Use JSON encoding for data-replace-with-qr

doc/api/resources/checkin.rst

@@ -71,8 +71,6 @@ Checking a ticket in
    :>json object questions: List of questions to be answered for check-in, only set on status ``"incomplete"``.
    :>json object media_policy: Reusable media policy (see documentation on items), only set on status ``"exchange"``.
    :>json object media_type: Reusable media type (see documentation on items), only set on status ``"exchange"``.
-   :>json boolean simulate: Do not actually perform the check-in, only simulate the response. The ``position`` response
-                            object will not reflect the simulated changes.
 
    **Example request**:
 

pyproject.toml

@@ -53,8 +53,7 @@ dependencies = [
   "django-oauth-toolkit==2.3.*",
   "django-otp==1.7.*",
   "django-phonenumber-field==8.4.*",
-  "django-querytagger==0.0.3",
-  "django-redis==7.0.*",
+  "django-redis==6.0.*",
   "django-scopes==2.0.*",
   "django-statici18n==2.7.*",
   "djangorestframework==3.17.*",
@@ -77,7 +76,7 @@ dependencies = [
   "paypal-checkout-serversdk==1.0.*",
   "PyJWT==2.13.*",
   "phonenumberslite==9.0.*",
-  "Pillow==12.3.*",
+  "Pillow==12.2.*",
   "pretix-plugin-build",
   "protobuf==7.35.*",
   "psycopg2-binary",
@@ -92,9 +91,9 @@ dependencies = [
   "pyuca",
   "qrcode==8.2",
   "redis==7.4.*",
-  "reportlab==5.0.*",
-  "requests==2.34.*",
-  "sentry-sdk==2.64.*",
+  "reportlab==4.5.*",
+  "requests==2.32.*",
+  "sentry-sdk==2.63.*",
   "sepaxml==2.7.*",
   "stripe==7.9.*",
   "text-unidecode==1.*",
@@ -102,7 +101,7 @@ dependencies = [
   "tqdm==4.*",
   "ua-parser==1.0.*",
   "vobject==0.9.*",
-  "webauthn==3.0.*",
+  "webauthn==2.8.*",
   "zeep==4.3.*"
 ]
 

src/Makefile

@@ -6,8 +6,8 @@ localecompile:
 	./manage.py compilemessages
 
 localegen:
-	./manage.py makemessages --keep-pot --add-location file --ignore "pretix/static/npm_dir/*" $(LNGS)
-	./manage.py makemessages --keep-pot --add-location file -e js,ts,vue -d djangojs --ignore "pretix/static/npm_dir/*" --ignore "pretix/helpers/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static.dist/*" --ignore "data/*" --ignore "pretix/static/rrule/*" --ignore "build/*" $(LNGS)
+	./manage.py makemessages --keep-pot --ignore "pretix/static/npm_dir/*" $(LNGS)
+	./manage.py makemessages --keep-pot -e js,ts,vue -d djangojs --ignore "pretix/static/npm_dir/*" --ignore "pretix/helpers/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static/jsi18n/*" --ignore "pretix/static.dist/*" --ignore "data/*" --ignore "pretix/static/rrule/*" --ignore "build/*" $(LNGS)
 
 staticfiles: npminstall npmbuild jsi18n
 	./manage.py collectstatic --noinput

src/pretix/__init__.py

@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.7.0.dev0"
+__version__ = "2026.6.0.dev0"

src/pretix/_base_settings.py

@@ -118,7 +118,6 @@ ALL_LANGUAGES = [
     ('sv', _('Swedish')),
     ('es', _('Spanish')),
     ('es-419', _('Spanish (Latin America)')),
-    ('th', _('Thai')),
     ('tr', _('Turkish')),
     ('uk', _('Ukrainian')),
 ]

src/pretix/api/serializers/checkin.py

@@ -90,7 +90,6 @@ class CheckinRPCRedeemInputSerializer(serializers.Serializer):
     answers = serializers.JSONField(required=False, allow_null=True)
     exchange_medium_type = serializers.ChoiceField(required=False, choices=MEDIA_TYPES)
     exchange_medium_identifier = serializers.CharField(required=False)
-    simulate = serializers.BooleanField(default=False, required=False)
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)

src/pretix/api/serializers/event.py

@@ -747,7 +747,6 @@ class EventSettingsSerializer(SettingsSerializer):
         'max_items_per_order',
         'reservation_time',
         'contact_mail',
-        'contact_url',
         'show_variations_expanded',
         'hide_sold_out',
         'meta_noindex',

src/pretix/api/serializers/organizer.py

@@ -27,7 +27,7 @@ from django.core.exceptions import ObjectDoesNotExist
 from django.db import transaction
 from django.db.models import Q
 from django.utils.crypto import get_random_string
-from django.utils.translation import gettext, gettext_lazy as _
+from django.utils.translation import gettext_lazy as _
 from rest_framework import serializers
 from rest_framework.exceptions import ValidationError
 
@@ -492,9 +492,7 @@ class TeamInviteSerializer(serializers.ModelSerializer):
     def _send_invite(self, instance):
         mail(
             instance.email,
-            gettext('You\'ve been invited to join %(organizer)s') % {
-                'organizer': self.context['organizer'].name,
-            },
+            _('Account invitation'),
             'pretixcontrol/email/invitation.txt',
             {
                 'instance': settings.PRETIX_INSTANCE_NAME,
@@ -576,7 +574,6 @@ class OrganizerSettingsSerializer(SettingsSerializer):
         'customer_accounts_require_login_for_order_access',
         'invoice_regenerate_allowed',
         'contact_mail',
-        'contact_url',
         'imprint_url',
         'organizer_info_text',
         'event_list_type',

src/pretix/api/views/checkin.py

@@ -837,11 +837,6 @@ def _redeem_process(*, checkinlists, raw_barcode, answers_data, datetime, force,
             )
 
             if exchange_medium_identifier:  # other fields are filled, see CheckinRPCRedeemInputSerializer.validate
-                if simulate:
-                    raise CheckInError(
-                        gettext('You cannot simulate a medium exchange.'),
-                        'error'
-                    )
                 with transaction.atomic():
                     # Do exchange and check-in atomically, i.e. both succeed or both fail
                     medium = perform_media_exchange(
@@ -1069,7 +1064,6 @@ class CheckinRPCRedeemView(views.APIView):
             legacy_url_support=False,
             exchange_medium_type=s.validated_data.get('exchange_medium_type'),
             exchange_medium_identifier=s.validated_data.get('exchange_medium_identifier'),
-            simulate=s.validated_data.get('simulate'),
         )
 
 

src/pretix/base/forms/questions.py

@@ -53,7 +53,6 @@ from django.db.models import QuerySet
 from django.forms import Select, widgets
 from django.forms.widgets import FILE_INPUT_CONTRADICTION
 from django.utils.formats import date_format
-from django.utils.functional import lazy
 from django.utils.html import escape
 from django.utils.safestring import mark_safe
 from django.utils.text import format_lazy
@@ -325,21 +324,16 @@ class WrappedPhonePrefixSelect(Select):
     initial = None
 
     def __init__(self, initial=None):
-        def _get_choices():
-            choices = [("", "---------")]
-
-            if initial:
-                for prefix, values in COUNTRY_CODE_TO_REGION_CODE.items():
-                    if all(v == REGION_CODE_FOR_NON_GEO_ENTITY for v in values):
-                        continue
-                    if initial in values:
-                        self.initial = "+%d" % prefix
-                        break
-            choices += get_phone_prefixes_sorted_and_localized()
-            return choices
-
-        choices = lazy(_get_choices, list)()
+        choices = [("", "---------")]
 
+        if initial:
+            for prefix, values in COUNTRY_CODE_TO_REGION_CODE.items():
+                if all(v == REGION_CODE_FOR_NON_GEO_ENTITY for v in values):
+                    continue
+                if initial in values:
+                    self.initial = "+%d" % prefix
+                    break
+        choices += get_phone_prefixes_sorted_and_localized()
         super().__init__(choices=choices, attrs={
             'aria-label': pgettext_lazy('phonenumber', 'International area code'),
             'autocomplete': 'tel-country-code',
@@ -1404,7 +1398,7 @@ class BaseInvoiceAddressForm(forms.ModelForm):
         elif self.validate_vat_id and vat_id_applicable:
             try:
                 normalized_id = validate_vat_id(data.get('vat_id'), str(data.get('country')))
-                self.instance.vat_id_validated = bool(normalized_id)
+                self.instance.vat_id_validated = True
                 self.instance.vat_id = data['vat_id'] = normalized_id
             except VATIDFinalError as e:
                 if self.all_optional:

src/pretix/base/management/commands/noop.py

@@ -1,29 +0,0 @@
-#
-# This file is part of pretix (Community Edition).
-#
-# Copyright (C) 2014-2020  Raphael Michel and contributors
-# Copyright (C) 2020-today pretix GmbH and contributors
-#
-# This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
-# Public License as published by the Free Software Foundation in version 3 of the License.
-#
-# ADDITIONAL TERMS APPLY: Pursuant to Section 7 of the GNU Affero General Public License, additional terms are
-# applicable granting you additional permissions and placing additional restrictions on your usage of this software.
-# Please refer to the pretix LICENSE file to obtain the full terms applicable to this work. If you did not receive
-# this file, see <https://pretix.eu/about/en/license>.
-#
-# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
-# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
-# details.
-#
-# You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
-# <https://www.gnu.org/licenses/>.
-#
-from django.core.management.base import BaseCommand
-
-
-class Command(BaseCommand):
-    help = "Do nothing. Useful for startup performance testing."
-
-    def handle(self, *args, **options):
-        pass

src/pretix/base/management/commands/runperiodic.py

@@ -40,7 +40,6 @@ from django.core.cache import cache
 from django.core.management.base import BaseCommand
 from django.db import close_old_connections
 from django.dispatch.dispatcher import NO_RECEIVERS
-from django_querytagger.tagging import with_tag
 
 from pretix.helpers.periodic import SKIPPED
 
@@ -83,8 +82,7 @@ class Command(BaseCommand):
             try:
                 # Check if the DB connection is still good, it might be closed if the previous task took too long.
                 close_old_connections()
-                with with_tag(f"periodictask={name}"):
-                    r = receiver(signal=periodic_task, sender=self)
+                r = receiver(signal=periodic_task, sender=self)
             except Exception as err:
                 if isinstance(err, KeyboardInterrupt):
                     raise err

src/pretix/base/middleware.py

@@ -19,8 +19,6 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import logging
-import re
 from collections import OrderedDict
 from urllib.parse import urlparse, urlsplit
 from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
@@ -45,8 +43,6 @@ from pretix.multidomain.urlreverse import (
 )
 from pretix.presale.style import get_fonts
 
