Add sendmail-rules tests

Co-authored-by: Richard Schreiber <wiffbi@gmail.com>

doc/api/resources/orders.rst

@@ -2038,7 +2038,7 @@ Manipulating individual positions
 
    * ``order`` (mandatory, specified as a string mapping to a ``code``)
 
-   * ``addon_to`` (optional, specified as an integer mapping to the ``positionid`` of the parent position)
+   * ``addon_to`` (optional, specified as an integer mapping to ``positionid`` - the number of the position within the order, see :ref:`_order-position-resource` - of the parent position)
 
    * ``item`` (mandatory)
 
@@ -2348,7 +2348,7 @@ otherwise, such as splitting an order or changing fees.
             "subevent": 562,
             "seat": "seat-guid-2",
             "price": "99.99",
-            "addon_to": 12374,
+            "addon_to": 1,
             "attendee_name": "Peter",
           }
         ],

src/pretix/api/views/checkin.py

@@ -139,6 +139,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
             )
         return qs
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -153,6 +154,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(

src/pretix/api/views/discount.py

@@ -32,6 +32,7 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under the License.
 
+from django.db import transaction
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
 from rest_framework import viewsets
@@ -64,6 +65,7 @@ class DiscountViewSet(ConditionalListView, viewsets.ModelViewSet):
             'limit_sales_channels',
         )
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -78,6 +80,7 @@ class DiscountViewSet(ConditionalListView, viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -87,6 +90,7 @@ class DiscountViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('You cannot delete this discount because it already has '

src/pretix/api/views/event.py

@@ -257,6 +257,7 @@ class EventViewSet(viewsets.ModelViewSet):
                 data=self.request.data
             )
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         copy_from = None
         if 'clone_from' in self.request.GET:
@@ -320,6 +321,7 @@ class EventViewSet(viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('The event can not be deleted as it already contains orders. Please set \'live\''
@@ -355,6 +357,7 @@ class CloneEventViewSet(viewsets.ModelViewSet):
         ctx['organizer'] = self.request.organizer
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         # Weird edge case: Requires settings permission on the event (to read) but also on the organizer (two write)
         perm_holder = (self.request.auth if isinstance(self.request.auth, (Device, TeamAPIToken))
@@ -513,6 +516,7 @@ class SubEventViewSet(ConditionalListView, viewsets.ModelViewSet):
         resp['X-Page-Generated'] = date
         return resp
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         original_data = self.get_serializer(instance=serializer.instance).data
         super().perform_update(serializer)
@@ -529,6 +533,7 @@ class SubEventViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -538,6 +543,7 @@ class SubEventViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('The sub-event can not be deleted as it has already been used in orders. Please set'
@@ -566,6 +572,7 @@ class TaxRuleViewSet(ConditionalListView, viewsets.ModelViewSet):
     def get_queryset(self):
         return self.request.event.tax_rules.all()
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         super().perform_update(serializer)
         serializer.instance.log_action(
@@ -575,6 +582,7 @@ class TaxRuleViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -584,6 +592,7 @@ class TaxRuleViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('This tax rule can not be deleted as it is currently in use.')
@@ -757,6 +766,7 @@ class SeatViewSet(ConditionalListView, UpdateModelMixin, viewsets.ReadOnlyModelV
         }
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         super().perform_update(serializer)
         serializer.instance.event.log_action(
@@ -766,6 +776,7 @@ class SeatViewSet(ConditionalListView, UpdateModelMixin, viewsets.ReadOnlyModelV
             data={"seats": [serializer.instance.pk]},
         )
 
