Use a protocol

Currently translated at 82.8% (5210 of 6287 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/nl_BE/

powered by weblate

pyproject.toml

@@ -76,7 +76,7 @@ dependencies = [
   "paypal-checkout-serversdk==1.0.*",
   "PyJWT==2.12.*",
   "phonenumberslite==9.0.*",
-  "Pillow==12.1.*",
+  "Pillow==12.2.*",
   "pretix-plugin-build",
   "protobuf==7.34.*",
   "psycopg2-binary",
@@ -90,10 +90,10 @@ dependencies = [
   "pytz-deprecation-shim==0.1.*",
   "pyuca",
   "qrcode==8.2",
-  "redis==7.1.*",
+  "redis==7.4.*",
   "reportlab==4.4.*",
   "requests==2.32.*",
-  "sentry-sdk==2.56.*",
+  "sentry-sdk==2.57.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",

src/pretix/__init__.py

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.3.0.dev0"
+__version__ = "2026.4.0.dev0"

src/pretix/base/exporter.py

@@ -47,6 +47,7 @@ from django.utils.formats import localize
 from django.utils.translation import gettext, gettext_lazy as _
 
 from pretix.base.models import Event
+from pretix.base.models.auth import PermissionHolder
 from pretix.helpers.safe_openpyxl import (  # NOQA: backwards compatibility for plugins using excel_safe
     SafeWorkbook, remove_invalid_excel_chars as excel_safe,
 )
@@ -59,11 +60,20 @@ class BaseExporter:
     This is the base class for all data exporters
     """
 
-    def __init__(self, event, organizer, progress_callback=lambda v: None):
+    def __init__(self, event, organizer, permission_holder: PermissionHolder=None, progress_callback=lambda v: None):
+        """
+        :param event: Event context, can also be a queryset of events for multi-event exports
+        :param organizer: Organizer context
+        :param user: The user who triggered the export (or None).
+        :param token: The API token that triggered the export (or None).
+        :param device: The device that triggered the export (or None)
+        :param progress_callback: Callback function with progress
+        """
         self.event = event
         self.organizer = organizer
         self.progress_callback = progress_callback
         self.is_multievent = isinstance(event, QuerySet)
+        self.permission_holder = permission_holder
         if isinstance(event, QuerySet):
             self.events = event
             self.event = None
@@ -180,7 +190,7 @@ class BaseExporter:
         return True
 
     @classmethod
-    def get_required_event_permission(cls) -> str:
+    def get_required_event_permission(cls) -> Optional[str]:
         """
         The permission level required to use this exporter for events. For multi-event-exports, this will be used
         to limit the selection of events. Will be ignored if the ``OrganizerLevelExportMixin`` mixin is used.
@@ -195,7 +205,7 @@ class OrganizerLevelExportMixin:
         raise TypeError("required_event_permission may not be called on OrganizerLevelExportMixin")
 
     @classmethod
-    def get_required_organizer_permission(cls) -> str:
+    def get_required_organizer_permission(cls) -> Optional[str]:
         """
         The permission level required to use this exporter. Must be set for organizer-level exports. Set to `None` to
         allow everyone with any access to the organizer.

src/pretix/base/forms/auth.py

@@ -196,8 +196,7 @@ class RegistrationForm(forms.Form):
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
         user = User(email=self.cleaned_data.get('email'))
-        if validate_password(password1, user=user) is not None:
-            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
+        validate_password(password1, user=user)
         return password1
 
     def clean_email(self):

src/pretix/base/models/auth.py

@@ -38,6 +38,7 @@ import operator
 import secrets
 from datetime import timedelta
 from functools import reduce
+from typing import Protocol
 
 from django.conf import settings
 from django.contrib.auth.models import (
@@ -67,6 +68,14 @@ class EmailAddressTakenError(IntegrityError):
     pass
 
 
+class PermissionHolder(Protocol):
+    def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
+        ...
+
+    def has_organizer_permission(self, organizer, perm_name=None, request=None):
+        ...
+
+
 class UserManager(BaseUserManager):
     """
     This is the user manager for our custom user model. See the User

src/pretix/base/models/devices.py

@@ -229,7 +229,7 @@ class Device(LoggedModel):
         """
         return self._organizer_permission_set() if self.organizer == organizer else set()
 
-    def has_event_permission(self, organizer, event, perm_name=None, request=None) -> bool:
+    def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
         """
         Checks if this token is part of a team that grants access of type ``perm_name``
         to the event ``event``.
@@ -238,6 +238,7 @@ class Device(LoggedModel):
         :param event: The event to check
         :param perm_name: The permission, e.g. ``event.orders:read``
         :param request: This parameter is ignored and only defined for compatibility reasons.
+        :param session_key: This parameter is ignored and only defined for compatibility reasons.
         :return: bool
         """
         has_event_access = (self.all_events and organizer == self.organizer) or (

src/pretix/base/models/organizer.py

@@ -319,6 +319,9 @@ class TeamQuerySet(models.QuerySet):
     def event_permission_q(cls, perm_name):
         from ..permissions import assert_valid_event_permission
 
+        if perm_name is None:
+            return Q()
+
         if perm_name.startswith('can_') and perm_name in OLD_TO_NEW_EVENT_COMPAT:  # legacy
             return reduce(operator.and_, [cls.event_permission_q(p) for p in OLD_TO_NEW_EVENT_COMPAT[perm_name]])
         assert_valid_event_permission(perm_name, allow_legacy=False)
@@ -331,6 +334,9 @@ class TeamQuerySet(models.QuerySet):
     def organizer_permission_q(cls, perm_name):
         from ..permissions import assert_valid_organizer_permission
 
+        if perm_name is None:
+            return Q()
+
         if perm_name.startswith('can_') and perm_name in OLD_TO_NEW_ORGANIZER_COMPAT:  # legacy
             return reduce(operator.and_, [cls.organizer_permission_q(p) for p in OLD_TO_NEW_ORGANIZER_COMPAT[perm_name]])
         assert_valid_organizer_permission(perm_name, allow_legacy=False)
@@ -550,7 +556,7 @@ class TeamAPIToken(models.Model):
         """
         return self.team.organizer_permission_set() if self.team.organizer == organizer else set()
 
-    def has_event_permission(self, organizer, event, perm_name=None, request=None) -> bool:
+    def has_event_permission(self, organizer, event, perm_name=None, request=None, session_key=None) -> bool:
         """
         Checks if this token is part of a team that grants access of type ``perm_name``
         to the event ``event``.
@@ -559,6 +565,7 @@ class TeamAPIToken(models.Model):
         :param event: The event to check
         :param perm_name: The permission, e.g. ``event.orders:read``
         :param request: This parameter is ignored and only defined for compatibility reasons.
+        :param session_key: This parameter is ignored and only defined for compatibility reasons.
         :return: bool
         """
         has_event_access = (self.team.all_events and organizer == self.team.organizer) or (

src/pretix/base/pdf.py

@@ -54,7 +54,7 @@ from bidi import get_display
 from django.conf import settings
 from django.contrib.staticfiles import finders
 from django.core.exceptions import ValidationError
-from django.db.models import Max, Min
+from django.db.models import Exists, Max, Min, OuterRef
 from django.db.models.fields.files import FieldFile
 from django.dispatch import receiver
 from django.utils.deconstruct import deconstructible
@@ -76,7 +76,7 @@ from reportlab.pdfgen.canvas import Canvas
 from reportlab.platypus import Paragraph
 
 from pretix.base.i18n import language
-from pretix.base.models import Event, Order, OrderPosition, Question
+from pretix.base.models import Checkin, Event, Order, OrderPosition, Question
 from pretix.base.settings import PERSON_NAME_SCHEMES
 from pretix.base.signals import layout_image_variables, layout_text_variables
 from pretix.base.templatetags.money import money_filter
@@ -379,6 +379,13 @@ DEFAULT_VARIABLES = OrderedDict((
             str(p) for p in generate_compressed_addon_list(op, order, ev)
         ])
     }),
+    ("checked_in_addons", {
+        "label": _("List of Checked-In Add-Ons"),
+        "editor_sample": _("Add-on 1\n2x Add-on 2"),
+        "evaluate": lambda op, order, ev: "\n".join([
+            str(p) for p in generate_compressed_addon_list(op, order, ev, only_checked_in=True)
+        ])
+    }),
     ("organizer", {
         "label": _("Organizer name"),
         "editor_sample": _("Event organizer company"),
@@ -750,12 +757,16 @@ def get_program_times(op: OrderPosition, ev: Event):
     ])
 
 
-def generate_compressed_addon_list(op, order, event):
+def generate_compressed_addon_list(op, order, event, only_checked_in=False):
     itemcount = defaultdict(int)
-    addons = [p for p in (
+    addon_qs = (
         op.addons.all() if 'addons' in getattr(op, '_prefetched_objects_cache', {})
         else op.addons.select_related('item', 'variation')
-    ) if not p.canceled]
+    )
+    if only_checked_in:
+        addon_qs = addon_qs.filter(Exists(Checkin.objects.filter(position=OuterRef('pk'))), canceled=False)
+    addons = [p for p in addon_qs if not p.canceled]
+
     for pos in addons:
         itemcount[pos.item, pos.variation] += 1
 

src/pretix/base/services/export.py

@@ -211,7 +211,12 @@ def init_event_exporters(event, user=None, token=None, device=None, request=None
         if not perm_holder.has_event_permission(event.organizer, event, permission_name, request) and not staff_session:
             continue
 