-logger = logging.getLogger(__name__)
-
 _supported = None
 
 
@@ -227,26 +223,7 @@ def _parse_csp(header):
     return h
 
 
-VALID_CSP_DIRECTIVES = [
-    "child-src", "connect-src", "default-src", "fenced-frame-src", "font-src", "form-action", "frame-src", "img-src",
-    "manifest-src", "media-src", "object-src", "prefetch-src", "report-uri", "script-src", "script-src-elem",
-    "script-src-attr", "style-src", "style-src-elem", "style-src-attr", "worker-src",
-]
-
-CSP_ILLEGAL_CHARS = re.compile(r'[\s,;]')
-
-
-def _sanitize_csp(h):
-    for k, v in h.items():
-        if k not in VALID_CSP_DIRECTIVES:
-            raise ValueError("Invalid CSP directive " + k)
-        if any(CSP_ILLEGAL_CHARS.search(el) for el in v):
-            logger.warning("Stripping invalid component from CSP: %r", h)
-            h[k] = [el for el in v if not CSP_ILLEGAL_CHARS.search(el)]
-
-
 def _render_csp(h):
-    _sanitize_csp(h)
     return "; ".join(k + ' ' + ' '.join(v) for k, v in h.items() if v)
 
 
@@ -266,7 +243,21 @@ def _merge_csp(a, b):
 
 
 class SecurityMiddleware(MiddlewareMixin):
+    CSP_EXEMPT = (
+        '/api/v1/docs/',
+    )
+
     def process_response(self, request, resp):
+        def nested_dict_values(d):
+            for v in d.values():
+                if isinstance(v, dict):
+                    yield from nested_dict_values(v)
+                else:
+                    if isinstance(v, str):
+                        yield v
+
+        url = resolve(request.path_info)
+
         if settings.DEBUG and resp.status_code >= 400:
             # Don't use CSP on debug error page as it breaks of Django's fancy error
             # pages
@@ -277,15 +268,18 @@ class SecurityMiddleware(MiddlewareMixin):
         # https://github.com/pretix/pretix/issues/765
         resp['P3P'] = 'CP=\"ALL DSP COR CUR ADM TAI OUR IND COM NAV INT\"'
 
-        if not getattr(resp, '_csp_ignore', False):
-            resp['Content-Security-Policy'] = _render_csp(self._build_csp(request, resp))
-        elif 'Content-Security-Policy' in resp:
-            del resp['Content-Security-Policy']
+        img_src = []
+        gs = global_settings_object(request)
+        if gs.settings.leaflet_tiles:
+            img_src.append(gs.settings.leaflet_tiles[:gs.settings.leaflet_tiles.index("/", 10)].replace("{s}", "*"))
 
-        return resp
-
-    def _build_csp(self, request, resp):
-        url = resolve(request.path_info)
+        font_src = set()
+        if hasattr(request, 'event'):
+            for font in get_fonts(request.event, pdf_support_required=False).values():
+                for path in list(nested_dict_values(font)):
+                    font_location = urlparse(path)
+                    if font_location.scheme and font_location.netloc:
+                        font_src.add('{}://{}'.format(font_location.scheme, font_location.netloc))
 
         h = {
             'default-src': ["{static}"],
@@ -294,8 +288,8 @@ class SecurityMiddleware(MiddlewareMixin):
             'frame-src': ['{static}'],
             'style-src': ["{static}", "{media}"],
             'connect-src': ["{dynamic}", "{media}"],
-            'img-src': ["{static}", "{media}", "data:"],
-            'font-src': ["{static}"],
+            'img-src': ["{static}", "{media}", "data:"] + img_src,
+            'font-src': ["{static}"] + list(font_src),
             'media-src': ["{static}", "data:"],
             # form-action is not only used to match on form actions, but also on URLs
             # form-actions redirect to. In the context of e.g. payment providers or
@@ -304,13 +298,6 @@ class SecurityMiddleware(MiddlewareMixin):
             'form-action': ["{dynamic}", "https:"] + (['http:'] if settings.SITE_URL.startswith('http://') else []),
         }
 
-        gs = global_settings_object(request)
-        if gs.settings.leaflet_tiles:
-            h['img-src'].append(gs.settings.leaflet_tiles[:gs.settings.leaflet_tiles.index("/", 10)].replace("{s}", "*"))
-
-        if hasattr(request, 'event'):
-            h['font-src'] += list(self._get_font_origins(request.event))
-
         if settings.VITE_DEV_MODE:
             h['script-src'] += ["http://localhost:5173", "ws://localhost:5173"]
             h['style-src'] += ["'unsafe-inline'"]
@@ -322,7 +309,6 @@ class SecurityMiddleware(MiddlewareMixin):
             if not settings.VITE_DEV_MODE:
                 # can't have 'unsafe-inline' and nonce at the same time
                 h['style-src'].append(nonce)
-
         # Only include pay.google.com for wallet detection purposes on the Payment selection page
         if (
                 url.url_name == "event.order.pay.change" or
@@ -331,32 +317,27 @@ class SecurityMiddleware(MiddlewareMixin):
             h['script-src'].append('https://pay.google.com')
             h['frame-src'].append('https://pay.google.com')
             h['connect-src'].append('https://google.com/pay')
-
         if settings.LOG_CSP:
             h['report-uri'] = ["/csp_report/"]
-
         if 'Content-Security-Policy' in resp:
             _merge_csp(h, _parse_csp(resp['Content-Security-Policy']))
-
         if settings.CSP_ADDITIONAL_HEADER:
             _merge_csp(h, _parse_csp(settings.CSP_ADDITIONAL_HEADER))
 
-        placeholders = {
-            "{static}": ["'self'"],
-            "{dynamic}": ["'self'"],
-            "{media}": ["'self'"],
-        }
+        staticdomain = "'self'"
+        dynamicdomain = "'self'"
+        mediadomain = "'self'"
         if settings.MEDIA_URL.startswith('http'):
-            placeholders["{media}"].append(settings.MEDIA_URL[:settings.MEDIA_URL.find('/', 9)])
+            mediadomain += " " + settings.MEDIA_URL[:settings.MEDIA_URL.find('/', 9)]
         if settings.STATIC_URL.startswith('http'):
-            placeholders["{static}"].append(settings.STATIC_URL[:settings.STATIC_URL.find('/', 9)])
+            staticdomain += " " + settings.STATIC_URL[:settings.STATIC_URL.find('/', 9)]
         if settings.SITE_URL.startswith('http'):
             if settings.SITE_URL.find('/', 9) > 0:
-                placeholders["{static}"].append(settings.SITE_URL[:settings.SITE_URL.find('/', 9)])
-                placeholders["{dynamic}"].append(settings.SITE_URL[:settings.SITE_URL.find('/', 9)])
+                staticdomain += " " + settings.SITE_URL[:settings.SITE_URL.find('/', 9)]
+                dynamicdomain += " " + settings.SITE_URL[:settings.SITE_URL.find('/', 9)]
             else:
-                placeholders["{static}"].append(settings.SITE_URL)
-                placeholders["{dynamic}"].append(settings.SITE_URL)
+                staticdomain += " " + settings.SITE_URL
+                dynamicdomain += " " + settings.SITE_URL
 
         if hasattr(request, 'organizer') and request.organizer:
             if hasattr(request, 'event') and request.event:
@@ -367,29 +348,18 @@ class SecurityMiddleware(MiddlewareMixin):
                 siteurlsplit = urlsplit(settings.SITE_URL)
                 if siteurlsplit.port and siteurlsplit.port not in (80, 443):
                     domain = '%s:%d' % (domain, siteurlsplit.port)
-                placeholders["{dynamic}"].append(domain)
+                dynamicdomain += " " + domain
 
-        for k, v in h.items():
-            h[k] = sorted(set(result for part in v for result in placeholders.get(part, [part])))
+        if request.path not in self.CSP_EXEMPT and not getattr(resp, '_csp_ignore', False):
+            resp['Content-Security-Policy'] = _render_csp(h).format(static=staticdomain, dynamic=dynamicdomain,
+                                                                    media=mediadomain)
+            for k, v in h.items():
+                h[k] = sorted(set(' '.join(v).format(static=staticdomain, dynamic=dynamicdomain, media=mediadomain).split(' ')))
+            resp['Content-Security-Policy'] = _render_csp(h)
+        elif 'Content-Security-Policy' in resp:
+            del resp['Content-Security-Policy']
 