+    @transaction.atomic()
     def bulk_change_blocked(self, blocked):
         s = SeatBulkBlockInputSerializer(
             data=self.request.data,

src/pretix/api/views/exporters.py

@@ -23,6 +23,7 @@ from datetime import timedelta
 
 from celery.result import AsyncResult
 from django.conf import settings
+from django.db import transaction
 from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.utils.functional import cached_property
@@ -227,6 +228,7 @@ class ScheduledEventExportViewSet(ScheduledExportersViewSet):
             qs = self.request.event.scheduled_exports
         return qs.select_related("owner")
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         if not self.request.user.is_authenticated:
             raise PermissionDenied('Creation of exports requires user-specific API access.')
@@ -257,6 +259,7 @@ class ScheduledEventExportViewSet(ScheduledExportersViewSet):
         ))
         return {e.identifier: e for e in exporters}
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         if not self.request.user.is_authenticated or self.request.user != serializer.instance.owner:
             # This is to prevent a possible privilege escalation where user A creates a scheduled export and
@@ -282,6 +285,7 @@ class ScheduledEventExportViewSet(ScheduledExportersViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         self.request.event.log_action(
             'pretix.event.export.schedule.deleted',
@@ -309,6 +313,7 @@ class ScheduledOrganizerExportViewSet(ScheduledExportersViewSet):
             qs = self.request.organizer.scheduled_exports
         return qs.select_related("owner")
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         if not self.request.user.is_authenticated:
             raise PermissionDenied('Creation of exports requires user-specific API access.')
@@ -339,6 +344,7 @@ class ScheduledOrganizerExportViewSet(ScheduledExportersViewSet):
         ))
         return {e.identifier: e for e in exporters}
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         if not self.request.user.is_authenticated or self.request.user != serializer.instance.owner:
             # This is to prevent a possible privilege escalation where user A creates a scheduled export and
@@ -389,6 +395,7 @@ class ScheduledOrganizerExportViewSet(ScheduledExportersViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         self.request.organizer.log_action(
             'pretix.organizer.export.schedule.deleted',

src/pretix/api/views/item.py

@@ -33,6 +33,7 @@
 # License for the specific language governing permissions and limitations under the License.
 
 import django_filters
+from django.db import transaction
 from django.db.models import Q
 from django.shortcuts import get_object_or_404
 from django.utils.functional import cached_property
@@ -109,6 +110,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
             'limit_sales_channels', 'variations__limit_sales_channels', 'program_times'
         ).all()
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -123,6 +125,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         original_data = self.get_serializer(instance=serializer.instance).data
 
@@ -139,6 +142,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('This item cannot be deleted because it has already been ordered '
@@ -183,6 +187,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         item = self.item
         if not item.has_variations:
@@ -197,6 +202,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
                              {'value': serializer.instance.value})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.item.log_action(
@@ -207,6 +213,7 @@ class ItemVariationViewSet(viewsets.ModelViewSet):
                              {'value': serializer.instance.value})
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied('This variation cannot be deleted because it has already been ordered '
@@ -249,6 +256,7 @@ class ItemBundleViewSet(viewsets.ModelViewSet):
         ctx['item'] = self.item
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         item = get_object_or_404(Item, pk=self.kwargs['item'], event=self.request.event)
         serializer.save(base_item=item)
@@ -259,6 +267,7 @@ class ItemBundleViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.base_item.log_action(
@@ -268,6 +277,7 @@ class ItemBundleViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         super().perform_destroy(instance)
         instance.base_item.log_action(
@@ -303,6 +313,7 @@ class ItemProgramTimeViewSet(viewsets.ModelViewSet):
         ctx['item'] = self.item
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         item = get_object_or_404(Item, pk=self.kwargs['item'], event=self.request.event)
         serializer.save(item=item)
@@ -313,6 +324,7 @@ class ItemProgramTimeViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.item.log_action(
@@ -322,6 +334,7 @@ class ItemProgramTimeViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         super().perform_destroy(instance)
         instance.item.log_action(
@@ -354,6 +367,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
         ctx['item'] = self.item
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         item = self.item
         category = get_object_or_404(ItemCategory, pk=self.request.data['addon_category'])
@@ -365,6 +379,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.base_item.log_action(
@@ -374,6 +389,7 @@ class ItemAddOnViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         super().perform_destroy(instance)
         instance.base_item.log_action(
@@ -403,6 +419,7 @@ class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
     def get_queryset(self):
         return self.request.event.categories.all()
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -417,6 +434,7 @@ class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -426,6 +444,7 @@ class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         for item in instance.items.all():
             item.category = None
@@ -458,6 +477,7 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
     def get_queryset(self):
         return self.request.event.questions.prefetch_related('options').all()
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -472,6 +492,7 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -481,6 +502,7 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         instance.log_action(
             'pretix.event.question.deleted',
@@ -509,6 +531,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
         ctx['question'] = get_object_or_404(Question, pk=self.kwargs['question'], event=self.request.event)
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         q = get_object_or_404(Question, pk=self.kwargs['question'], event=self.request.event)
         serializer.save(question=q)
@@ -519,6 +542,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.question.log_action(
@@ -528,6 +552,7 @@ class QuestionOptionViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'ORDER': serializer.instance.position}, {'id': serializer.instance.pk})
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         instance.question.log_action(
             'pretix.event.question.option.deleted',
@@ -586,6 +611,7 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
         serializer = self.get_serializer(page, many=True)
         return self.get_paginated_response(serializer.data)
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -608,6 +634,7 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
         ctx['request'] = self.request
         return ctx
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         original_data = self.get_serializer(instance=serializer.instance).data
 