-        exporter: BaseExporter = response(event=event, organizer=event.organizer, **kwargs)
+        exporter: BaseExporter = response(
+            event=event,
+            organizer=event.organizer,
+            permission_holder=token or device or user,
+            **kwargs
+        )
 
         if not exporter.available_for_user(user if user and user.is_authenticated else None):
             continue
@@ -243,7 +248,12 @@ def init_organizer_exporters(
             continue
 
         if issubclass(response, OrganizerLevelExportMixin):
-            exporter: BaseExporter = response(event=Event.objects.none(), organizer=organizer, **kwargs)
+            exporter: BaseExporter = response(
+                event=Event.objects.none(),
+                organizer=organizer,
+                permission_holder=token or device or user,
+                **kwargs,
+            )
 
             try:
                 if not perm_holder.has_organizer_permission(organizer, response.get_required_organizer_permission(), request) and not staff_session:
@@ -295,7 +305,12 @@ def init_organizer_exporters(
             if not _has_permission_on_any_team_cache[permission_name] and not staff_session:
                 continue
 
-            exporter: BaseExporter = response(event=_event_list_cache[permission_name], organizer=organizer, **kwargs)
+            exporter: BaseExporter = response(
+                event=_event_list_cache[permission_name],
+                organizer=organizer,
+                permission_holder=token or device or user,
+                **kwargs,
+            )
 
         if not exporter.available_for_user(user if user and user.is_authenticated else None):
             continue

src/pretix/base/services/mail.py

@@ -411,7 +411,7 @@ def mail_send_task(self, **kwargs) -> bool:
         try:
             outgoing_mail = OutgoingMail.objects.select_for_update(of=OF_SELF).get(pk=outgoing_mail)
         except OutgoingMail.DoesNotExist:
-            logger.info(f"Ignoring job for non existing email {outgoing_mail.guid}")
+            logger.info(f"Ignoring job for non existing email {outgoing_mail}")
             return False
         if outgoing_mail.status == OutgoingMail.STATUS_INFLIGHT:
             logger.info(f"Ignoring job for inflight email {outgoing_mail.guid}")

src/pretix/base/services/orders.py

@@ -67,9 +67,9 @@ from pretix.base.email import get_email_context
 from pretix.base.i18n import get_language_without_region, language
 from pretix.base.media import MEDIA_TYPES
 from pretix.base.models import (
-    CartPosition, Device, Event, GiftCard, Item, ItemVariation, Membership,
-    Order, OrderPayment, OrderPosition, Quota, Seat, SeatCategoryMapping, User,
-    Voucher,
+    CartPosition, Device, Event, GiftCard, Item, ItemVariation, LogEntry,
+    Membership, Order, OrderPayment, OrderPosition, Quota, Seat,
+    SeatCategoryMapping, User, Voucher,
 )
 from pretix.base.models.event import SubEvent
 from pretix.base.models.orders import (
@@ -1618,7 +1618,7 @@ class OrderChangeManager:
     MembershipOperation = namedtuple('MembershipOperation', ('position', 'membership'))
     CancelOperation = namedtuple('CancelOperation', ('position', 'price_diff'))
     AddOperation = namedtuple('AddOperation', ('item', 'variation', 'price', 'addon_to', 'subevent', 'seat', 'membership',
-                                               'valid_from', 'valid_until', 'is_bundled', 'result'))
+                                               'valid_from', 'valid_until', 'is_bundled', 'result', 'count'))
     SplitOperation = namedtuple('SplitOperation', ('position',))
     FeeValueOperation = namedtuple('FeeValueOperation', ('fee', 'value', 'price_diff'))
     AddFeeOperation = namedtuple('AddFeeOperation', ('fee', 'price_diff'))
@@ -1632,16 +1632,24 @@ class OrderChangeManager:
     ForceRecomputeOperation = namedtuple('ForceRecomputeOperation', tuple())
 
     class AddPositionResult:
-        _position: Optional[OrderPosition]
+        _positions: Optional[List[OrderPosition]]
 
         def __init__(self):
-            self._position = None
+            self._positions = None
 
         @property
         def position(self) -> OrderPosition:
-            if self._position is None:
+            if self._positions is None:
                 raise RuntimeError("Order position has not been created yet. Call commit() first on OrderChangeManager.")
-            return self._position
+            if len(self._positions) != 1:
+                raise RuntimeError("More than one position created.")
+            return self._positions[0]
+
+        @property
+        def positions(self) -> List[OrderPosition]:
+            if self._positions is None:
+                raise RuntimeError("Order position has not been created yet. Call commit() first on OrderChangeManager.")
+            return self._positions
 
     def __init__(self, order: Order, user=None, auth=None, notify=True, reissue_invoice=True, allow_blocked_seats=False):
         self.order = order
@@ -1848,8 +1856,12 @@ class OrderChangeManager:
 
     def add_position(self, item: Item, variation: ItemVariation, price: Decimal, addon_to: OrderPosition = None,
                      subevent: SubEvent = None, seat: Seat = None, membership: Membership = None,
-                     valid_from: datetime = None, valid_until: datetime = None) -> 'OrderChangeManager.AddPositionResult':
+                     valid_from: datetime = None, valid_until: datetime = None, count: int = 1) -> 'OrderChangeManager.AddPositionResult':
+        if count < 1:
+            raise ValueError("Count must be positive")
         if isinstance(seat, str):
+            if count > 1:
+                raise ValueError("Cannot combine count > 1 with seat")
             if not seat:
                 seat = None
             else:
@@ -1903,14 +1915,14 @@ class OrderChangeManager:
         if self.order.event.settings.invoice_include_free or price.gross != Decimal('0.00'):
             self._invoice_dirty = True
 
-        self._totaldiff_guesstimate += price.gross
-        self._quotadiff.update(new_quotas)
+        self._totaldiff_guesstimate += price.gross * count
+        self._quotadiff.update({q: count for q in new_quotas})
         if seat:
             self._seatdiff.update([seat])
 
         result = self.AddPositionResult()
         self._operations.append(self.AddOperation(item, variation, price, addon_to, subevent, seat, membership,
-                                                  valid_from, valid_until, is_bundled, result))
+                                                  valid_from, valid_until, is_bundled, result, count))
         return result
 
     def split(self, position: OrderPosition):
@@ -2530,29 +2542,35 @@ class OrderChangeManager:
                     secret_dirty.remove(position)
                 position.save(update_fields=['canceled', 'secret'])
             elif isinstance(op, self.AddOperation):
-                pos = OrderPosition.objects.create(
-                    item=op.item, variation=op.variation, addon_to=op.addon_to,
-                    price=op.price.gross, order=self.order, tax_rate=op.price.rate, tax_code=op.price.code,
-                    tax_value=op.price.tax, tax_rule=op.item.tax_rule,
-                    positionid=nextposid, subevent=op.subevent, seat=op.seat,
-                    used_membership=op.membership, valid_from=op.valid_from, valid_until=op.valid_until,
-                    is_bundled=op.is_bundled,
-                )
-                nextposid += 1
-                self.order.log_action('pretix.event.order.changed.add', user=self.user, auth=self.auth, data={
-                    'position': pos.pk,
-                    'item': op.item.pk,
-                    'variation': op.variation.pk if op.variation else None,
-                    'addon_to': op.addon_to.pk if op.addon_to else None,
-                    'price': op.price.gross,
-                    'positionid': pos.positionid,
-                    'membership': pos.used_membership_id,
-                    'subevent': op.subevent.pk if op.subevent else None,
-                    'seat': op.seat.pk if op.seat else None,
-                    'valid_from': op.valid_from.isoformat() if op.valid_from else None,
-                    'valid_until': op.valid_until.isoformat() if op.valid_until else None,
-                })
-                op.result._position = pos
+                new_pos = []
+                new_logs = []
+                for i in range(op.count):
+                    pos = OrderPosition.objects.create(
+                        item=op.item, variation=op.variation, addon_to=op.addon_to,
+                        price=op.price.gross, order=self.order, tax_rate=op.price.rate, tax_code=op.price.code,
+                        tax_value=op.price.tax, tax_rule=op.item.tax_rule,
+                        positionid=nextposid, subevent=op.subevent, seat=op.seat,
+                        used_membership=op.membership, valid_from=op.valid_from, valid_until=op.valid_until,
+                        is_bundled=op.is_bundled,
+                    )
+                    nextposid += 1
+                    new_pos.append(pos)
+                    new_logs.append(self.order.log_action('pretix.event.order.changed.add', user=self.user, auth=self.auth, data={
+                        'position': pos.pk,
+                        'item': op.item.pk,
+                        'variation': op.variation.pk if op.variation else None,
+                        'addon_to': op.addon_to.pk if op.addon_to else None,
+                        'price': op.price.gross,
+                        'positionid': pos.positionid,
+                        'membership': pos.used_membership_id,
+                        'subevent': op.subevent.pk if op.subevent else None,
+                        'seat': op.seat.pk if op.seat else None,
+                        'valid_from': op.valid_from.isoformat() if op.valid_from else None,
+                        'valid_until': op.valid_until.isoformat() if op.valid_until else None,
+                    }, save=False))
+
+                op.result._positions = new_pos
+                LogEntry.bulk_create_and_postprocess(new_logs)
             elif isinstance(op, self.SplitOperation):
                 position = position_cache.setdefault(op.position.pk, op.position)
                 split_positions.append(position)
@@ -2877,7 +2895,7 @@ class OrderChangeManager:
         return total
 
     def _check_order_size(self):
-        if (len(self.order.positions.all()) + len([op for op in self._operations if isinstance(op, self.AddOperation)])) > settings.PRETIX_MAX_ORDER_SIZE:
+        if (len(self.order.positions.all()) + sum([op.count for op in self._operations if isinstance(op, self.AddOperation)])) > settings.PRETIX_MAX_ORDER_SIZE:
             raise OrderError(
                 self.error_messages['max_order_size'] % {
                     'max': settings.PRETIX_MAX_ORDER_SIZE,
@@ -2938,7 +2956,7 @@ class OrderChangeManager:
         ]) + len([
             o for o in self._operations if isinstance(o, self.SplitOperation)
         ])
-        adds = len([o for o in self._operations if isinstance(o, self.AddOperation)])
+        adds = sum([o.count for o in self._operations if isinstance(o, self.AddOperation)])
         if current > 0 and current - cancels + adds < 1:
             raise OrderError(self.error_messages['complete_cancel'])
 
