership.objects.filter(granted_in__order=self, testmode=True).update(granted_in=None)
+        OrderPosition.all.filter(order=self, addon_to__isnull=False).delete()
+        OrderPosition.all.filter(order=self).delete()
+        OrderFee.all.filter(order=self).delete()
+        Transaction.objects.filter(order=self).delete()
+        self.refunds.all().delete()
+        self.payments.all().delete()
+        self.event.cache.delete('complain_testmode_orders')
+        self.delete()
 
     def email_confirm_secret(self):
         return self.tagged_secret("email_confirm", 9)

src/pretix/control/views/event.py

@@ -1148,11 +1148,8 @@ class EventLive(EventPermissionRequiredMixin, TemplateView):
             if request.POST.get("delete") == "yes":
                 try:
                     with transaction.atomic():
-                        Order.gracefully_delete_bulk(
-                            request.event,
-                            request.event.orders.filter(testmode=True),
-                            user=self.request.user
-                        )
+                        for order in request.event.orders.filter(testmode=True):
+                            order.gracefully_delete(user=self.request.user)
                 except ProtectedError:
                     messages.error(self.request, _('An order could not be deleted as some constraints (e.g. data '
                                                    'created by plug-ins) do not allow it.'))

src/pretix/control/views/orders.py

@@ -139,7 +139,6 @@ from pretix.helpers import OF_SELF
 from pretix.helpers.compat import CompatDeleteView
 from pretix.helpers.format import SafeFormatter, format_map
 from pretix.helpers.hierarkey import clean_filename
-from pretix.helpers.iter import chunked_iterable
 from pretix.helpers.json import CustomJSONEncoder
 from pretix.helpers.safedownload import check_token
 from pretix.presale.signals import question_form_fields
@@ -241,7 +240,7 @@ class BaseOrderBulkActionView(OrderSearchMixin, EventPermissionRequiredMixin, As
         raise NotImplementedError()
 
     def execute_bulk(self, queryset: QuerySet, form: forms.Form):
-        qs = self.allowed_for(self.get_queryset())
+        qs = self.allowed_for(self.allowed_for(self.get_queryset()))
         total = qs.count()
         orders_with_successful_action = 0
         for i, o in enumerate(qs):
@@ -395,21 +394,9 @@ class OrderDeleteBulkActionView(BaseOrderBulkActionView):
             testmode=True,
         )
 
-    def execute_bulk(self, queryset: QuerySet, form: forms.Form):
-        qs = self.allowed_for(self.get_queryset())
-        total = qs.count()
-        all_ids = list(qs.values_list("id", flat=True))
-
-        orders_with_successful_action = 0
-        for chunk in chunked_iterable(all_ids, 1000):
-            Order.gracefully_delete_bulk(
-                self.request.event,
-                qs.filter(id__in=chunk),
-                user=self.request.user,
-            )
-            orders_with_successful_action += len(chunk)
-            self.async_set_progress(orders_with_successful_action / total * 100)
-        return orders_with_successful_action, total
+    def execute_single(self, instance, form: forms.Form):
+        instance.gracefully_delete(user=self.request.user)
+        return True
 
 
 class OrderList(OrderSearchMixin, EventPermissionRequiredMixin, PaginationMixin, ListView):

src/pretix/settings.py

@@ -503,6 +503,7 @@ REST_FRAMEWORK = {
 
 MIDDLEWARE = [
     'pretix.helpers.logs.RequestIdMiddleware',
+    'pretix.base.middleware.BaseLocaleMiddleware',
     'pretix.api.middleware.IdempotencyMiddleware',
     'pretix.multidomain.middlewares.MultiDomainMiddleware',
     'pretix.base.middleware.CustomCommonMiddleware',