@@ -663,6 +690,7 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
                 )
         serializer.instance.rebuild_cache()
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         instance.log_action(
             'pretix.event.quota.deleted',

src/pretix/api/views/organizer.py

@@ -394,6 +394,7 @@ class TeamViewSet(viewsets.ModelViewSet):
         )
         return inst
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         instance.log_action('pretix.team.deleted', user=self.request.user, auth=self.request.auth)
         instance.delete()
@@ -693,6 +694,7 @@ class MembershipTypeViewSet(viewsets.ModelViewSet):
         ctx['organizer'] = self.request.organizer
         return ctx
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied("Can only be deleted if unused.")
@@ -833,6 +835,7 @@ class SalesChannelViewSet(viewsets.ModelViewSet):
         )
         return inst
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if not instance.allow_delete():
             raise PermissionDenied("Can only be deleted if unused.")

src/pretix/api/views/waitinglist.py

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 import django_filters
+from django.db import transaction
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
 from rest_framework import viewsets
@@ -62,6 +63,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
         ctx['event'] = self.request.event
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         serializer.save(event=self.request.event)
         serializer.instance.log_action(
@@ -70,6 +72,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
             auth=self.request.auth,
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         if serializer.instance.voucher:
             raise PermissionDenied('This entry can not be changed as it has already been assigned a voucher.')
@@ -80,6 +83,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
             auth=self.request.auth,
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         if instance.voucher:
             raise PermissionDenied('This entry can not be deleted as it has already been assigned a voucher.')

src/pretix/api/views/webhooks.py

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 import django_filters
+from django.db import transaction
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from rest_framework import viewsets
 
@@ -48,6 +49,7 @@ class WebHookViewSet(viewsets.ModelViewSet):
         ctx['organizer'] = self.request.organizer
         return ctx
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         inst = serializer.save(organizer=self.request.organizer)
         self.request.organizer.log_action(
@@ -57,6 +59,7 @@ class WebHookViewSet(viewsets.ModelViewSet):
             data=merge_dicts(self.request.data, {'id': inst.pk})
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         inst = serializer.save(organizer=self.request.organizer)
         self.request.organizer.log_action(
@@ -67,6 +70,7 @@ class WebHookViewSet(viewsets.ModelViewSet):
         )
         return inst
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         self.request.organizer.log_action(
             'pretix.webhook.changed',

src/pretix/plugins/paypal2/payment.py

@@ -677,6 +677,8 @@ class PaypalMethod(BasePaymentProvider):
                 raise PaymentException(_('We had trouble communicating with PayPal'))
             else:
                 pp_captured_order = response.result
+                payment.info = json.dumps(pp_captured_order.dict())
+                payment.save()
 
             try:
                 ReferencedPayPalObject.objects.get_or_create(order=payment.order, payment=payment, reference=pp_captured_order.id)

src/pretix/plugins/paypal2/views.py

@@ -357,14 +357,13 @@ def webhook(request, *args, **kwargs):
     if 'resource_type' not in event_json:
         return HttpResponse("Invalid body, no resource_type given", status=400)
 