@@ -2985,17 +3003,18 @@ class OrderChangeManager:
             elif isinstance(op, self.CancelOperation) and op.position in positions_to_fake_cart:
                 fake_cart.remove(positions_to_fake_cart[op.position])
             elif isinstance(op, self.AddOperation):
-                cp = CartPosition(
-                    event=self.event,
-                    item=op.item,
-                    variation=op.variation,
-                    used_membership=op.membership,
-                    subevent=op.subevent,
-                    seat=op.seat,
-                )
-                cp.override_valid_from = op.valid_from
-                cp.override_valid_until = op.valid_until
-                fake_cart.append(cp)
+                for i in range(op.count):
+                    cp = CartPosition(
+                        event=self.event,
+                        item=op.item,
+                        variation=op.variation,
+                        used_membership=op.membership,
+                        subevent=op.subevent,
+                        seat=op.seat,
+                    )
+                    cp.override_valid_from = op.valid_from
+                    cp.override_valid_until = op.valid_until
+                    fake_cart.append(cp)
         try:
             validate_memberships_in_order(self.order.customer, fake_cart, self.event, lock=True, ignored_order=self.order, testmode=self.order.testmode)
         except ValidationError as e:

src/pretix/control/forms/filter.py

@@ -1528,133 +1528,6 @@ class SubEventFilterForm(FilterForm):
         return self.event.organizer.meta_properties.filter(filter_allowed=True)
 
 
-class QuotaFilterForm(FilterForm):
-    orders = {
-        '-date': ('-subevent__date_from', 'name', 'pk'),
-        'date': ('subevent__date_from', '-name', '-pk'),
-        'size': ('size', 'name', 'pk'),
-        '-size': ('-size', '-name', '-pk'),
-        'name': ('name', 'pk'),
-        '-name': ('-name', '-pk'),
-    }
-    subevent = forms.ModelChoiceField(
-        label=pgettext_lazy('subevent', 'Date'),
-        queryset=SubEvent.objects.none(),
-        required=False,
-        empty_label=pgettext_lazy('subevent', 'All dates')
-    )
-    date_from = forms.DateField(
-        label=_('Date from'),
-        required=False,
-        widget=DatePickerWidget({
-            'placeholder': _('Date from'),
-        }),
-    )
-    date_until = forms.DateField(
-        label=_('Date until'),
-        required=False,
-        widget=DatePickerWidget({
-            'placeholder': _('Date until'),
-        }),
-    )
-    time_from = forms.TimeField(
-        label=_('Start time from'),
-        required=False,
-        widget=TimePickerWidget({}),
-    )
-    time_until = forms.TimeField(
-        label=_('Start time until'),
-        required=False,
-        widget=TimePickerWidget({}),
-    )
-    weekday = forms.MultipleChoiceField(
-        label=_('Weekday'),
-        choices=(
-            ('2', _('Monday')),
-            ('3', _('Tuesday')),
-            ('4', _('Wednesday')),
-            ('5', _('Thursday')),
-            ('6', _('Friday')),
-            ('7', _('Saturday')),
-            ('1', _('Sunday')),
-        ),
-        widget=forms.CheckboxSelectMultiple,
-        required=False
-    )
-    query = forms.CharField(
-        label=_('Quota name'),
-        widget=forms.TextInput(),
-        required=False
-    )
-
-    def __init__(self, *args, **kwargs):
-        self.event = kwargs.pop('event')
-        super().__init__(*args, **kwargs)
-        if self.event.has_subevents:
-            self.fields['date_from'].widget = DatePickerWidget()
-            self.fields['date_until'].widget = DatePickerWidget()
-            self.fields['subevent'].queryset = self.event.subevents.all()
-            self.fields['subevent'].widget = Select2(
-                attrs={
-                    'data-model-select2': 'event',
-                    'data-select2-url': reverse('control:event.subevents.select2', kwargs={
-                        'event': self.event.slug,
-                        'organizer': self.event.organizer.slug,
-                    }),
-                    'data-placeholder': pgettext_lazy('subevent', 'All dates')
-                }
-            )
-            self.fields['subevent'].widget.choices = self.fields['subevent'].choices
-        else:
-            del self.fields['subevent']
-            del self.fields['date_from']
-            del self.fields['date_until']
-            del self.fields['time_from']
-            del self.fields['time_until']
-            del self.fields['weekday']
-
-    def filter_qs(self, qs):
-        fdata = self.cleaned_data
-
-        if fdata.get('weekday'):
-            qs = qs.annotate(wday=ExtractWeekDay('subevent__date_from')).filter(wday__in=fdata.get('weekday'))
-
-        if fdata.get('subevent'):
-            qs = qs.filter(subevent=fdata["subevent"])
-
-        if fdata.get('query'):
-            query = fdata.get('query')
-            qs = qs.filter(name__icontains=query)
-
-        if fdata.get('date_until'):
-            date_end = make_aware(datetime.combine(
-                fdata.get('date_until') + timedelta(days=1),
-                time(hour=0, minute=0, second=0, microsecond=0)
-            ), get_current_timezone())
-            qs = qs.filter(
-                Q(subevent__date_to__isnull=True, subevent__date_from__lt=date_end) |
-                Q(subevent__date_to__isnull=False, subevent__date_to__lt=date_end)
-            )
-        if fdata.get('date_from'):
-            date_start = make_aware(datetime.combine(
-                fdata.get('date_from'),
-                time(hour=0, minute=0, second=0, microsecond=0)
-            ), get_current_timezone())
-            qs = qs.filter(subevent__date_from__gte=date_start)
-
-        if fdata.get('time_until'):
-            qs = qs.filter(subevent__date_from__time__lte=fdata.get('time_until'))
-        if fdata.get('time_from'):
-            qs = qs.filter(subevent__date_from__time__gte=fdata.get('time_from'))
-
-        if fdata.get('ordering'):
-            qs = qs.order_by(*get_deterministic_ordering(Quota, self.get_order_by()))
-        else:
-            qs = qs.order_by('-subevent__date_from', 'name', 'pk')
-
-        return qs
-
-
 class OrganizerFilterForm(FilterForm):
     orders = {
         'slug': 'slug',

src/pretix/control/forms/item.py

@@ -43,7 +43,6 @@ from django.core.exceptions import ValidationError
 from django.db.models import Max, Q
 from django.forms import ChoiceField, RadioSelect
 from django.forms.formsets import DELETION_FIELD_NAME
-from django.forms.utils import ErrorDict
 from django.urls import reverse
 from django.utils.functional import cached_property
 from django.utils.html import escape, format_html
@@ -376,60 +375,6 @@ class QuotaForm(I18nModelForm):
         return inst
 
 
-class QuotaBulkEditForm(QuotaForm):
-
-    def __init__(self, *args, **kwargs):
-        self.mixed_values = kwargs.pop('mixed_values')
-        self.queryset = kwargs.pop('queryset')
-        super().__init__(**kwargs)
-        self.fields.pop("subevent", None)  # Would add extra complexity and it's hard to imagine a use case for that
-        self.fields["name"].required = False
-        self.fields["itemvars"].required = False
-
-    def clean(self):
-        d = super().clean()
-        if self.prefix + "name" in self.data.getlist('_bulk') and not d.get("name"):
-            raise ValidationError({"name": _("This field is required.")})
-        if self.prefix + "itemvars" in self.data.getlist('_bulk') and not d.get("itemvars"):
-            raise ValidationError({"itemvars": _("This field is required.")})
-        return d
-
-    def save(self, commit=True):
-        objs = list(self.queryset)
-        fields = set()
-
-        for k in self.fields:
-            cb_val = self.prefix + k
-            if cb_val not in self.data.getlist('_bulk'):
-                continue
-
-            fields.add(k)
-            if k == 'itemvars':
-                selected_items = set(list(self.event.items.filter(id__in=[
-                    i.split('-')[0] for i in self.cleaned_data['itemvars']
-                ])))
-                selected_variations = list(ItemVariation.objects.filter(item__event=self.event, id__in=[
-                    i.split('-')[1] for i in self.cleaned_data['itemvars'] if '-' in i
-                ]))
-                for obj in objs:
-                    obj.items.set(selected_items)
-                    obj.variations.set(selected_variations)
-            else:
-                for obj in objs:
-                    setattr(obj, k, self.cleaned_data[k])
-
-        fields = [f for f in fields if f != 'itemvars']
-        if fields:
-            Quota.objects.bulk_update(objs, fields, 200)
-
-    def full_clean(self):
-        if len(self.data) == 0:
-            # form wasn't submitted
-            self._errors = ErrorDict()
-            return
-        super().full_clean()
-
-
 class ItemCreateForm(I18nModelForm):
     NONE = 'none'
     EXISTING = 'existing'

src/pretix/control/forms/orders.py

@@ -331,6 +331,10 @@ class OtherOperationsForm(forms.Form):
 
 
 class OrderPositionAddForm(forms.Form):
+    count = forms.IntegerField(
+        label=_('Number of products to add'),
+        initial=1,
+    )
     itemvar = forms.ChoiceField(
         label=_('Product')
     )
@@ -432,6 +436,10 @@ class OrderPositionAddForm(forms.Form):
             d['used_membership'] = [m for m in self.memberships if str(m.pk) == d['used_membership']][0]
         else:
             d['used_membership'] = None
+        if d.get("count", 1) and d.get("seat"):
+            raise ValidationError({
+                "seat": _("You can not choose a seat when adding multiple products at once.")
+            })
         return d
 