-        return h
-
-    def _get_font_origins(self, event):
-        def nested_dict_values(d):
-            for v in d.values():
-                if isinstance(v, dict):
-                    yield from nested_dict_values(v)
-                else:
-                    if isinstance(v, str):
-                        yield v
-
-        font_src = set()
-        for font in get_fonts(event, pdf_support_required=False).values():
-            for path in list(nested_dict_values(font)):
-                font_location = urlparse(path)
-                if font_location.scheme and font_location.netloc:
-                    font_src.add('{}://{}'.format(font_location.scheme, font_location.netloc))
-        return font_src
+        return resp
 
 
 class RejectInvalidInputMiddleware(MiddlewareMixin):

src/pretix/base/models/auth.py

@@ -373,7 +373,7 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
 
         mail(
             email or self.email,
-            _('Changes to your account'),
+            _('Account information changed'),
             'pretixcontrol/email/security_notice.txt',
             {
                 'user': self,
@@ -400,13 +400,12 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
 
         with language(self.locale):
             if reason == 'email_change':
-                msg = str(_('To change your email address from {old_email} to {new_email}, use the following code:').format(
+                msg = str(_('to confirm changing your email address from {old_email}\nto {new_email}, use the following code:').format(
                     old_email=self.email, new_email=email,
                 ))
             elif reason == 'email_verify':
-                msg = str(_('To verify your email address {email} on {instance}, use the following code:').format(
+                msg = str(_('to confirm that your email address {email} belongs to your pretix account, use the following code:').format(
                     email=self.email,
-                    instance=settings.PRETIX_INSTANCE_NAME,
                 ))
             else:
                 raise Exception('Invalid confirmation code reason')
@@ -419,7 +418,7 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
         }
         mail(
             email or self.email,
-            _('Your confirmation code'),
+            _('pretix confirmation code'),
             'pretixcontrol/email/confirmation_code.txt',
             {
                 'user': self,
@@ -463,9 +462,7 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
         from pretix.base.services.mail import mail
 
         mail(
-            self.email,
-            _('Reset your password'),
-            'pretixcontrol/email/forgot.txt',
+            self.email, _('Password recovery'), 'pretixcontrol/email/forgot.txt',
             {
                 'instance': settings.PRETIX_INSTANCE_NAME,
                 'user': self,
@@ -650,22 +647,25 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
             id__in=self.teams.filter(TeamQuerySet.organizer_permission_q(permission)).values_list('organizer', flat=True)
         )
 
-    def has_active_staff_session(self, session_key):
+    def has_active_staff_session(self, session_key=None):
         """
         Returns whether or not a user has an active staff session (formerly known as superuser session)
         with the given session key.
         """
         return self.get_active_staff_session(session_key) is not None
 
-    def get_active_staff_session(self, session_key):
-        if not self.is_staff or not session_key:
+    def get_active_staff_session(self, session_key=None):
+        if not self.is_staff:
             return None
         if not hasattr(self, '_staff_session_cache'):
             self._staff_session_cache = {}
         if session_key not in self._staff_session_cache:
-            sess = StaffSession.objects.filter(
-                user=self, date_end__isnull=True, session_key=session_key
-            ).first()
+            qs = StaffSession.objects.filter(
+                user=self, date_end__isnull=True
+            )
+            if session_key:
+                qs = qs.filter(session_key=session_key)
+            sess = qs.first()
             if sess:
                 if sess.date_start < now() - timedelta(seconds=settings.PRETIX_SESSION_TIMEOUT_ABSOLUTE):
                     sess.date_end = now()

src/pretix/base/models/event.py

@@ -40,7 +40,6 @@ import warnings
 from collections import Counter, OrderedDict, defaultdict
 from datetime import datetime, time, timedelta
 from operator import attrgetter
-from typing import TYPE_CHECKING
 from urllib.parse import urljoin
 from zoneinfo import ZoneInfo
 
@@ -80,16 +79,10 @@ from pretix.helpers.thumb import get_thumbnail
 from ..settings import settings_hierarkey
 from .organizer import Organizer, Team
 
-if TYPE_CHECKING:
-    from hierarkey.proxy import HierarkeyProxy
-
 logger = logging.getLogger(__name__)
 
 
 class EventMixin:
-    if TYPE_CHECKING:
-        settings: HierarkeyProxy
-
     def clean(self):
         if self.presale_start and self.presale_end and self.presale_start > self.presale_end:
             raise ValidationError({'presale_end': _('The end of the presale period has to be later than its start.')})
@@ -906,7 +899,7 @@ class Event(EventMixin, LoggedModel):
         self.save()
         self.log_action('pretix.object.cloned', data={'source': other.slug, 'source_id': other.pk})
 
-        if hasattr(other, 'alternative_domain_assignment') and not is_cross_organizer:
+        if hasattr(other, 'alternative_domain_assignment'):
             other.alternative_domain_assignment.domain.event_assignments.create(event=self)
 
         if not self.all_sales_channels:

src/pretix/base/models/organizer.py

@@ -35,7 +35,6 @@ import operator
 import string
 from datetime import date, datetime, time
 from functools import reduce
-from typing import TYPE_CHECKING
 
 import pytz_deprecation_shim
 from django.conf import settings
@@ -62,9 +61,6 @@ from ...helpers.permission_migration import (
 from ..settings import settings_hierarkey
 from .auth import User
 
-if TYPE_CHECKING:
-    from hierarkey.proxy import HierarkeyProxy
-
 
 @settings_hierarkey.add(cache_namespace='organizer')
 class Organizer(LoggedModel):
@@ -82,9 +78,6 @@ class Organizer(LoggedModel):
     """
 
     settings_namespace = 'organizer'
-    if TYPE_CHECKING:
-        settings: HierarkeyProxy
-
     name = models.CharField(max_length=200,
                             verbose_name=_("Name"))
     slug = models.CharField(

src/pretix/base/payment.py

@@ -834,7 +834,7 @@ class BasePaymentProvider:
         """
         raise NotImplementedError()  # NOQA
 
-    def execute_payment(self, request: HttpRequest, payment: OrderPayment) -> str | None:
+    def execute_payment(self, request: HttpRequest, payment: OrderPayment) -> str:
         """
         After the user has confirmed their purchase, this method will be called to complete
         the payment process. This is the place to actually move the money if applicable.
@@ -936,7 +936,7 @@ class BasePaymentProvider:
         """
         Will be called if the *event administrator* views the details of a payment.
 
-        It should return HTML code containing information regarding the current payment
+        It should return a SafeString containing HTML code, with information regarding the current payment
         status and, if applicable, next steps.
 
         The default implementation returns an empty string.
@@ -961,7 +961,7 @@ class BasePaymentProvider:
         """
         Will be called if the *event administrator* views the details of a refund.
 
-        It should return HTML code containing information regarding the current refund
+        It should return a SafeString containing HTML code, with information regarding the current refund
         status and, if applicable, next steps.
 
         The default implementation returns an empty string.

src/pretix/base/pdf.py

@@ -77,7 +77,6 @@ from reportlab.platypus import Paragraph
 
 from pretix.base.i18n import language
 from pretix.base.models import Checkin, Event, Order, OrderPosition, Question
-from pretix.base.services.placeholders import PlaceholderContext
 from pretix.base.settings import PERSON_NAME_SCHEMES
 from pretix.base.signals import layout_image_variables, layout_text_variables
 from pretix.base.templatetags.money import money_filter
@@ -402,7 +401,11 @@ DEFAULT_VARIABLES = OrderedDict((
         "editor_sample": _("Event organizer info text"),
         "evaluate": lambda op, order, ev: str(order.event.settings.organizer_info_text)
     }),
-    ("event_info_text", {}),  # Placeholder to "reserve" position, defined later in `get_variables`
+    ("event_info_text", {
+        "label": _("Event info text"),
+        "editor_sample": _("Event info text"),
+        "evaluate": lambda op, order, ev: str(order.event.settings.event_info_text)
+    }),
     ("now_date", {
         "label": _("Printing date"),
         "editor_sample": _("2017-05-31"),
@@ -667,14 +670,6 @@ def get_images(event):
 def get_variables(event):
     v = copy.copy(DEFAULT_VARIABLES)
 
-    templating_context = PlaceholderContext(event=event)
-    v['event_info_text'] = {
-        "label": _("Event info text"),
-        "editor_sample": _("Event info text"),
-        "evaluate": lambda op, order, ev:
-            templating_context.format(str(order.event.settings.event_info_text))
-    }
-
     scheme = PERSON_NAME_SCHEMES[event.settings.name_scheme]
 
     concatenation_for_salutation = scheme.get("concatenation_for_salutation", scheme["concatenation"])

src/pretix/base/services/cancelevent.py

@@ -22,7 +22,6 @@
 import logging
 from decimal import Decimal
 
-from django.conf import settings
 from django.db import transaction
 from django.db.models import Count, Exists, IntegerField, OuterRef, Q, Subquery
 from django.utils.crypto import get_random_string
@@ -378,13 +377,12 @@ def cancel_event(self, event: Event, subevent: int, auto_refund: bool,
         confirmation_code = get_random_string(8, allowed_chars="01234567890")
         mail(
             user.email,
-            subject=gettext('Confirm event cancellation and bulk refund'),
+            subject=gettext('Bulk-refund confirmation'),
             template='pretixbase/email/cancel_confirm.txt',
             context={
                 "event": str(event),
                 "amount": money_filter(refund_total, event.currency),
                 "confirmation_code": confirmation_code,
-                "instance": settings.PRETIX_INSTANCE_NAME,
             },
             locale=user.locale,
         )

src/pretix/base/services/checkin.py

@@ -40,7 +40,7 @@ import dateutil
 import dateutil.parser
 from dateutil.tz import datetime_exists
 from django.core.files import File
-from django.db import IntegrityError
+from django.db import IntegrityError, transaction
 from django.db.models import (
     BooleanField, Case, Count, ExpressionWrapper, F, IntegerField, Max, Min,
     OuterRef, Q, Subquery, TextField, Value, When,
@@ -59,7 +59,6 @@ from pretix.base.models import (
 )
 from pretix.base.signals import checkin_created, periodic_task
 from pretix.helpers import OF_SELF
-from pretix.helpers.database import conditional_atomic
 from pretix.helpers.jsonlogic import Logic
 from pretix.helpers.jsonlogic_boolalg import convert_to_dnf
 from pretix.helpers.jsonlogic_query import (
@@ -1044,10 +1043,10 @@ def perform_checkin(op: OrderPosition, clist: CheckinList, given_answers: dict,
         if not simulate:
             _save_answers(op, answers, given_answers)
 