-    if event_json['resource_type'] not in ["checkout-order", "refund", "capture"]:
-        return HttpResponse("Not interested in this resource type", status=200)
-
     # Retrieve the Charge ID of the refunded payment
-    if event_json['resource_type'] == 'refund':
+    if event_json['resource_type'] == 'checkout-order':
+        payloadid = event_json['resource']['id']
+    elif event_json['resource_type'] == 'refund' or event_json['resource_type'] == 'capture':
         payloadid = get_link(event_json['resource']['links'], 'up')['href'].split('/')[-1]
     else:
-        payloadid = event_json['resource']['id']
+        return HttpResponse("Not interested in this resource type", status=200)
 
     refs = [payloadid]
     if event_json['resource'].get('supplementary_data', {}).get('related_ids', {}).get('order_id'):
@@ -424,6 +423,8 @@ def webhook(request, *args, **kwargs):
         **event_json,
         '_order_state': sale.dict(),
     })
+    payment.info = json.dumps(sale.dict())
+    payment.save()
 
     if payment.state == OrderPayment.PAYMENT_STATE_CONFIRMED and sale['status'] in ('PARTIALLY_REFUNDED', 'REFUNDED', 'COMPLETED'):
         if event_json['resource_type'] == 'refund':

src/pretix/plugins/sendmail/api.py

@@ -20,6 +20,7 @@
 # <https://www.gnu.org/licenses/>.
 #
 from django.core.exceptions import ValidationError
+from django.db import transaction
 from django_filters.rest_framework import DjangoFilterBackend, FilterSet
 from django_scopes import scopes_disabled
 from rest_framework import viewsets
@@ -118,6 +119,7 @@ class RuleViewSet(viewsets.ModelViewSet):
     def get_queryset(self):
         return Rule.objects.filter(event=self.request.event)
 
+    @transaction.atomic()
     def perform_create(self, serializer):
         super().perform_create(serializer)
         serializer.instance.log_action(
@@ -128,6 +130,7 @@ class RuleViewSet(viewsets.ModelViewSet):
 
         )
 
+    @transaction.atomic()
     def perform_update(self, serializer):
         super().perform_update(serializer)
         serializer.instance.log_action(
@@ -137,6 +140,7 @@ class RuleViewSet(viewsets.ModelViewSet):
             data=self.request.data
         )
 
+    @transaction.atomic()
     def perform_destroy(self, instance):
         instance.log_action(
             'pretix.plugins.sendmail.rule.deleted',

src/pretix/plugins/sendmail/forms.py

@@ -158,7 +158,12 @@ class OrderMailForm(BaseMailForm):
         ),
         label=pgettext_lazy('sendmail_form', 'Restrict to products'),
         required=True,
-        queryset=Item.objects.none()
+        queryset=Item.objects.none(),
+        help_text=pgettext_lazy(
+            'sendmail_form',
+            'There may be multiple mails sent out to the same mail address if one order contains multiple attendee '
+            'products for it, if you restrict to products while also restricting mails to attendees only. '
+            'This is intended, as every one of those get linked to their own separate order page restricted to only that product.')
     )
     filter_checkins = forms.BooleanField(
         label=_('Filter check-in status'),
@@ -371,6 +376,11 @@ class RuleForm(FormPlaceholderMixin, I18nModelForm):
             del self.fields['subevent']
 
         self.fields['limit_products'].queryset = Item.objects.filter(event=self.event)
+        self.fields['limit_products'].help_text = pgettext_lazy(
+            'sendmail_form',
+            'There may be multiple mails sent out to the same mail address if one order contains multiple attendee '
+            'products for it, if you restrict to products while also restricting mails to attendees only. '
+            'This is intended, as every one of those get linked to their own separate order page restricted to only that product.')
 
         self.fields['schedule_type'] = forms.ChoiceField(
             label=_('Type of schedule time'),

src/pretix/plugins/sendmail/models.py

@@ -187,13 +187,32 @@ class ScheduledMail(models.Model):
                     o_sent = True
 
                 if send_to_attendees:
-                    if not self.rule.all_products:
-                        positions = [p for p in positions if p.item_id in limit_products]
                     if self.subevent_id:
                         positions = [p for p in positions if p.subevent_id == self.subevent_id]
 