 

src/pretix/control/templates/pretixcontrol/items/quota_bulk_edit.html

@@ -1,49 +0,0 @@
-{% extends "pretixcontrol/event/base.html" %}
-{% load i18n %}
-{% load bootstrap3 %}
-{% block content %}
-    <h1>
-        {% trans "Change multiple quotas" %}
-        <small>
-            {% blocktrans trimmed with number=quotas.count %}
-                {{ number }} selected
-            {% endblocktrans %}
-        </small>
-    </h1>
-    <form class="form-horizontal" action="" method="post">
-        {% csrf_token %}
-        {% bootstrap_form_errors form %}
-        <div class="hidden">
-            {% for d in quotas %}
-                <input type="hidden" name="quota" value="{{ d.pk }}">
-            {% endfor %}
-        </div>
-        <fieldset>
-            <legend>{% trans "General information" %}</legend>
-            {% bootstrap_field form.name layout="bulkedit" %}
-            {% bootstrap_field form.size layout="bulkedit" %}
-        </fieldset>
-        <fieldset>
-            <legend>{% trans "Items" %}</legend>
-            <p>
-                {% blocktrans trimmed %}
-                    Please select the products or product variations this quota should be applied to. If you apply two
-                    quotas to the same product, it will only be available if <strong>both</strong> quotas have capacity
-                    left.
-                {% endblocktrans %}
-            </p>
-            {% bootstrap_field form.itemvars layout="bulkedit" %}
-        </fieldset>
-        <fieldset>
-            <legend>{% trans "Advanced options" %}</legend>
-            {% bootstrap_field form.close_when_sold_out layout="bulkedit" %}
-            {% bootstrap_field form.release_after_exit layout="bulkedit" %}
-            {% bootstrap_field form.ignore_for_event_availability layout="bulkedit" %}
-        </fieldset>
-        <div class="form-group submit-group">
-            <button type="submit" class="btn btn-primary btn-save">
-                {% trans "Save" %}
-            </button>
-        </div>
-    </form>
-{% endblock %}

src/pretix/control/templates/pretixcontrol/items/quota_delete_bulk.html

@@ -1,34 +0,0 @@
-{% extends "pretixcontrol/event/base.html" %}
-{% load i18n %}
-{% load bootstrap3 %}
-{% block title %}{% trans "Delete quotas" %}{% endblock %}
-{% block content %}
-    <h1>{% trans "Delete quotas" %}</h1>
-    <form action="" method="post" class="form-horizontal">
-        {% csrf_token %}
-        {% if allowed %}
-            <p>{% blocktrans trimmed count num=allowed|length %}
-                Are you sure you want to delete the following quota?
-            {% plural %}
-                Are you sure you want to delete the following {{ num }} quotas?
-            {% endblocktrans %}</p>
-            <ul>
-                {% for q in allowed %}
-                    <li>
-                        {{ q }} {% if q.subevent %}({{ q.subevent }}){% endif %}
-                        <input type="hidden" name="quota" value="{{ q.pk }}">
-                    </li>
-                {% endfor %}
-            </ul>
-        {% endif %}
-        <div class="form-group submit-group">
-            <a href="{% url "control:event.items.quotas" organizer=request.event.organizer.slug event=request.event.slug %}"
-               class="btn btn-default btn-cancel">
-                {% trans "Cancel" %}
-            </a>
-            <button type="submit" class="btn btn-danger btn-save" value="delete_confirm" name="action">
-                {% trans "Delete" %}
-            </button>
-        </div>
-    </form>
-{% endblock %}

src/pretix/control/templates/pretixcontrol/items/quotas.html

@@ -1,7 +1,6 @@
 {% extends "pretixcontrol/items/base.html" %}
 {% load i18n %}
 {% load urlreplace %}
-{% load bootstrap3 %}
 {% block title %}{% trans "Quotas" %}{% endblock %}
 {% block inside %}
     <h1>{% trans "Quotas" %}</h1>
@@ -14,12 +13,21 @@
             number of a specific ticket type at the same time.
         {% endblocktrans %}
     </p>
-    {% if quotas|length == 0 and not filter_form.filtered %}
+    {% if request.event.has_subevents %}
+        <form class="form-inline helper-display-inline" action="" method="get">
+            {% include "pretixcontrol/event/fragment_subevent_choice_simple.html" %}
+        </form>
+    {% endif %}
+    {% if quotas|length == 0 %}
         <div class="empty-collection">
             <p>
-                {% blocktrans trimmed %}
-                    You haven't created any quotas yet.
-                {% endblocktrans %}
+                {% if request.GET.subevent %}
+                    {% trans "Your search did not match any quotas." %}
+                {% else %}
+                    {% blocktrans trimmed %}
+                        You haven't created any quotas yet.
+                    {% endblocktrans %}
+                {% endif %}
             </p>
 