-    with conditional_atomic(not simulate):
+    with transaction.atomic():
         # Lock order positions, if it is an entry. We don't need it for exits, as a race condition wouldn't be problematic
         opqs = OrderPosition.all.select_related("order", "item")
-        if type != Checkin.TYPE_EXIT and not simulate:
+        if type != Checkin.TYPE_EXIT:
             opqs = opqs.select_for_update(of=OF_SELF)
         op = opqs.get(pk=op.pk)
 

src/pretix/base/services/export.py

@@ -340,13 +340,12 @@ def _run_scheduled_export(schedule, context: Union[Event, Organizer], exporter,
             if schedule.owner.is_active:
                 mail(
                     email=schedule.owner.email,
-                    subject=gettext('Scheduled export failed'),
+                    subject=gettext('Export failed'),
                     template='pretixbase/email/export_failed.txt',
                     context={
                         'configuration_url': config_url,
                         'reason': msg,
                         'soft': soft,
-                        'instance': settings.PRETIX_INSTANCE_NAME,
                     },
                     event=context if isinstance(context, Event) else None,
                     organizer=context.organizer if isinstance(context, Event) else context,

src/pretix/base/services/shredder.py

@@ -44,7 +44,7 @@ from django.conf import settings
 from django.utils.crypto import get_random_string
 from django.utils.formats import date_format
 from django.utils.timezone import now
-from django.utils.translation import gettext, gettext_lazy as _
+from django.utils.translation import gettext_lazy as _
 
 from pretix.base.i18n import language
 from pretix.base.models import CachedFile, Event, User, cachedfile_name
@@ -171,16 +171,15 @@ def shred(self, event: Event, fileid: str, confirm_code: str, user: int=None, lo
 
     if user:
         with language(user.locale):
-            event_name = str(event.name)
             mail(
                 user.email,
-                gettext('Data shredding completed for %(event)s') % {'event': event_name},
+                _('Data shredding completed'),
                 'pretixbase/email/shred_completed.txt',
                 {
                     'instance': settings.PRETIX_INSTANCE_NAME,
                     'user': user,
                     'organizer': event.organizer.name,
-                    'event': event_name,
+                    'event': str(event.name),
                     'start_time': date_format(parse(indexdata['time']).astimezone(event.timezone), 'SHORT_DATETIME_FORMAT'),
                     'shredders': ', '.join([str(s.verbose_name) for s in shredders])
                 },

src/pretix/base/settings.py

@@ -1276,7 +1276,7 @@ DEFAULTS = {
         'serializer_class': serializers.BooleanField,
         'write_permission': 'event.settings.invoicing:write',
         'form_kwargs': dict(
-            label=_("Allow updating existing invoices"),
+            label=_("Allow to update existing invoices"),
             help_text=_("By default, invoices can never again be changed once they are issued. In most countries, we "
                         "recommend to leave this option turned off and always issue a new invoice if a change needs "
                         "to be made."),
@@ -1924,6 +1924,8 @@ DEFAULTS = {
         'serializer_class': serializers.BooleanField,
         'form_kwargs': dict(
             label=_("Hide all past dates from calendar"),
+            help_text=_("This option currently only affects the calendar of this event series, not the organizer-wide "
+                        "calendar.")
         )
     },
     'allow_modifications': {
@@ -2284,17 +2286,6 @@ DEFAULTS = {
             help_text=_("We'll show this publicly to allow attendees to contact you.")
         )
     },
-    'contact_url': {
-        'default': None,
-        'type': str,
-        'serializer_class': serializers.URLField,
-        'form_class': forms.URLField,
-        'form_kwargs': dict(
-            label=_("Contact URL"),
-            help_text=_("If you set this, the footer contact link will point here instead of using the email address above. "
-                        "Please note that you still need to add a contact email address that will be shared with all emails you send.")
-        )
-    },
     'imprint_url': {
         'default': None,
         'type': str,

src/pretix/base/templates/pretixbase/email/cancel_confirm.txt

@@ -1,14 +1,10 @@
 {% load i18n %}
-{% trans "You requested to cancel an event that involves a large bulk refund:" %}
+{% trans "You have requested us to cancel an event which includes a larger bulk-refund:" %}
 
-- {% trans "Event" %}: {{ event }}
-- {% trans "Estimated refund" %}: **{{ amount }}**
+{% trans "Event" %}: {{ event }}
 
-{% trans "To confirm, paste the following code into the cancellation form:" %}
+{% trans "Estimated refund amount" %}: **{{ amount }}**
 
-    {{ confirmation_code }}
+{% trans "Please confirm that you want to proceed by coping the following confirmation code into the cancellation form:" %}
 
-{% blocktrans with instance=instance %}Don't share this code with anyone. The {{ instance }} team will never ask you for it.{% endblocktrans %}
-
-{% blocktrans with instance=instance %}Thanks,  
-The {{ instance }} Team{% endblocktrans %}
+**{{ confirmation_code }}**

src/pretix/base/templates/pretixbase/email/export_failed.txt

@@ -1,13 +1,12 @@
 {% load i18n %}
-{% trans "Your scheduled export failed." %}
+{% trans "Your export failed." %}
 
-- {% trans "Reason" %}: {{ reason }}
+{% trans "Reason:" %} {{ reason }}
 
-{% if not soft %}{% trans "If an export fails five times in a row, we'll stop sending it." %}{% endif %}
+{% if not soft %}
+{% trans "If your export fails five times in a row, it will no longer be sent." %}
+{% endif %}
 
-{% trans "You can adjust or remove this export here:" %}
+{% trans "Configuration link:" %}
 
 {{ configuration_url }}
-
-{% blocktrans with instance=instance %}Thanks,  
-The {{ instance }} Team{% endblocktrans %}

src/pretix/base/templates/pretixbase/email/notification.html

@@ -52,13 +52,13 @@
                     <table cellpadding="20"><tr><td>
             <![endif]-->
             <div class="content">
-                {% trans "You're receiving this email based on your notification settings." %}<br>
+                {% trans "You receive these emails based on your notification settings." %}<br>
                 <a href="{{ settings_url }}">
-                    {% trans "Manage settings" %}
+                    {% trans "Click here to view and change your notification settings" %}
                 </a>
                 {% if disable_url %}<br>
                     <a href="{{ disable_url }}">
-                        {% trans "Disable all notifications" %}
+                        {% trans "Click here disable all notifications immediately." %}
                     </a>
                 {% endif %}
             </div>

src/pretix/base/templates/pretixbase/email/notification.txt

@@ -1,21 +1,19 @@
 {% load i18n %}
 {{ notification.title }}{% if notification.detail %}
 
-{{ notification.detail }}{% endif %}{% if notification.url %}
+{{ notification.detail }}
+{% endif %}{% if notification.url %}
 
-{{ notification.url }}{% endif %}{% if notification.attributes %}
+{{ notification.url }}{% endif %}{% for attr in notification.attributes %}
 
-{% for attr in notification.attributes %}- {{ attr.title }}: {{ attr.value }}
-{% endfor %}{% endif %}{% for action in notification.actions %}
+{{ attr.title }}: {{ attr.value }}{% endfor %}{% for action in notification.actions %}
 
-{{ action.label }}:
+{{ action.label }}
+    {{ action.url }}{% endfor %}
 
-{{ action.url }}{% endfor %}
-
----
-
-{% trans "You're receiving this email based on your notification settings." %}
-
-- {% trans "Manage settings" %}: {{ settings_url }}
-{% if disable_url %}- {% trans "Disable all notifications" %}: {{ disable_url }}
+{% trans "You receive these emails based on your notification settings." %}
+{% trans "Click here to view and change your notification settings:" %}
+{{ settings_url }}
+{% if disable_url %}{% trans "Click here disable all notifications immediately:" %}
+{{ disable_url }}
 {% endif %}

src/pretix/base/templates/pretixbase/email/shred_completed.txt

@@ -1,14 +1,17 @@
-{% load i18n %}{% blocktrans %}Hello,
+{% load i18n %}
+{% load i18n %}{% blocktrans with url=url|safe %}Hello,
 
-The following data shredding job has been completed:
+we hereby confirm that the following data shredding job has been completed:
 
-- Organizer: {{ organizer }}
-- Event: {{ event }}
-- Data selection: {{ shredders }}
-- Start time: {{ start_time }}
+Organizer: {{ organizer }}
 
-Any data added to the event after the start time may not have been deleted.
+Event: {{ event }}
 
-Thanks,  
-The {{ instance }} Team
+Data selection: {{ shredders }}
+
+Start time: {{ start_time }} (new data added after this time might not have been deleted)
+
+Best regards,
+
+Your {{ instance }} team
 {% endblocktrans %}

src/pretix/base/templates/pretixbase/framebreak.html

@@ -1,28 +0,0 @@
-{% extends "error.html" %}
-{% load i18n %}
-{% load eventurl %}
-{% load urlreplace %}
-{% load static %}
-
-{% block content %}
-    <h1>{% trans "Please continue in a new tab" %}</h1>
-    <p class="larger">
-        {% blocktrans trimmed %}
-            For security reasons, the following step is only possible in a new tab.
-        {% endblocktrans %}
-    </p>
-    <p class="larger">
-        {% blocktrans trimmed %}
-            If the new tab did not open automatically, please click the following button:
-        {% endblocktrans %}
-    </p>
-    <div class="text-center">
-        <a href="{{ url }}"
-           class="btn btn-primary btn-lg" target="_blank">
-            <span class="fa fa-external-link-square"></span>
-            {% trans "Continue in new tab" %}
-        </a>
-        {{ url|json_script:"framebreak-url" }}
-        <script type="text/javascript" src="{% static "pretixbase/js/framebreak.js" %}"></script>
-    </div>
-{% endblock %}

src/pretix/base/templatetags/rich_text.py

@@ -42,6 +42,8 @@ from bleach import DEFAULT_CALLBACKS, html5lib_shim
 from bleach.linkifier import build_email_re
 from django import template
 from django.conf import settings
+from django.core import signing
+from django.urls import reverse
 from django.utils.functional import SimpleLazyObject
 from django.utils.html import escape
 from django.utils.http import url_has_allowed_host_and_scheme
@@ -52,7 +54,6 @@ from markdown.postprocessors import Postprocessor
 from markdown.treeprocessors import UnescapeTreeprocessor
 from tlds import tld_set
 