             {% if 'event.items:write' in request.eventpermset %}
@@ -28,160 +36,79 @@
             {% endif %}
         </div>
     {% else %}
-
-        <div class="panel panel-default">
-            <div class="panel-heading">
-                <h3 class="panel-title">
-                    {% trans "Filter" %}
-                </h3>
-            </div>
-            <form class="panel-body filter-form" action="" method="get">
-                <div class="row">
-                    <div class="{% if not filter_form.subevent %}col-lg-6{% else %}col-lg-2{% endif %} col-md-6 col-sm-6 col-xs-12">
-                        {% bootstrap_field filter_form.query %}
-                    </div>
-                    {% if filter_form.subevent %}
-                        <div class="col-lg-2 col-md-6 col-md-2 col-sm-6 col-xs-12">
-                            {% bootstrap_field filter_form.subevent %}
-                        </div>
-                        <div class="col-lg-2 col-md-3 col-sm-6 col-xs-12">
-                            {% bootstrap_field filter_form.date_from %}
-                        </div>
-                        <div class="col-lg-2 col-md-3 col-sm-6 col-xs-12">
-                            {% bootstrap_field filter_form.date_until %}
-                        </div>
-                        <div class="col-lg-2 col-md-3 col-sm-6 col-xs-12">
-                            {% bootstrap_field filter_form.time_from %}
-                        </div>
-                        <div class="col-lg-2 col-md-3 col-sm-6 col-xs-12">
-                            {% bootstrap_field filter_form.time_until %}
-                        </div>
-                        <div class="col-xs-12 one-line-checkboxes">
-                            {% bootstrap_field filter_form.weekday %}
-                        </div>
-                    {% endif %}
-                </div>
-
-                <div class="text-right flip">
-                    <button class="btn btn-primary btn-lg" type="submit">
-                        <span class="fa fa-filter"></span>
-                        {% trans "Filter" %}
-                    </button>
-                </div>
-            </form>
-        </div>
         {% if 'event.items:write' in request.eventpermset %}
             <p>
                 <a href="{% url "control:event.items.quotas.add" organizer=request.event.organizer.slug event=request.event.slug %}" class="btn btn-default"><i class="fa fa-plus"></i> {% trans "Create a new quota" %}
                 </a>
             </p>
         {% endif %}
-        <form action="{% url "control:event.items.quotas.bulkaction"  organizer=request.event.organizer.slug event=request.event.slug %}" method="post">
-            {% csrf_token %}
-            {% for field in filter_form %}
-                {{ field.as_hidden }}
-            {% endfor %}
-            <div class="table-responsive">
-                <table class="table table-hover table-quotas">
-                    <thead>
-                    <tr>
-                        {% if "event.items:write" in request.eventpermset %}
-                            <th>
-                                <label aria-label="{% trans "select all rows for batch-operation" %}" class="batch-select-label"><input type="checkbox" data-toggle-table/></label>
-                            </th>
-                        {% endif %}
-                        <th>{% trans "Quota name" %}
-                            <a href="?{% url_replace request 'filter-ordering' '-name' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'filter-ordering' 'name' %}"><i class="fa fa-caret-up"></i></a>
+        <div class="table-responsive">
+            <table class="table table-hover table-quotas">
+                <thead>
+                <tr>
+                    <th>{% trans "Quota name" %}
+                        <a href="?{% url_replace request 'ordering' '-name' %}"><i class="fa fa-caret-down"></i></a>
+                        <a href="?{% url_replace request 'ordering' 'name' %}"><i class="fa fa-caret-up"></i></a>
+                    </th>
+                    <th>{% trans "Products" %}</th>
+                    {% if request.event.has_subevents %}
+                        <th>{% trans "Date" context "subevent" %}
+                            <a href="?{% url_replace request 'ordering' '-date' %}"><i class="fa fa-caret-down"></i></a>
+                            <a href="?{% url_replace request 'ordering' 'date' %}"><i class="fa fa-caret-up"></i></a>
                         </th>
-                        <th>{% trans "Products" %}</th>
-                        {% if request.event.has_subevents %}
-                            <th>{% trans "Date" context "subevent" %}
-                                <a href="?{% url_replace request 'filter-ordering' '-date' %}"><i class="fa fa-caret-down"></i></a>
-                                <a href="?{% url_replace request 'filter-ordering' 'date' %}"><i class="fa fa-caret-up"></i></a>
-                            </th>
-                        {% endif %}
-                        <th>{% trans "Total capacity" %}
-                            <a href="?{% url_replace request 'filter-ordering' '-size' %}"><i class="fa fa-caret-down"></i></a>
-                            <a href="?{% url_replace request 'filter-ordering' 'size' %}"><i class="fa fa-caret-up"></i></a>
-                        </th>
-                        <th>{% trans "Capacity left" %}</th>
-                        <th class="action-col-2"></th>
-                    </tr>
-                    {% if "event.items:write" in request.eventpermset and page_obj.paginator.num_pages > 1 %}
-                        <tr class="table-select-all warning hidden">
-                            <td>
-                                <input type="checkbox" name="__ALL" id="__all" data-results-total="{{ page_obj.paginator.count }}">
-                            </td>
-                            <td colspan="6">
-                                <label for="__all">
-                                    {% trans "Select all results on other pages as well" %}
-                                </label>
-                            </td>
-                        </tr>
                     {% endif %}
-                    </thead>
-                    <tbody>
-                    {% for q in quotas %}
-                        <tr>
-                            {% if "event.items:write" in request.eventpermset %}
-                                <td>
-                                    <label aria-label="{% trans "select row for batch-operation" %}" class="batch-select-label"><input type="checkbox" name="quota" class="batch-select-checkbox" value="{{ q.pk }}"/></label>
-                                </td>
+                    <th>{% trans "Total capacity" %}
+                        <a href="?{% url_replace request 'ordering' '-size' %}"><i class="fa fa-caret-down"></i></a>
+                        <a href="?{% url_replace request 'ordering' 'size' %}"><i class="fa fa-caret-up"></i></a>
+                    </th>
+                    <th>{% trans "Capacity left" %}</th>
+                    <th class="action-col-2"></th>
+                </tr>
+                </thead>
+                <tbody>
+                {% for q in quotas %}
+                    <tr>
+                        <td>
+                            <strong><a href="{% url "control:event.items.quotas.show" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}">{{ q.name }}</a></strong>
+                            {% if q.ignore_for_event_availability %}
+                                <span class="fa fa-eye-slash text-muted" data-toggle="tooltip" title="{% trans "Ignore this quota when determining event availability" %}"></span>
                             {% endif %}
+                        </td>
+                        <td>
+                            <ul>
+                                {% for item in q.cached_items %}
+                                    {% if not item.has_variations %}
+                                        <li><a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=item.id %}">{{ item }}</a></li>
+                                    {% endif %}
+                                {% endfor %}
+                                {% for v in q.variations.all %}
+                                    <li><a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=v.item.id %}#tab-0-3-open">
+                                        {{ v.item }} – {{ v }}</a></li>
+                                {% endfor %}
+                            </ul>
+                        </td>
+                        {% if request.event.has_subevents %}
                             <td>
-                                <strong><a href="{% url "control:event.items.quotas.show" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}">{{ q.name }}</a></strong>
-                                {% if q.ignore_for_event_availability %}
-                                    <span class="fa fa-eye-slash text-muted" data-toggle="tooltip" title="{% trans "Ignore this quota when determining event availability" %}"></span>
-                                {% endif %}
+                                {{ q.subevent.name }} – {{ q.subevent.get_date_range_display_with_times }}
                             </td>
-                            <td>
-                                <ul>
-                                    {% for item in q.cached_items %}
-                                        {% if not item.has_variations %}
-                                            <li><a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=item.id %}">{{ item }}</a></li>
-                                        {% endif %}
-                                    {% endfor %}
-                                    {% for v in q.variations.all %}
-                                        <li><a href="{% url "control:event.item" organizer=request.event.organizer.slug event=request.event.slug item=v.item.id %}#tab-0-3-open">
-                                            {{ v.item }} – {{ v }}</a></li>
-                                    {% endfor %}
-                                </ul>
-                            </td>
-                            {% if request.event.has_subevents %}
-                                <td>
-                                    {{ q.subevent.name }} – {{ q.subevent.get_date_range_display_with_times }}
-                                </td>
+                        {% endif %}
+                        <td>{% if q.size == None %}Unlimited{% else %}{{ q.size }}{% endif %}</td>
+                        <td>{% include "pretixcontrol/items/fragment_quota_availability.html" with availability=q.cached_avail closed=q.closed %}</td>
+                        <td class="text-right flip">
+                            {% if 'event.items:write' in request.eventpermset %}
+                                <a href="{% url "control:event.items.quotas.edit" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}" class="btn btn-default btn-sm"><i class="fa fa-edit"></i></a>
+                                <a href="{% url "control:event.items.quotas.add" organizer=request.event.organizer.slug event=request.event.slug %}?copy_from={{ q.id }}"
+                                   class="btn btn-sm btn-default" title="{% trans "Clone" %}" data-toggle="tooltip">
+                                    <span class="fa fa-copy"></span>
+                                </a>
+                                <a href="{% url "control:event.items.quotas.delete" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}" class="btn btn-danger btn-sm"><i class="fa fa-trash"></i></a>
                             {% endif %}
-                            <td>{% if q.size == None %}Unlimited{% else %}{{ q.size }}{% endif %}</td>
-                            <td>{% include "pretixcontrol/items/fragment_quota_availability.html" with availability=q.cached_avail closed=q.closed %}</td>
-                            <td class="text-right flip">
-                                {% if 'event.items:write' in request.eventpermset %}
-                                    <a href="{% url "control:event.items.quotas.edit" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}" class="btn btn-default btn-sm"><i class="fa fa-edit"></i></a>
-                                    <a href="{% url "control:event.items.quotas.add" organizer=request.event.organizer.slug event=request.event.slug %}?copy_from={{ q.id }}"
-                                       class="btn btn-sm btn-default" title="{% trans "Clone" %}" data-toggle="tooltip">
-                                        <span class="fa fa-copy"></span>
-                                    </a>
-                                    <a href="{% url "control:event.items.quotas.delete" organizer=request.event.organizer.slug event=request.event.slug quota=q.id %}" class="btn btn-danger btn-sm"><i class="fa fa-trash"></i></a>
-                                {% endif %}
-                            </td>
-                        </tr>
-                    {% endfor %}
-                    </tbody>
-                </table>
-            </div>
-            {% if "event.items:write" in request.eventpermset %}
-                <div class="batch-select-actions">
-                    <button type="submit" class="btn btn-danger btn-save" name="action" value="delete">
-                        <i class="fa fa-trash"></i>{% trans "Delete selected" %}
-                    </button>
-                    <button type="submit" class="btn btn-primary btn-save" name="action" value="edit"
-                            formaction="{% url "control:event.items.quotas.bulkedit"  organizer=request.event.organizer.slug event=request.event.slug %}">
-                        <i class="fa fa-edit"></i>{% trans "Edit selected" %}
-                    </button>
-                </div>
-            {% endif %}
-        </form>
+                        </td>
+                    </tr>
+                {% endfor %}
+                </tbody>
+            </table>
+        </div>
     {% endif %}
     {% include "pretixcontrol/pagination.html" %}
 {% endblock %}

src/pretix/control/templates/pretixcontrol/order/change.html

@@ -329,6 +329,7 @@
                                         {{ add_form.custom_error }}
                                     </div>
                                 {% endif %}
+                                {% bootstrap_field add_form.count layout="control" %}
                                 {% bootstrap_field add_form.itemvar layout="control" %}
                                 {% bootstrap_field add_form.price addon_after=request.event.currency layout="control" %}
                                 {% if add_form.addon_to %}
@@ -364,6 +365,7 @@
                         </div>
                         <div class="panel-body">
                             <div class="form-horizontal">
+                                {% bootstrap_field add_position_formset.empty_form.count layout="control" %}
                                 {% bootstrap_field add_position_formset.empty_form.itemvar layout="control" %}
                                 {% bootstrap_field add_position_formset.empty_form.price addon_after=request.event.currency layout="control" %}
                                 {% if add_position_formset.empty_form.addon_to %}

src/pretix/control/urls.py

@@ -349,8 +349,6 @@ urlpatterns = [
                 name='event.items.questions.edit'),
         re_path(r'^questions/add$', item.QuestionCreate.as_view(), name='event.items.questions.add'),
         re_path(r'^quotas/$', item.QuotaList.as_view(), name='event.items.quotas'),
-        re_path(r'^quotas/bulk_action$', item.QuotaBulkAction.as_view(), name='event.items.quotas.bulkaction'),
-        re_path(r'^quotas/bulk_edit$', item.QuotaBulkUpdateView.as_view(), name='event.items.quotas.bulkedit'),
         re_path(r'^quotas/(?P<quota>\d+)/$', item.QuotaView.as_view(), name='event.items.quotas.show'),
         re_path(r'^quotas/select$', typeahead.quotas_select2, name='event.items.quotas.select2'),
         re_path(r'^quotas/(?P<quota>\d+)/change$', item.QuotaUpdate.as_view(), name='event.items.quotas.edit'),

src/pretix/control/views/item.py

@@ -41,22 +41,21 @@ from json.decoder import JSONDecodeError
 from django.contrib import messages
 from django.core.exceptions import PermissionDenied
 from django.core.files import File
-from django.db import models, transaction
+from django.db import transaction
 from django.db.models import (
-    Count, Exists, F, OuterRef, Prefetch, ProtectedError, Q, Subquery, Value,
+    Count, Exists, F, OuterRef, Prefetch, ProtectedError, Q,
 )
-from django.db.models.functions import Cast, Concat
 from django.forms.models import inlineformset_factory
 from django.http import (
     Http404, HttpResponse, HttpResponseBadRequest, HttpResponseRedirect,
 )
-from django.shortcuts import redirect, render
+from django.shortcuts import redirect
 from django.urls import resolve, reverse
 from django.utils.functional import cached_property
 from django.utils.timezone import now
 from django.utils.translation import gettext, gettext_lazy as _
 from django.views.decorators.http import require_http_methods
-from django.views.generic import FormView, ListView, View
+from django.views.generic import ListView
 from django.views.generic.detail import DetailView, SingleObjectMixin
 from django_countries.fields import Country
 
@@ -66,7 +65,7 @@ from pretix.api.serializers.item import (
 )
 from pretix.base.forms import I18nFormSet
 from pretix.base.models import (
-    CartPosition, Item, ItemCategory, ItemProgramTime, ItemVariation, LogEntry,
+    CartPosition, Item, ItemCategory, ItemProgramTime, ItemVariation,
     OrderPosition, Question, QuestionAnswer, QuestionOption, Quota,
     SeatCategoryMapping, Voucher,
 )
@@ -75,15 +74,12 @@ from pretix.base.models.items import ItemAddOn, ItemBundle, ItemMetaValue
 from pretix.base.services.quotas import QuotaAvailability
 from pretix.base.services.tickets import invalidate_cache
 from pretix.base.signals import quota_availability
-from pretix.control.forms.filter import (
-    QuestionAnswerFilterForm, QuotaFilterForm,
-)
+from pretix.control.forms.filter import QuestionAnswerFilterForm
 from pretix.control.forms.item import (
     CategoryForm, ItemAddOnForm, ItemAddOnsFormSet, ItemBundleForm,
     ItemBundleFormSet, ItemCreateForm, ItemMetaValueForm, ItemProgramTimeForm,
     ItemProgramTimeFormSet, ItemUpdateForm, ItemVariationForm,
-    ItemVariationsFormSet, QuestionForm, QuestionOptionForm, QuotaBulkEditForm,
-    QuotaForm,
+    ItemVariationsFormSet, QuestionForm, QuestionOptionForm, QuotaForm,
 )
 from pretix.control.permissions import (
     EventPermissionRequiredMixin, event_permission_required,
@@ -91,7 +87,6 @@ from pretix.control.permissions import (
 from pretix.control.signals import item_forms, item_formsets
 from pretix.helpers.models import modelcopy
 
-from ...helpers import GroupConcat
 from ...helpers.compat import CompatDeleteView
 from . import ChartContainingView, CreateView, PaginationMixin, UpdateView
 
@@ -836,38 +831,13 @@ class QuestionCreate(EventPermissionRequiredMixin, QuestionMixin, CreateView):
         return ret
 
 
-class QuotaQueryMixin:
-
-    @cached_property
-    def request_data(self):
-        if self.request.method == "POST":
-            return self.request.POST
-        return self.request.GET
-
-    def get_queryset(self):
-        qs = self.request.event.quotas
-        if self.filter_form.is_valid():
-            qs = self.filter_form.filter_qs(qs)
-
-        if 'quota' in self.request_data and '__ALL' not in self.request_data:
-            qs = qs.filter(
-                id__in=self.request_data.getlist('quota')
-            )
-
-        return qs
-
-    @cached_property
-    def filter_form(self):
-        return QuotaFilterForm(data=self.request_data, prefix='filter', event=self.request.event)
-
-
-class QuotaList(PaginationMixin, QuotaQueryMixin, ListView):
+class QuotaList(PaginationMixin, ListView):
     model = Quota
     context_object_name = 'quotas'
     template_name = 'pretixcontrol/items/quotas.html'
 
     def get_queryset(self):
-        return super().get_queryset().prefetch_related(
+        qs = self.request.event.quotas.prefetch_related(
             Prefetch(
                 "items",
                 queryset=Item.objects.annotate(
@@ -882,10 +852,28 @@ class QuotaList(PaginationMixin, QuotaQueryMixin, ListView):
                 queryset=self.request.event.subevents.all()
             )
         )
+        if self.request.GET.get("subevent", "") != "":
+            s = self.request.GET.get("subevent", "")
+            qs = qs.filter(subevent_id=s)
+
+        valid_orders = {
+            '-date': ('-subevent__date_from', 'name', 'pk'),
+            'date': ('subevent__date_from', '-name', '-pk'),
+            'size': ('size', 'name', 'pk'),
+            '-size': ('-size', '-name', '-pk'),
+            'name': ('name', 'pk'),
+            '-name': ('-name', '-pk'),
+        }
+
+        if self.request.GET.get("ordering", "-date") in valid_orders:
+            qs = qs.order_by(*valid_orders[self.request.GET.get("ordering", "-date")])
+        else:
+            qs = qs.order_by('name', 'subevent__date_from', 'pk')
+
+        return qs
 
     def get_context_data(self, **kwargs):
         ctx = super().get_context_data()
-        ctx['filter_form'] = self.filter_form
 
         qa = QuotaAvailability()
         qa.queue(*ctx['quotas'])
@@ -896,165 +884,6 @@ class QuotaList(PaginationMixin, QuotaQueryMixin, ListView):
         return ctx
 
 
-class QuotaBulkAction(QuotaQueryMixin, EventPermissionRequiredMixin, View):
-    permission = 'event.items:write'
-
-    @transaction.atomic
-    def post(self, request, *args, **kwargs):
-        if request.POST.get('action') == 'delete':
-            return render(request, 'pretixcontrol/items/quota_delete_bulk.html', {
-                'allowed': self.get_queryset().select_related("subevent"),
-            })
-        elif request.POST.get('action') == 'delete_confirm':
-            log_entries = []
-            to_delete = []
-            for obj in self.get_queryset():
-                log_entries.append(obj.log_action('pretix.event.quota.deleted', user=self.request.user, save=False))
-                to_delete.append(obj.pk)
-
-            if to_delete:
-                LogEntry.bulk_create_and_postprocess(log_entries)
-                Quota.objects.filter(pk__in=to_delete).delete()
-            messages.success(request, _('The selected quotas have been deleted or disabled.'))
-        return redirect(self.get_success_url())
-
-    def get_success_url(self) -> str:
-        return reverse('control:event.items.quotas', kwargs={
-            'organizer': self.request.event.organizer.slug,
-            'event': self.request.event.slug,
-        })
-
-
-class QuotaBulkUpdateView(QuotaQueryMixin, EventPermissionRequiredMixin, FormView):
-    template_name = 'pretixcontrol/items/quota_bulk_edit.html'
-    permission = 'event.items:write'
-    context_object_name = 'quota'
-    form_class = QuotaBulkEditForm
-
-    def get_queryset(self):
-        return super().get_queryset().prefetch_related(None).order_by()
-
-    def get(self, request, *args, **kwargs):
-        return HttpResponse(status=405)
-
-    @cached_property
-    def is_submitted(self):
-        # Usually, django considers a form "bound" / "submitted" on every POST request. However, this view is always
-        # called with POST method, even if just to pass the selection of objects to work on, so we want to modify
-        # that behaviour
-        return '_bulk' in self.request.POST
-
-    def get_form_kwargs(self):
-        initial = {}
-        mixed_values = set()
-        qs = self.get_queryset().annotate(
-            items_list=Subquery(
-                Quota.items.through.objects.filter(
-                    quota_id=OuterRef('pk'),
-                    item__variations__isnull=True,
-                ).order_by().values('quota_id').annotate(
-                    g=GroupConcat('item_id', separator=',', ordered=True)
-                ).values('g')
-            ),
-            vars_list=Subquery(
-                Quota.variations.through.objects.filter(
-                    quota_id=OuterRef('pk')
-                ).order_by().values('quota_id').annotate(
-                    g=GroupConcat(
-                        Concat(
-                            Cast(F('itemvariation__item_id'), output_field=models.TextField()),
-                            Value('-', output_field=models.TextField()),
-                            Cast(F('itemvariation_id'), output_field=models.TextField()),
-                        ),
-                        separator=',',
-                        ordered=True
-                    )
-                ).values('g')
-            ),
-        )
-
-        fields = {
-            'name': 'name',
-            'size': 'size',
-            'subevent': 'subevent',
-            'close_when_sold_out': 'close_when_sold_out',
-            'release_after_exit': 'release_after_exit',
-            'ignore_for_event_availability': 'ignore_for_event_availability',
-        }
-        for k, f in fields.items():
-            existing_values = list(qs.order_by(f).values(f).annotate(c=Count('*')))
-            if len(existing_values) == 1:
-                initial[k] = existing_values[0][f]
-            elif len(existing_values) > 1:
-                mixed_values.add(k)
-                initial[k] = None
-
-        item_values = list(qs.order_by("items_list").values("items_list").annotate(c=Count('*')))
-        var_values = list(qs.order_by("vars_list").values("vars_list").annotate(c=Count('*')))
-        if len(item_values) > 1 or len(var_values) > 1:
-            mixed_values.add("itemvars")
-        else:
-            initial["itemvars"] = [iv for iv in (item_values[0]["items_list"] or "").split(",") + (var_values[0]["vars_list"] or "").split(",") if iv]
-
-        kwargs = super().get_form_kwargs()
-        kwargs['event'] = self.request.event
-        kwargs['prefix'] = 'bulkedit'
-        kwargs['initial'] = initial
-        kwargs['queryset'] = self.get_queryset()
-        kwargs['mixed_values'] = mixed_values
-        if not self.is_submitted:
-            kwargs['data'] = None
-            kwargs['files'] = None
-        return kwargs
-
-    def get_success_url(self):
-        return reverse('control:event.items.quotas', kwargs={
-            'organizer': self.request.event.organizer.slug,
-            'event': self.request.event.slug,
-        })
-
-    @transaction.atomic()
-    def form_valid(self, form):
-        log_entries = []
-
-        # Main form
-        form.save()
-        data = {
-            k: v
-            for k, v in form.cleaned_data.items()
-            if k in form.changed_data
-        }
-        data['_raw_bulk_data'] = self.request.POST.dict()
-        for obj in self.get_queryset():
-            log_entries.append(
-                obj.log_action('pretix.event.quota.changed', data=data, user=self.request.user, save=False)
-            )
-
-        LogEntry.bulk_create_and_postprocess(log_entries)
-
-        messages.success(self.request, _('Your changes have been saved.'))
-        return super().form_valid(form)
-
-    def get_context_data(self, **kwargs):
-        ctx = super().get_context_data(**kwargs)
-        ctx['quotas'] = self.get_queryset()
-        ctx['bulk_selected'] = self.request.POST.getlist("_bulk")
-        return ctx
-
-    def post(self, request, *args, **kwargs):
-        form = self.get_form()
-        is_valid = (
-            self.is_submitted and
-            form.is_valid()
-        )
-        if is_valid:
-            return self.form_valid(form)
-        else:
-            if self.is_submitted:
-                messages.error(self.request, _('We could not save your changes. See below for details.'))
-            return self.form_invalid(form)
-
-
 class QuotaCreate(EventPermissionRequiredMixin, CreateView):
     model = Quota
     form_class = QuotaForm