-from pretix.base.views.redirect import safelink
 from pretix.helpers.format import SafeFormatter, format_map
 
 register = template.Library()
@@ -157,7 +158,8 @@ def safelink_callback(attrs, new=False):
     """
     url = html.unescape(attrs.get((None, 'href'), '/'))
     if not url_has_allowed_host_and_scheme(url, allowed_hosts=None) and not url.startswith('mailto:') and not url.startswith('tel:'):
-        attrs[None, 'href'] = safelink(url)
+        signer = signing.Signer(salt='safe-redirect')
+        attrs[None, 'href'] = reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))
         attrs[None, 'target'] = '_blank'
         attrs[None, 'rel'] = 'noopener'
     return attrs

src/pretix/base/views/redirect.py

@@ -19,7 +19,6 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import logging
 import urllib.parse
 
 from django.core import signing
@@ -27,8 +26,6 @@ from django.http import HttpResponseBadRequest, HttpResponseRedirect
 from django.shortcuts import render
 from django.urls import reverse
 
-logger = logging.getLogger(__name__)
-
 
 def _is_samesite_referer(request):
     referer = request.headers.get('referer')
@@ -45,16 +42,11 @@ def _is_samesite_referer(request):
 
 
 def redir_view(request):
-    framebreak = "framebreak" in request.GET
-    salt = 'framebreak-safelink-url' if framebreak else 'safelink-url'
+    signer = signing.Signer(salt='safe-redirect')
     try:
-        url = signing.Signer(salt=salt).unsign(request.GET.get('url', ''))
+        url = signer.unsign(request.GET.get('url', ''))
     except signing.BadSignature:
-        try:
-            # Backwards-compatibility for a change in 2026-06, remove after a while
-            url = signing.Signer(salt='safe-redirect').unsign(request.GET.get('url', ''))
-        except signing.BadSignature:
-            return HttpResponseBadRequest('Invalid parameter')
+        return HttpResponseBadRequest('Invalid parameter')
 
     if not _is_samesite_referer(request):
         u = urllib.parse.urlparse(url)
@@ -63,26 +55,11 @@ def redir_view(request):
             'url': url,
         })
 
-    if framebreak:
-        r = render(request, 'pretixbase/framebreak.html', {
-            'url': url,
-        })
-        r.xframe_options_exempt = True
-        return r
-
     r = HttpResponseRedirect(url)
     r['X-Robots-Tag'] = 'noindex'
     return r
 
 
-def safelink(url, framebreak=False):
-    url = str(url)
-    if not (url.startswith('https://') or url.startswith('http://') or url.startswith("/")):
-        logger.warning('Invalid URL passed to safelink: %r', url)
-        return '#invalid-url'
-    salt = 'framebreak-safelink-url' if framebreak else 'safelink-url'
-    signer = signing.Signer(salt=salt)
-    u = reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))
-    if framebreak:
-        u += "&framebreak=true"
-    return u
+def safelink(url):
+    signer = signing.Signer(salt='safe-redirect')
+    return reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))

src/pretix/celery_app.py

@@ -19,56 +19,14 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import logging
 import os
 
-from celery import Celery, signals
-from django.dispatch import receiver
+from celery import Celery
 
 os.environ.setdefault("DJANGO_SETTINGS_MODULE", "pretix.settings")
-logger = logging.getLogger(__name__)
 
 from django.conf import settings
 
 app = Celery('pretix')
 app.config_from_object('django.conf:settings', namespace='CELERY')
 app.autodiscover_tasks(lambda: settings.INSTALLED_APPS)
-
-
-@receiver(signals.before_task_publish)
-def on_before_task_publish(sender, body, exchange, routing_key, headers, properties, declare, retry_policy, **kwargs):
-    from pretix.helpers.logs import local
-
-    trace = getattr(local, 'trace', [])
-    request_id = getattr(local, 'request_id', None)
-    if request_id:
-        trace.append(request_id)
-
-    headers["X-Pretix-Trace"] = " ".join(trace)
-
-
-@receiver(signals.task_received)
-def on_task_received(sender, request, **kwargs):
-    trace = request._request_dict.get("X-Pretix-Trace")
-    if trace:
-        logger.info(f"Task {request.id} has trace {trace}")
-
-
-@receiver(signals.task_prerun)
-def on_task_prerun(sender, task_id, task, **kwargs):
-    from pretix.helpers.logs import local
-
-    local.request_id = task_id
-    if "X-Pretix-Trace" in task.request.headers:
-        local.trace = task.request.headers["X-Pretix-Trace"].split(" ")
-    else:
-        local.trace = []
-    local.trace.append(task_id)
-
-
-@receiver(signals.task_postrun)
-def on_task_postrun(sender, task_id, task, **kwargs):
-    from pretix.helpers.logs import local
-
-    local.request_id = None
-    local.trace = []

src/pretix/control/forms/event.py

@@ -625,7 +625,6 @@ class EventSettingsForm(EventSettingsValidationMixin, FormPlaceholderMixin, Sett
         'max_items_per_order',
         'reservation_time',
         'contact_mail',
-        'contact_url',
         'show_variations_expanded',
         'hide_sold_out',
         'meta_noindex',
@@ -672,11 +671,6 @@ class EventSettingsForm(EventSettingsValidationMixin, FormPlaceholderMixin, Sett
 
     base_context = {
         'frontpage_text': ['event'],
-        'presale_has_ended_text': ['event'],
-        'voucher_explanation_text': ['event'],
-        'banner_text': ['event'],
-        'banner_text_bottom': ['event'],
-        'event_info_text': ['event'],
     }
 
     def _resolve_virtual_keys_input(self, data, prefix=''):
@@ -1679,7 +1673,7 @@ class CountriesAndEUAndStates(CountriesAndEU):
 
 class TaxRuleLineForm(I18nForm):
     country = LazyTypedChoiceField(
-        choices=lazy(lambda: CountriesAndEUAndStates(), CountriesAndEUAndStates),
+        choices=CountriesAndEUAndStates(),
         required=False
     )
     address_type = forms.ChoiceField(
@@ -1905,12 +1899,6 @@ class QuickSetupForm(I18nForm):
         required=False,
         help_text=_("We'll show this publicly to allow attendees to contact you.")
     )
-    contact_url = forms.URLField(
-        label=_("Contact URL"),
-        required=False,
-        help_text=_("If you set this, the footer contact link will point here instead of using the email address above. "
-                    "Please note that you still need to add a contact email address that will be shared with all emails you send.")
-    )
     total_quota = forms.IntegerField(
         label=_("Total capacity"),
         min_value=0,

src/pretix/control/forms/organizer.py

@@ -604,7 +604,6 @@ class OrganizerSettingsForm(SettingsForm):
         'customer_accounts_require_login_for_order_access',
         'invoice_regenerate_allowed',
         'contact_mail',
-        'contact_url',
         'imprint_url',
         'organizer_info_text',
         'event_list_type',

src/pretix/control/forms/vouchers.py

@@ -106,11 +106,6 @@ class VoucherForm(I18nModelForm):
                 pass
         super().__init__(*args, **kwargs)
 
-        self.fields['tag'].widget.attrs['data-typeahead-url'] = reverse('control:event.vouchers.tags.typeahead', kwargs={
-            'event': instance.event.slug,
-            'organizer': instance.event.organizer.slug,
-        })
-
         if instance.event.has_subevents:
             self.fields['subevent'].queryset = instance.event.subevents.all()
             self.fields['subevent'].widget = Select2(

src/pretix/control/middleware.py

@@ -36,7 +36,6 @@ from urllib.parse import quote, urljoin, urlparse
 
 from django.conf import settings
 from django.contrib.auth import REDIRECT_FIELD_NAME, logout
-from django.contrib.auth.views import redirect_to_login
 from django.http import Http404
 from django.shortcuts import get_object_or_404, resolve_url
 from django.template.response import TemplateResponse
@@ -213,17 +212,14 @@ class AuditLogMiddleware:
         if request.path.startswith(get_script_prefix() + 'control') and request.user.is_authenticated:
             if getattr(request.user, "is_hijacked", False):
                 hijack_history = request.session.get('hijack_history', False)
-                hijacker = get_object_or_404(User, pk=hijack_history[0]["user"])
+                hijacker = get_object_or_404(User, pk=hijack_history[0])
                 ss = hijacker.get_active_staff_session(request.session.get('hijacker_session'))
-                if not ss:
-                    # Staff session expired or not found
-                    logout(request)
-                    return redirect_to_login(request.get_full_path())
-                ss.logs.create(
-                    url=request.path,
-                    method=request.method,
-                    impersonating=request.user
-                )
+                if ss:
+                    ss.logs.create(
+                        url=request.path,
+                        method=request.method,
+                        impersonating=request.user
+                    )
             else:
                 ss = request.user.get_active_staff_session(request.session.session_key)
                 if ss:

src/pretix/control/templates/pretixcontrol/auth/login_2fa.html

@@ -3,6 +3,7 @@
 {% load i18n %}
 {% load static %}
 {% load compress %}
+{% load escapejson %}
 {% block content %}
     <form class="form-signin" action="" method="post" id="webauthn-form">
         {% csrf_token %}
@@ -30,8 +31,7 @@
     </form>
     {% if jsondata %}
         <script type="text/json" id="webauthn-login">
-            {{ jsondata|safe }}
-
+            {{ jsondata|escapejson }}
         </script>
     {% endif %}
     {% compress js %}

src/pretix/control/templates/pretixcontrol/email/confirmation_code.txt

@@ -1,13 +1,13 @@
-{% load i18n %}{% blocktrans with code=code reason=reason instance=instance %}Hello,
+{% load i18n %}{% blocktrans with url=url|safe messages=messages|safe %}Hello,
 
 {{ reason }}
 
     {{ code }}
 
-Don't share this code with anyone. The {{ instance }} team will never ask you for it.
+Please do never give this code to another person. Our support team will never ask for this code.
 