src/pretix/control/views/orders.py

@@ -2059,12 +2059,13 @@ class OrderChange(OrderView):
                 else:
                     variation = None
                 try:
-                    ocm.add_position(item, variation,
-                                     f.cleaned_data['price'],
-                                     f.cleaned_data.get('addon_to'),
-                                     f.cleaned_data.get('subevent'),
-                                     f.cleaned_data.get('seat'),
-                                     f.cleaned_data.get('used_membership'))
+                    for i in range(f.cleaned_data.get("count", 1)):
+                        ocm.add_position(item, variation,
+                                         f.cleaned_data['price'],
+                                         f.cleaned_data.get('addon_to'),
+                                         f.cleaned_data.get('subevent'),
+                                         f.cleaned_data.get('seat'),
+                                         f.cleaned_data.get('used_membership'))
                 except OrderError as e:
                     f.custom_error = str(e)
                     return False

src/pretix/helpers/database.py

@@ -117,17 +117,12 @@ class GroupConcat(Aggregate):
             template = "%(function)s(%(distinct)s%(field)s::text, '%(separator)s' ORDER BY %(field)s::text ASC)"
         else:
             template = "%(function)s(%(distinct)s%(field)s::text, '%(separator)s')"
-
-        template, params = super().as_sql(
+        return super().as_sql(
             compiler, connection,
             function='string_agg',
             template=template,
             **extra_context,
         )
-        if self.ordered:
-            # ordered statement requires field parameters twice
-            params = params + params
-        return template, params
 
 
 class ReplicaRouter:

src/pretix/locale/de/wordlist.txt

@@ -32,6 +32,7 @@ ausgecheckt
 ausgeklappt
 auswahl
 Authentication
+Authenticator
 Authenticator-App
 Autorisierungscode
 Autorisierungs-Endpunktes
@@ -130,6 +131,7 @@ Eingangsscan
 Einlassbuchung
 Einlassdatum
 Einlasskontrolle
+Einmalpasswörter
 einzuchecken
 email
 E-Mail-Renderer
@@ -163,6 +165,7 @@ Explorer
 FA
 Favicon
 F-Droid
+freeOTP
 Footer
 Footer-Link
 Footer-Text
@@ -557,6 +560,7 @@ Zahlungs-ID
 Zahlungspflichtig
 Zehnerkarten
 Zeitbasiert
+zeitbasierte
 Zeitslotbuchung
 Zimpler
 ZIP-Datei

src/pretix/locale/de_Informal/wordlist.txt

@@ -32,6 +32,7 @@ ausgecheckt
 ausgeklappt
 auswahl
 Authentication
+Authenticator
 Authenticator-App
 Autorisierungscode
 Autorisierungs-Endpunktes
@@ -130,6 +131,7 @@ Eingangsscan
 Einlassbuchung
 Einlassdatum
 Einlasskontrolle
+Einmalpasswörter
 einzuchecken
 email
 E-Mail-Renderer
@@ -163,6 +165,7 @@ Explorer
 FA
 Favicon
 F-Droid
+freeOTP
 Footer
 Footer-Link
 Footer-Text
@@ -557,6 +560,7 @@ Zahlungs-ID
 Zahlungspflichtig
 Zehnerkarten
 Zeitbasiert
+zeitbasierte
 Zeitslotbuchung
 Zimpler
 ZIP-Datei

src/pretix/locale/djangojs.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-03-17 14:06+0000\n"
+"POT-Creation-Date: 2026-03-30 11:25+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

src/pretix/locale/es/LC_MESSAGES/djangojs.po

@@ -8,7 +8,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-03-17 14:06+0000\n"
-"PO-Revision-Date: 2026-03-18 12:23+0000\n"
+"PO-Revision-Date: 2026-03-30 03:00+0000\n"
 "Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
 "Language-Team: Spanish <https://translate.pretix.eu/projects/pretix/pretix-"
 "js/es/>\n"
@@ -329,7 +329,7 @@ msgstr "Pedido no aprobado"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:68
 msgid "Checked-in Tickets"
-msgstr "Registro de código QR"
+msgstr "Billetes registrados"
 
 #: pretix/plugins/webcheckin/static/pretixplugins/webcheckin/main.js:69
 msgid "Valid Tickets"

src/pretix/locale/wordlist.txt

@@ -12,6 +12,7 @@ anonymized
 Auth
 authentification
 authenticator
+Authenticator
 automatical
 availabilities
 backend
@@ -22,6 +23,7 @@ barcodes
 Bcc
 BCC
 BezahlCode
+biometric
 BLIK
 blocklist
 BN
@@ -56,6 +58,7 @@ EPS
 eps
 favicon
 filetype
+freeOTP
 frontend
 frontpage
 Galician

src/pretix/presale/forms/customer.py

@@ -28,7 +28,7 @@ from django import forms
 from django.conf import settings
 from django.contrib.auth.hashers import check_password
 from django.contrib.auth.password_validation import (
-    get_password_validators, password_validators_help_texts, validate_password,
+    MinimumLengthValidator, get_password_validators, validate_password,
 )
 from django.contrib.auth.tokens import PasswordResetTokenGenerator
 from django.core import signing
@@ -296,17 +296,17 @@ class SetPasswordForm(forms.Form):
     }
     email = forms.EmailField(
         label=_('Email'),
-        disabled=True
+        widget=forms.EmailInput(attrs={'autocomplete': 'username', 'readonly': 'readonly'}),
+        required=False,
     )
     password = forms.CharField(
         label=_('Password'),
-        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
         max_length=4096,
-        required=True
     )
     password_repeat = forms.CharField(
         label=_('Repeat password'),
-        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
         max_length=4096,
     )
 
@@ -316,6 +316,14 @@ class SetPasswordForm(forms.Form):
         kwargs['initial']['email'] = self.customer.email
         super().__init__(*args, **kwargs)
 
+        pw_min_len_validators = [v for v in get_customer_password_validators() if isinstance(v, MinimumLengthValidator)]
+        if pw_min_len_validators:
+            self.fields['password'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
+            self.fields['password_repeat'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
+
+        if 'password' not in self.data:
+            self.fields['password'].help_text = ' '.join(v.get_help_text() for v in pw_min_len_validators)
+
     def clean(self):
         password1 = self.cleaned_data.get('password', '')
         password2 = self.cleaned_data.get('password_repeat')
@@ -329,8 +337,7 @@ class SetPasswordForm(forms.Form):
 
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
-        if validate_password(password1, user=self.customer, password_validators=get_customer_password_validators()) is not None:
-            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
+        validate_password(password1, user=self.customer, password_validators=get_customer_password_validators())
         return password1
 
 
@@ -395,13 +402,13 @@ class ChangePasswordForm(forms.Form):
     )
     password = forms.CharField(
         label=_('New password'),
-        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
         max_length=4096,
         required=True
     )
     password_repeat = forms.CharField(
         label=_('Repeat password'),
-        widget=forms.PasswordInput(attrs={'minlength': '8', 'autocomplete': 'new-password'}),
+        widget=forms.PasswordInput(attrs={'autocomplete': 'new-password'}),
         max_length=4096,
     )
 
@@ -411,6 +418,14 @@ class ChangePasswordForm(forms.Form):
         kwargs['initial']['email'] = self.customer.email
         super().__init__(*args, **kwargs)
 
+        pw_min_len_validators = [v for v in get_customer_password_validators() if isinstance(v, MinimumLengthValidator)]
+        if pw_min_len_validators:
+            self.fields['password'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
+            self.fields['password_repeat'].widget.attrs['minlength'] = max(v.min_length for v in pw_min_len_validators)
+
+        if 'password' not in self.data:
+            self.fields['password'].help_text = ' '.join(v.get_help_text() for v in pw_min_len_validators)
+
     def clean(self):
         password1 = self.cleaned_data.get('password', '')
         password2 = self.cleaned_data.get('password_repeat')
@@ -424,8 +439,7 @@ class ChangePasswordForm(forms.Form):
 
     def clean_password(self):
         password1 = self.cleaned_data.get('password', '')
-        if validate_password(password1, user=self.customer, password_validators=get_customer_password_validators()) is not None:
-            raise forms.ValidationError(_(password_validators_help_texts()), code='pw_invalid')
+        validate_password(password1, user=self.customer, password_validators=get_customer_password_validators())
         return password1
 
     def clean_password_current(self):

src/pretix/presale/views/__init__.py

@@ -70,18 +70,21 @@ def cached_invoice_address(request):
             # do not create a session, if we don't have a session we also don't have an invoice address ;)
             request._checkout_flow_invoice_address = InvoiceAddress()
             return request._checkout_flow_invoice_address
-        cs = cart_session(request)
-        iapk = cs.get('invoice_address')
-        if not iapk:
+        cs = cart_session(request, create=False)
+        if cs is None:
             request._checkout_flow_invoice_address = InvoiceAddress()
         else:
-            try:
-                with scopes_disabled():
-                    request._checkout_flow_invoice_address = InvoiceAddress.objects.get(
-                        pk=iapk, order__isnull=True
-                    )
-            except InvoiceAddress.DoesNotExist:
+            iapk = cs.get('invoice_address')
+            if not iapk:
                 request._checkout_flow_invoice_address = InvoiceAddress()
+            else:
+                try:
+                    with scopes_disabled():
+                        request._checkout_flow_invoice_address = InvoiceAddress.objects.get(
+                            pk=iapk, order__isnull=True
+                        )
+                except InvoiceAddress.DoesNotExist:
+                    request._checkout_flow_invoice_address = InvoiceAddress()
     return request._checkout_flow_invoice_address
 
 
@@ -111,6 +114,12 @@ class CartMixin:
         return cached_invoice_address(self.request)
 
     def get_cart(self, answers=False, queryset=None, order=None, downloads=False, payments=None):
+        if not self.request.session.session_key and not order:
+            # The user has not even a session ID yet, so they can't have a cart and we can save a lot of work
+            return {
+                'positions': [],
+                # Other keys are not used on non-checkout pages
+            }
         if queryset is not None:
             prefetch = []
             if answers:
@@ -166,7 +175,8 @@ class CartMixin:
         else:
             fees = []
 
-        if not order:
+        if not order and lcp:
+            # Do not re-round for empty cart (useless) or confirmed order (incorrect)
             apply_rounding(self.request.event.settings.tax_rounding, self.invoice_address, self.request.event.currency, [*lcp, *fees])
 
         total = sum([c.price for c in lcp]) + sum([f.value for f in fees])
@@ -277,6 +287,12 @@ class CartMixin:
         }
 
     def current_selected_payments(self, positions, fees, invoice_address, *, warn=False):
+        from pretix.presale.views.cart import get_or_create_cart_id
+
+        if not get_or_create_cart_id(self.request, create=False):
+            # No active cart ID, no payments there
+            return []
+
         raw_payments = copy.deepcopy(self.cart_session.get('payments', []))
         fees = [f for f in fees if f.fee_type != OrderFee.FEE_TYPE_PAYMENT]  # we re-compute these here
 

src/pretix/presale/views/cart.py

@@ -417,7 +417,7 @@ def get_or_create_cart_id(request, create=True):
     return new_id
 
 
-def cart_session(request):
+def cart_session(request, create=True):
     """
     Before pretix 1.8.0, all checkout-related information (like the entered email address) was stored
     in the user's regular session dictionary. This led to data interference and leaks for example if a
@@ -428,7 +428,9 @@ def cart_session(request):
     active cart session sub-dictionary for read and write access.
     """
     request.session.modified = True
-    cart_id = get_or_create_cart_id(request)
+    cart_id = get_or_create_cart_id(request, create=create)
+    if not cart_id and not create:
+        return None
     return request.session['carts'][cart_id]
 
 

src/pretix/settings.py

@@ -157,7 +157,7 @@ DATABASES = {
         'HOST': config.get('database', 'host', fallback=''),
         'PORT': config.get('database', 'port', fallback=''),
         'CONN_MAX_AGE': 0 if db_backend == 'sqlite3' else 120,
-        'CONN_HEALTH_CHECKS': db_backend != 'sqlite3',  # Will only be used from Django 4.1 onwards
+        'CONN_HEALTH_CHECKS': db_backend != 'sqlite3',
         'DISABLE_SERVER_SIDE_CURSORS': db_disable_server_side_cursors,
         'OPTIONS': db_options,
         'TEST': {}
@@ -179,6 +179,21 @@ if config.has_section('replica'):
     }
     DATABASE_ROUTERS = ['pretix.helpers.database.ReplicaRouter']
 
+if config.has_section('dbreadonly'):
+    DATABASES['readonly'] = {
+        'ENGINE': 'django.db.backends.' + db_backend,
+        'NAME': config.get('dbreadonly', 'name', fallback=DATABASES['default']['NAME']),
+        'USER': config.get('dbreadonly', 'user', fallback=DATABASES['default']['USER']),
+        'PASSWORD': config.get('dbreadonly', 'password', fallback=DATABASES['default']['PASSWORD']),
+        'HOST': config.get('dbreadonly', 'host', fallback=DATABASES['default']['HOST']),
+        'PORT': config.get('dbreadonly', 'port', fallback=DATABASES['default']['PORT']),
+        'CONN_MAX_AGE': 0,  # do not spam primary with open connections as long as readonly is only used occasionally
+        'CONN_HEALTH_CHECKS': db_backend != 'sqlite3',
+        'DISABLE_SERVER_SIDE_CURSORS': db_disable_server_side_cursors,
+        'OPTIONS': db_options,
+        'TEST': {}
+    }
+
 STATIC_URL = config.get('urls', 'static', fallback='/static/')
 
 MEDIA_URL = config.get('urls', 'media', fallback='/media/')

src/tests/api/test_orders.py

@@ -2053,7 +2053,7 @@ def test_pdf_data(token_client, organizer, event, order, django_assert_max_num_q
     assert not resp.data['positions'][0].get('pdf_data')
 
     # order list
-    with django_assert_max_num_queries(33):
+    with django_assert_max_num_queries(34):
         resp = token_client.get('/api/v1/organizers/{}/events/{}/orders/?pdf_data=true'.format(
             organizer.slug, event.slug
         ))
@@ -2068,7 +2068,7 @@ def test_pdf_data(token_client, organizer, event, order, django_assert_max_num_q
     assert not resp.data['results'][0]['positions'][0].get('pdf_data')
 
     # position list
-    with django_assert_max_num_queries(35):
+    with django_assert_max_num_queries(36):
         resp = token_client.get('/api/v1/organizers/{}/events/{}/orderpositions/?pdf_data=true'.format(
             organizer.slug, event.slug
         ))

src/tests/base/test_orders.py

@@ -2406,6 +2406,15 @@ class OrderChangeManagerTests(TestCase):
             self.ocm.commit()
         assert self.order.positions.count() == 2
 
+    @classscope(attr='o')
+    def test_add_item_quota_partial(self):
+        q1 = self.event.quotas.create(name='Test', size=1)
+        q1.items.add(self.shirt)
+        self.ocm.add_position(self.shirt, None, None, None, count=2)
+        with self.assertRaises(OrderError):
+            self.ocm.commit()
+        assert self.order.positions.count() == 2
+
     @classscope(attr='o')
     def test_add_item_addon(self):
         self.shirt.category = self.event.categories.create(name='Add-ons', is_addon=True)

src/tests/control/test_orders.py

@@ -1584,10 +1584,11 @@ class OrderChangeTests(SoupTest):
             'add_position-MAX_NUM_FORMS': '100',
             'add_position-0-itemvar': str(self.shirt.pk),
             'add_position-0-do': 'on',
+            'add_position-0-count': '2',
             'add_position-0-price': '14.00',
         })
         with scopes_disabled():
-            assert self.order.positions.count() == 3
+            assert self.order.positions.count() == 4
             assert self.order.positions.last().item == self.shirt
             assert self.order.positions.last().price == 14
 

src/tests/presale/test_event.py

@@ -36,6 +36,7 @@
 import datetime
 import re
 from decimal import Decimal
+from importlib import import_module
 from json import loads
 from zoneinfo import ZoneInfo
 
@@ -80,6 +81,34 @@ class EventMiddlewareTest(EventTestMixin, SoupTest):
         doc = self.get_doc('/%s/%s/' % (self.orga.slug, self.event.slug))
         self.assertIn(str(self.event.name), doc.find("h1").text)
 
+    def test_no_session_cookie_set_on_event_index_view(self):
+        resp = self.client.get('/%s/%s/' % (self.orga.slug, self.event.slug))
+        self.assertEqual(resp.status_code, 200)
+        assert settings.SESSION_COOKIE_NAME not in self.client.cookies
+
+    def test_no_cart_session_added_on_event_index_view(self):
+        # Make sure a session is present by doing a cart op on another event
+        event2 = Event.objects.create(
+            organizer=self.orga, name='30C3b', slug='30c3b',
+            date_from=datetime.datetime(now().year + 1, 12, 26, 14, 0, tzinfo=datetime.timezone.utc),
+            live=True,
+        )
+        self.client.post('/%s/%s/cart/add' % (self.orga.slug, event2.slug), {
+            'item_%d' % 1337: '1',  # item does not need to exist
+            'ajax': 1
+        })
+        assert settings.SESSION_COOKIE_NAME in self.client.cookies
+
+        # Visit shop, make sure no session is created
+        resp = self.client.get('/%s/%s/' % (self.orga.slug, self.event.slug))
+        self.assertEqual(resp.status_code, 200)
+
+        SessionStore = import_module(settings.SESSION_ENGINE).SessionStore
+        session = SessionStore(self.client.cookies[settings.SESSION_COOKIE_NAME].value).load()
+        assert set(session.keys()) == {
+            f"current_cart_event_{event2.pk}", "carts"
+        }
+
     def test_not_found(self):
         resp = self.client.get('/%s/%s/' % ('foo', 'bar'))
         self.assertEqual(resp.status_code, 404)