-If you didn't request this code, please contact us immediately.
+If this code was not requested by you, please contact us immediately.
 
-Thanks,  
-The {{ instance }} Team
+Best regards,
+Your {{ instance }} team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/email_setup.txt

@@ -1,15 +1,14 @@
-{% load i18n %}{% blocktrans with code=code address=address instance=instance %}Hello,
+{% load i18n %}{% blocktrans with code=code instance=instance %}Hello,
 
-Someone requested to use {{ address }} as a sender address on {{ instance }}. Once verified, emails sent from {{ instance }} can show this address as the sender.
+someone requested to use {{ address }} as a sender address on {{ instance }}.
+This will allow them to send emails that are shown to originate from this email address.
+If that was you, please enter the following confirmation code:
 
-If this was you, enter the following code in the setup form:
+{{ code }}
 
-    {{ code }}
+If this was not requested by you, you can safely ignore this email.
 
-Don't share this code with anyone unless you want to authorize them to use this address for this purpose. The {{ instance }} team will never ask you for it.
+Best regards,  
 
-If you didn't request this, you can safely ignore this email.
-
-Thanks,  
-The {{ instance }} Team
-{% endblocktrans %}
+Your {{ instance }} team
+{% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/forgot.txt

@@ -1,11 +1,9 @@
 {% load i18n %}{% blocktrans with url=url|safe %}Hello,
 
-We received a request to reset the password for your {{ instance }} account. To choose a new password, follow the link below:
+you requested a new password. Please go to the following page to reset your password:
 
 {{ url }}
 
-If you didn't request this, you can safely ignore this email — your password won't change.
-
-Thanks,  
-The {{ instance }} Team
+Best regards,  
+Your {{ instance }} team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/invitation.txt

@@ -1,16 +1,17 @@
 {% load i18n %}{% blocktrans with url=url|safe %}Hello,
 
-You've been invited to join a team on {{ instance }}, an event ticket sales platform.
+you have been invited to a team on {{ instance }}, a platform to perform event
+ticket sales.
 
-- Organizer: {{ organizer }}
-- Team: {{ team }}
-
-To accept, follow the link below:
+Organizer: {{ organizer }}
+Team: {{ team }}
 
+If you want to join that team, just click on the following link:
 {{ url }}
 
-If you don't want to join, you can safely ignore this email.
+If you do not want to join, you can safely ignore or delete this email.
 
-Thanks,  
-The {{ instance }} Team
+Best regards,  
+
+Your {{ instance }} team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/login_notice.txt

@@ -1,19 +1,13 @@
-{% load i18n %}{% blocktrans %}Hello,
+{% load i18n %}{% blocktrans with url=url|safe os=source.os_type agent=source.agent_type %}Hello,
 
-We noticed a new sign-in to your {{ instance }} account:
-{% endblocktrans %}
-- {% trans "Time" %}: {{ when }}
-- {% trans "Browser" %}: {{ agent }}
-- {% trans "Operating system" %}: {{ os }}
-{% if device %}- {% trans "Device" %}: {{ device }}
-{% endif %}{% if country %}- {% trans "Country" %}: {{ country }}
-{% endif %}
-{% blocktrans with url=url|safe %}If it was you, no action is needed.
+a login to your {{ instance }} account from an unusual or new location was detected. The login was performed using {{ agent }} on {{ os }} from {{ country }}.
 
-If you don't recognize this sign-in, please change your password immediately:
+If this was you, you can safely ignore this email.
+
+If this was not you, we recommend that you change your password in your account settings:
 
 {{ url }}
 
-Thanks,  
-The {{ instance }} Team
+Best regards,  
+Your {{ instance }} team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/email/security_notice.txt

@@ -1,15 +1,16 @@
 {% load i18n %}{% blocktrans with url=url|safe messages=messages|safe %}Hello,
 
-The following changes were made to your {{ instance }} account:
+this is to inform you that the account information of your {{ instance }} account has been
+changed. In particular, the following changes have been performed:
 
 {{ messages }}
 
-If you didn't make these changes, please contact the {{ instance }} support team immediately.
+If this change was not performed by you, please contact us immediately.
 
-You can review your account settings here:
+You can review and change your account settings here:
 
 {{ url }}
 
-Thanks,  
-The {{ instance }} Team
+Best regards,  
+Your {{ instance }} team
 {% endblocktrans %}

src/pretix/control/templates/pretixcontrol/event/quick_setup.html

@@ -193,7 +193,6 @@
                     {% endblocktrans %}
                 </p>
                 {% bootstrap_field form.contact_mail layout="control" %}
-                {% bootstrap_field form.contact_url layout="control" %}
                 {% bootstrap_field form.imprint_url layout="control" %}
             </div>
         </fieldset>

src/pretix/control/templates/pretixcontrol/event/settings.html

@@ -30,7 +30,6 @@
                 {% bootstrap_field form.date_admission layout="control" %}
                 {% bootstrap_field form.currency layout="control" %}
                 {% bootstrap_field sform.contact_mail layout="control" %}
-                {% bootstrap_field sform.contact_url layout="control" %}
                 {% bootstrap_field sform.imprint_url layout="control" %}
                 {% bootstrap_field form.is_public layout="control" %}
                 {% bootstrap_field form.all_sales_channels layout="control" %}

src/pretix/control/templates/pretixcontrol/order/cancel.html

@@ -26,7 +26,7 @@
         {% if form.cancellation_fee %}
             {% if fee %}
                 {% with fee|money:request.event.currency as f %}
-                    <p>{% blocktrans trimmed with fee="<strong>"|add:f|add:"</strong>"|safe %}
+                    <p>{% blocktrans trimmed with fee=f|wrap_in:"strong" %}
                         The configured cancellation fee for a self-service cancellation would be {{ fee }} for this
                         order, but for a cancellation performed by you, you need to set the cancellation fee here:
                     {% endblocktrans %}</p>

src/pretix/control/templates/pretixcontrol/order/index.html

@@ -903,7 +903,7 @@
                                             <tr>
                                                 <td colspan="1"></td>
                                                 <td colspan="5">
-                                                    {{ p.html_info|safe }}
+                                                    {{ p.html_info }}
                                                     {% if staff_session %}
                                                         <p>
                                                             <a href="" class="btn btn-default btn-xs admin-only" data-expandpayment data-id="{{ p.pk }}">
@@ -1018,7 +1018,7 @@
                                                             </dl>
                                                         {% endif %}
                                                         {% if r.html_info %}
-                                                            {{ r.html_info|safe }}
+                                                            {{ r.html_info }}
                                                         {% endif %}
                                                         {% if staff_session %}
                                                             <p>

src/pretix/control/templates/pretixcontrol/organizers/device_connect.html

@@ -2,6 +2,7 @@
 {% load i18n %}
 {% load static %}
 {% load bootstrap3 %}
+{% load escapejson_dumps %}
 {% block inner %}
     <h1>{% trans "Connect to device:" %} {{ device.name }}</h1>
 
@@ -18,7 +19,7 @@
                 {% trans "Open the app that you want to connect and optionally reset it to the original state." %}
             </li>
             <li>{% trans "Scan the following configuration code:" %}<br><br>
-                <script type="text/json" data-replace-with-qr>{{ qrdata|safe }}</script><br>
+                <script type="application/json" data-replace-with-qr>{{ qrdata|escapejson_dumps }}</script><br>
                 {% trans "If your app/device does not support scanning a QR code, you can also enter the following information:" %}
                 <br>
                 <strong>{% trans "System URL:" %}</strong> <code id="system_url">{{ settings.SITE_URL }}</code>

src/pretix/control/templates/pretixcontrol/organizers/edit.html

@@ -34,7 +34,6 @@
                         {% endif %}
                         {% bootstrap_field sform.imprint_url layout="control" %}
                         {% bootstrap_field sform.contact_mail layout="control" %}
-                        {% bootstrap_field sform.contact_url layout="control" %}
                         {% bootstrap_field sform.organizer_info_text layout="control" %}
                         {% bootstrap_field sform.event_team_provisioning layout="control" %}
                         {% if sform.allowed_restricted_plugins %}

src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html

@@ -1,6 +1,7 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% load escapejson %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Add a two-factor authentication device" %}</h1>
@@ -32,7 +33,7 @@
         </li>
         <li>
             {% trans "Add a new account to the app by scanning the following barcode:" %}
-            <div class="qrcode-canvas" data-qrdata="#qrdata"></div>
+            <script type="application/json" data-replace-with-qr>{{ qrdata|escapejson_dumps }}</script>
             <p>
                 <a data-toggle="collapse" href="#no_scan">
                     {% trans "Can't scan the barcode?" %}
@@ -81,9 +82,4 @@
         </li>
     </ol>
 
-    <script type="text/json" id="qrdata">
-        {{ qrdata|safe }}
-
-
-    </script>
 {% endblock %}

src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html

@@ -3,6 +3,7 @@
 {% load bootstrap3 %}
 {% load static %}
 {% load compress %}
+{% load escapejson %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Add a two-factor authentication device" %}</h1>
@@ -26,9 +27,7 @@
         {% trans "Device registration failed." %}
     </div>
     <script type="text/json" id="webauthn-enroll">
-        {{ jsondata|safe }}
-
-
+        {{ jsondata|escapejson }}
     </script>
     {% compress js %}
         <script type="text/javascript" src="{% static "pretixcontrol/js/base64js.js" %}"></script>

src/pretix/control/templates/pretixcontrol/user/reauth.html

@@ -3,6 +3,7 @@
 {% load bootstrap3 %}
 {% load compress %}
 {% load static %}
+{% load escapejson %}
 {% block content %}
     <form class="form-signin" id="webauthn-form" action="" method="post">
         {% csrf_token %}
@@ -43,7 +44,7 @@
 
         {% if jsondata %}
             <script type="text/json" id="webauthn-login">
-            {{ jsondata|safe }}
+                {{ jsondata|escapejson }}
             </script>
         {% endif %}
         {% compress js %}

src/pretix/control/urls.py

@@ -370,7 +370,6 @@ urlpatterns = [
         re_path(r'^discounts/add$', discounts.DiscountCreate.as_view(), name='event.items.discounts.add'),
         re_path(r'^vouchers/$', vouchers.VoucherList.as_view(), name='event.vouchers'),
         re_path(r'^vouchers/tags/$', vouchers.VoucherTags.as_view(), name='event.vouchers.tags'),
-        re_path(r'^vouchers/tags/typeahead$', typeahead.voucher_tag_typeahead, name='event.vouchers.tags.typeahead'),
         re_path(r'^vouchers/rng$', vouchers.VoucherRNG.as_view(), name='event.vouchers.rng'),
         re_path(r'^vouchers/item_select$', typeahead.itemvarquota_select2, name='event.vouchers.itemselect2'),
         re_path(r'^vouchers/(?P<voucher>\d+)/$', vouchers.VoucherUpdate.as_view(), name='event.voucher'),

src/pretix/control/views/mailsetup.py

@@ -28,7 +28,7 @@ from django.core.mail import get_connection
 from django.shortcuts import redirect
 from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
-from django.utils.translation import gettext, gettext_lazy as _
+from django.utils.translation import gettext_lazy as _
 from django.views.generic import TemplateView
 
 from pretix.base import email
@@ -216,14 +216,13 @@ class MailSettingsSetupView(TemplateView):
                     messages.error(request, _('The verification code was incorrect, please try again.'))
                 else:
                     self.request.session[session_key] = get_random_string(length=6, allowed_chars='1234567890')
-                    sender_address = self.simple_form.cleaned_data.get('mail_from')
                     mail(
-                        sender_address,
-                        gettext('Confirm %(address)s as a sender address') % {'address': sender_address},
+                        self.simple_form.cleaned_data.get('mail_from'),
+                        _('Sender address verification'),
                         'pretixcontrol/email/email_setup.txt',
                         {
                             'code': self.request.session[session_key],
-                            'address': sender_address,
+                            'address': self.simple_form.cleaned_data.get('mail_from'),
                             'instance': settings.PRETIX_INSTANCE_NAME,
                         },
                         None,

src/pretix/control/views/orders.py

@@ -551,10 +551,10 @@ class OrderDetail(OrderView):
         ctx['refunds'] = self.order.refunds.select_related('payment').order_by('-created')
         for p in ctx['payments']:
             if p.payment_provider:
-                p.html_info = (p.payment_provider.payment_control_render(self.request, p) or "").strip()
+                p.html_info = p.payment_provider.payment_control_render(self.request, p) or ""
         for r in ctx['refunds']:
             if r.payment_provider:
-                r.html_info = (r.payment_provider.refund_control_render(self.request, r) or "").strip()
+                r.html_info = r.payment_provider.refund_control_render(self.request, r) or ""
         ctx['invoices'] = list(self.order.invoices.all().select_related('event'))
         ctx['comment_form'] = CommentForm(initial={
             'comment': self.order.comment,

src/pretix/control/views/organizer.py

@@ -1032,9 +1032,7 @@ class TeamMemberView(OrganizerDetailViewMixin, OrganizerPermissionRequiredMixin,
     def _send_invite(self, instance):
         mail(
             instance.email,
-            gettext('You\'ve been invited to join %(organizer)s') % {
-                'organizer': self.request.organizer.name,
-            },
+            _('Account invitation'),
             'pretixcontrol/email/invitation.txt',
             {
                 'instance': settings.PRETIX_INSTANCE_NAME,

src/pretix/control/views/typeahead.py

@@ -975,21 +975,6 @@ def subevent_meta_values(request, organizer, event):
     })
 
 
-@event_permission_required('event.vouchers:read')
-def voucher_tag_typeahead(request, **kwargs):
-    q = request.GET.get('q', '')
-    tags = request.event.vouchers.filter(
-        tag__isnull=False,
-        waitinglistentries__isnull=True,
-    ).filter(
-        tag__icontains=q,
-    ).values_list('tag', flat=True).distinct().order_by('tag')[:10]
-
-    return JsonResponse({
-        'results': [{'name': t} for t in tags]
-    })
-
-
 def item_meta_values(request, organizer, event):
     q = request.GET.get('q')
     propname = request.GET.get('property')

src/pretix/control/views/users.py

@@ -19,23 +19,19 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-import hmac
 import json
 from contextlib import contextmanager
 
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import (
-    BACKEND_SESSION_KEY, HASH_SESSION_KEY, get_user_model, load_backend, login,
-    logout,
+    BACKEND_SESSION_KEY, get_user_model, load_backend, login,
 )
 from django.contrib.auth.mixins import LoginRequiredMixin
-from django.contrib.auth.views import redirect_to_login
-from django.core.exceptions import PermissionDenied
 from django.db import transaction
 from django.shortcuts import get_object_or_404, redirect
 from django.urls import reverse
-from django.utils.crypto import get_random_string, salted_hmac
+from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from django.views import View
@@ -222,13 +218,11 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
 
     def post(self, request, *args, **kwargs):
         self.object = get_object_or_404(User, pk=self.kwargs.get("id"))
-        staff_session = request.user.get_active_staff_session(request.session.session_key)
         self.request.user.log_action('pretix.control.auth.user.impersonated',
                                      user=request.user,
                                      data={
                                          'other': self.kwargs.get("id"),
-                                         'other_email': self.object.email,
-                                         'staff_session': staff_session.pk,
+                                         'other_email': self.object.email
                                      })
         oldkey = request.session.session_key
 
@@ -236,15 +230,7 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
         hijacked = self.object
 
         hijack_history = request.session.get("hijack_history", [])
-        hijack_history.append({
-            "user": request.user.pk,
-            # We include the auth_hash, because it is unguessable. So should an attacker gain an attack vector to
-            # modify hijack_history, they can't just insert or change a user that shouldn't be there. We HMAC it
-            # again, though, since we also do not want the auth_hash of the admin user to be in the session of an
-            # unprivileged user to contain the risk if there is some leak of session data.
-            "auth_hash": salted_hmac(key_salt=b"hijack-history-hash", value=request.session[HASH_SESSION_KEY],
-                                     algorithm="sha256", secret=settings.SECRET_KEY).hexdigest(),
-        })
+        hijack_history.append(request.user._meta.pk.value_to_string(hijacker))
 
         backend = get_used_backend(request)
         backend = f"{backend.__module__}.{backend.__class__.__name__}"
@@ -252,12 +238,6 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
         with signals.no_update_last_login(), keep_session_age(request.session):
             login(request, hijacked, backend=backend)
 
-        request.session.save()
-        staff_session.logs.create(
-            method='(NOTE)',
-            url=f'Begin impersonating user #{hijacked.pk} (request session {oldkey[:8]} -> {request.session.session_key[:8]})',
-        )
-
         request.session["hijack_history"] = hijack_history
 
         signals.hijack_started.send(
@@ -274,28 +254,13 @@ class UserImpersonateView(AdministratorPermissionRequiredMixin, RecentAuthentica
 class UserImpersonateStopView(LoginRequiredMixin, View):
 
     def post(self, request, *args, **kwargs):
-        staff_session_key = request.session['hijacker_session']
-        prev_session_key = request.session.session_key
+        impersonated = request.user
+
+        hijs = request.session['hijacker_session']
         hijack_history = request.session.get("hijack_history", [])
         hijacked = request.user
-        prev_session = hijack_history.pop()
-        hijacker = get_object_or_404(get_user_model(), pk=prev_session["user"])
-        staff_session = hijacker.get_active_staff_session(staff_session_key)
-        if not staff_session:
-            raise PermissionDenied
-
-        expected_hash = salted_hmac(
-            key_salt=b"hijack-history-hash",
-            value=hijacker.get_session_auth_hash(),
-            algorithm="sha256",
-            secret=settings.SECRET_KEY
-        ).hexdigest()
-        if not hmac.compare_digest(expected_hash, prev_session["auth_hash"]):
-            # Could be an attacker-controlled hijack history, but could also be e.g. a password change of the admin user
-            # that happened during the hijack session
-            logout(request)
-            return redirect_to_login(request.get_full_path())
-
+        user_pk = hijack_history.pop()
+        hijacker = get_object_or_404(get_user_model(), pk=user_pk)
         backend = get_used_backend(request)
         backend = f"{backend.__module__}.{backend.__class__.__name__}"
         with signals.no_update_last_login(), keep_session_age(request.session):
@@ -310,22 +275,17 @@ class UserImpersonateStopView(LoginRequiredMixin, View):
             hijacked=hijacked,
         )
 
-        request.session.save()
-        staff_session.session_key = request.session.session_key
-        staff_session.save()
-
-        staff_session.logs.create(
-            method='(NOTE)',
-            url=f'Stop impersonating user #{hijacked.pk} (request session {prev_session_key[:8]}, '
-                f'staff session {staff_session_key[:8]} -> {request.session.session_key[:8]})',
-        )
+        ss = request.user.get_active_staff_session(hijs)
+        if ss:
+            request.session.save()
+            ss.session_key = request.session.session_key
+            ss.save()
 
         request.user.log_action('pretix.control.auth.user.impersonate_stopped',
                                 user=request.user,
                                 data={
-                                    'other': hijacked.pk,
-                                    'other_email': hijacked.email,
-                                    'staff_session': staff_session.pk,
+                                    'other': impersonated.pk,
+                                    'other_email': impersonated.email
                                 })
         return redirect(reverse('control:index'))
 

src/pretix/helpers/config.py

@@ -29,61 +29,36 @@ class EnvOrParserConfig:
         self.cp = configparser
 
     def _envkey(self, section, option):
-        section = re.sub("[^a-zA-Z0-9]", "_", section.upper())
-        option = re.sub("[^a-zA-Z0-9]", "_", option.upper())
-        return f"PRETIX_{section}_{option}"
-
-    def _file_envkey(self, section, option):
-        section = re.sub("[^a-zA-Z0-9]", "_", section.upper())
-        option = re.sub("[^a-zA-Z0-9]", "_", option.upper())
-        return f"FILE__PRETIX_{section}_{option}"
+        section = re.sub('[^a-zA-Z0-9]', '_', section.upper())
+        option = re.sub('[^a-zA-Z0-9]', '_', option.upper())
+        return f'PRETIX_{section}_{option}'
 
     def get(self, section, option, *, raw=False, vars=None, fallback=_UNSET):
-        if self._file_envkey(section, option) in os.environ:
-            with open(os.environ[self._file_envkey(section, option)], "r") as f:
-                return f.read().strip()
         if self._envkey(section, option) in os.environ:
             return os.environ[self._envkey(section, option)]
         return self.cp.get(section, option, raw=raw, vars=vars, fallback=fallback)
 
     def getint(self, section, option, *, raw=False, vars=None, fallback=_UNSET):
-        if self._file_envkey(section, option) in os.environ:
-            with open(os.environ[self._file_envkey(section, option)], "r") as f:
-                return int(f.read().strip())
         if self._envkey(section, option) in os.environ:
             return int(os.environ[self._envkey(section, option)])
         return self.cp.getint(section, option, raw=raw, vars=vars, fallback=fallback)
 
     def getfloat(self, section, option, *, raw=False, vars=None, fallback=_UNSET):
-        if self._file_envkey(section, option) in os.environ:
-            with open(os.environ[self._file_envkey(section, option)], "r") as f:
-                return float(f.read().strip())
         if self._envkey(section, option) in os.environ:
             return float(os.environ[self._envkey(section, option)])
         return self.cp.getfloat(section, option, raw=raw, vars=vars, fallback=fallback)
 
     def getboolean(self, section, option, *, raw=False, vars=None, fallback=_UNSET):
-        if self._file_envkey(section, option) in os.environ:
-            with open(os.environ[self._file_envkey(section, option)], "r") as f:
-                return self.cp._convert_to_boolean(f.read().strip())
         if self._envkey(section, option) in os.environ:
-            return self.cp._convert_to_boolean(
-                os.environ[self._envkey(section, option)]
-            )
-        return self.cp.getboolean(
-            section, option, raw=raw, vars=vars, fallback=fallback
-        )
+            return self.cp._convert_to_boolean(os.environ[self._envkey(section, option)])
+        return self.cp.getboolean(section, option, raw=raw, vars=vars, fallback=fallback)
 
     def has_section(self, section):
-        if any(k.startswith(self._file_envkey(section, "")) for k in os.environ):
-            return True
-        if any(k.startswith(self._envkey(section, "")) for k in os.environ):
+        if any(k.startswith(self._envkey(section, '')) for k in os.environ):
             return True
         return self.cp.has_section(section)
 
     def has_option(self, section, option):
-        if self._file_envkey(section, option) in os.environ:
-            return True
         if self._envkey(section, option) in os.environ:
             return True
         return self.cp.has_option(section, option)

src/pretix/helpers/database.py

@@ -285,12 +285,3 @@ def get_deterministic_ordering(model, ordering):
             # on the primary key to provide total ordering.
             ordering.append("-pk")
     return ordering
-
-
-@contextlib.contextmanager
-def conditional_atomic(do_atomic, **kwargs):
-    if do_atomic:
-        with transaction.atomic(**kwargs):
-            yield
-    else:
-        yield

src/pretix/helpers/escapejson.py

@@ -47,5 +47,5 @@ def escapejson(value):
 
 @keep_lazy(str, SafeText)
 def escapejson_attr(value):
-    """Hex encodes characters for use in a html attributw script."""
+    """Hex encodes characters for use in a html attribute."""
     return mark_safe(force_str(value).translate(_json_escapes_attr))

src/pretix/helpers/logs.py

@@ -20,7 +20,6 @@
 # <https://www.gnu.org/licenses/>.
 #
 import logging
-import uuid
 
 from django.core.signals import request_finished
 from django.dispatch import receiver
@@ -47,13 +46,6 @@ class RequestIdFilter(logging.Filter):
         return True
 
 
-class SkipNotFoundFilter(logging.Filter):
-    # Drop the WARNING "Not Found: ..." records django.request emits for 404s
-    # We have different access logs for that
-    def filter(self, record):
-        return getattr(record, 'status_code', None) != 404
-
-
 class RequestIdMiddleware:
     def __init__(self, get_response):
         self.get_response = get_response
@@ -66,9 +58,7 @@ class RequestIdMiddleware:
                 import sentry_sdk
                 sentry_sdk.set_tag("request_id", request.request_id)
         else:
-            # Web server did not pass a request ID, we still generate one to correlate between django logs and
-            # celery logs
-            local.request_id = request.request_id = str(uuid.uuid4())
+            local.request_id = request.request_id = None
 
         return self.get_response(request)
 

src/pretix/helpers/payment.py

@@ -25,19 +25,6 @@ import text_unidecode
 from django.utils.safestring import mark_safe
 from django.utils.translation import gettext_lazy as _
 
-EPC_QR_ALLOWED_CHARS = set(
-    "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-    "abcdefghijklmnopqrstuvwxyz"
-    "0123456789/-?:().,'+ "
-)
-
-
-def epc_qr_field(value):
-    return ''.join(
-        char for char in text_unidecode.unidecode(str(value or ''))
-        if char in EPC_QR_ALLOWED_CHARS
-    )
-
 
 def dotdecimal(value):
     return str(value).replace(",", ".")
@@ -90,7 +77,7 @@ def euro_epc_qr(
     return {
         "id": "girocode",
         "label": "EPC-QR",
-        "qr_data": "\n".join(epc_qr_field(d) for d in [
+        "qr_data": "\n".join(text_unidecode.unidecode(str(d or '')) for d in [
             "BCD",   # Service Tag: ‘BCD’
             "002",   # Version: V2
             "2",     # Character set: ISO 8859-1

src/pretix/helpers/security.py

@@ -27,7 +27,6 @@ from django.conf import settings
 from django.contrib.auth import login as auth_login
 from django.contrib.gis import geoip2
 from django.core.cache import cache
-from django.utils.formats import date_format
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from django_countries.fields import Country
@@ -170,15 +169,11 @@ def handle_login_source(user, request):
             with language(user.locale):
                 mail(
                     user.email,
-                    _('New sign-in to your account'),
+                    _('Login from new source detected'),
                     'pretixcontrol/email/login_notice.txt',
                     {
-                        'when': date_format(src.last_seen, 'DATETIME_FORMAT'),
-                        'agent': src.agent_type,
-                        'os': src.os_type,
-                        # ua-parser returns "Other" for unidentified desktop devices.
-                        'device': src.device_type if src.device_type and src.device_type != 'Other' else None,
-                        'country': Country(str(country)).name if country else None,
+                        'source': src,
+                        'country': Country(str(country)).name if country else _('Unknown country'),
                         'instance': settings.PRETIX_INSTANCE_NAME,
                         'url': mainreverse_absolute('control:user.settings')
                     },

src/pretix/locale/de/wordlist.txt

@@ -74,7 +74,6 @@ Bokmål
 Boleto
 Branding-Informationen
 Browsereinstellungen
-Browserfenster
 BSD-Lizenz
 bspw
 Bundles
@@ -135,7 +134,6 @@ Einlasskontrolle
 Einmalpasswörter
 einzuchecken
 email
-E-Mail-App
 E-Mail-Renderer
 Enterprise-Lizenz
 Enterprise-Lizenzen
@@ -154,7 +152,6 @@ erstmalig
 etc
 EU-USt-ID-Nr
 Event
-Event-Absage
 Event-Eigenschaft
 Eventeingang
 Event-Erstellung
@@ -209,7 +206,6 @@ innenname
 innennamen
 innergemeinschaftliche
 Innergemeinschaftlicher
-Instagram
 Installations-ID
 Integrationen
 invalidieren
@@ -231,7 +227,6 @@ Linktext
 lit
 Log-ID
 Logindaten
-Loginvorgangs
 Macau
 MapQuest-API-Key
 max
@@ -455,7 +450,6 @@ Strong
 Swish
 systemweiten
 Tab
-Tabs
 tag
 Teammitglied
 Teamname

src/pretix/locale/de_Informal/wordlist.txt

@@ -74,7 +74,6 @@ Bokmål
 Boleto
 Branding-Informationen
 Browsereinstellungen
-Browserfenster
 BSD-Lizenz
 bspw
 Bundles
@@ -135,7 +134,6 @@ Einlasskontrolle
 Einmalpasswörter
 einzuchecken
 email
-E-Mail-App
 E-Mail-Renderer
 Enterprise-Lizenz
 Enterprise-Lizenzen
@@ -154,7 +152,6 @@ erstmalig
 etc
 EU-USt-ID-Nr
 Event
-Event-Absage
 Event-Eigenschaft
 Eventeingang
 Event-Erstellung
@@ -209,7 +206,6 @@ innenname
 innennamen
 innergemeinschaftliche
 Innergemeinschaftlicher
-Instagram
 Installations-ID
 Integrationen
 invalidieren
@@ -231,7 +227,6 @@ Linktext
 lit
 Log-ID
 Logindaten
-Loginvorgangs
 Macau
 MapQuest-API-Key
 max
@@ -455,7 +450,6 @@ Strong
 Swish
 systemweiten
 Tab
-Tabs
 tag
 Teammitglied
 Teamname