+                    parent_op = None
+                    sent_to_positions = set()
                     for p in positions:
+
+                        if p.addon_to_id is None:
+                            parent_op = p
+                        if not self.rule.all_products and p.id not in position_ids:
+                            continue
+
                         if p.id in position_ids:
+                            if p.addon_to_id:
+                                if not parent_op or parent_op.id != p.addon_to_id:
+                                    # something got mixed up with this order as addons should always come after their parent-position
+                                    continue
+                                if not p.attendee_email:
+                                    if p.addon_to_id in sent_to_positions:
+                                        continue
+                                    else:
+                                        p = parent_op
+                                # with attendee-email but same as parent's and sent to parent
+                                elif parent_op.attendee_email and p.attendee_email == parent_op.attendee_email and parent_op.pk in sent_to_positions:
+                                    continue
+
                             if p.attendee_email and (p.attendee_email != o.email or not o_sent):
                                 email_ctx = get_email_context(
                                     event=e,
@@ -205,6 +224,7 @@ class ScheduledMail(models.Model):
                                 p.send_mail(self.rule.subject, self.rule.template, email_ctx,
                                             attach_ical=self.rule.attach_ical,
                                             log_entry_type='pretix.plugins.sendmail.rule.order.position.email.sent')
+                                sent_to_positions.add(p.id)
                             elif not o_sent and o.email:
                                 email_ctx = get_email_context(
                                     event=e,

src/pretix/plugins/sendmail/tasks.py

@@ -70,6 +70,8 @@ def send_mails_to_orders(event: Event, user: int, subject: dict, message: dict,
         except InvoiceAddress.DoesNotExist:
             ia = InvoiceAddress(order=o)
 
+        parent_op = None
+        sent_to_positions = set()
         if recipients in ('both', 'attendees'):
             for p in o.positions.annotate(
                 any_checkins=Exists(
@@ -85,10 +87,13 @@ def send_mails_to_orders(event: Event, user: int, subject: dict, message: dict,
                     )
                 ),
             ).prefetch_related('addons', 'subevent'):
-                if p.addon_to_id is not None:
-                    continue
 
-                if p.item_id not in items and not any(a.item_id in items for a in p.addons.all()):
+                is_addon = p.addon_to_id is not None
+
+                if not is_addon:
+                    parent_op = p
+
+                if p.item_id not in items:
                     continue
 
                 if filter_checkins:
@@ -99,12 +104,25 @@ def send_mails_to_orders(event: Event, user: int, subject: dict, message: dict,
                     if not allowed:
                         continue
 
+                send_to_parent = False
                 if not p.attendee_email:
                     if recipients == 'attendees':
-                        send_to_order = True
+                        if is_addon:
+                            if p.addon_to_id in sent_to_positions:
+                                continue
+                            elif parent_op and parent_op.id == p.addon_to_id and parent_op.attendee_email:
+                                send_to_parent = True
+                            else:
+                                send_to_order = True
+                                continue
+                        else:
+                            send_to_order = True
+                            continue
+                # add-on's attendee-email is the same as parent's and sent to parent
+                elif is_addon and p.addon_to_id in sent_to_positions and p.attendee_email == parent_op.attendee_email:
                     continue
 
-                if p.attendee_email == o.email and send_to_order:
+                if p.attendee_email and p.attendee_email == o.email and send_to_order:
                     continue
 
                 if subevent and p.subevent_id != subevent:
@@ -117,26 +135,50 @@ def send_mails_to_orders(event: Event, user: int, subject: dict, message: dict,
                     continue
 
                 with language(o.locale, event.settings.region):
-                    email_context = get_email_context(event=event, order=o, invoice_address=ia, position=p)
-                    outgoing_mail = mail(
-                        p.attendee_email,
-                        subject,
-                        message,
-                        email_context,
-                        event,
-                        locale=o.locale,
-                        order=o,
-                        position=p,
-                        attach_tickets=attach_tickets,
-                        attach_ical=attach_ical,
-                        attach_cached_files=attachments
-                    )
-                    if outgoing_mail:
-                        o.log_action(
-                            'pretix.plugins.sendmail.order.email.sent.attendee',
-                            user=user,
-                            data=outgoing_mail.log_data(),
+                    if send_to_parent:
+                        email_context = get_email_context(event=event, order=o, invoice_address=ia, position=parent_op)
+                        outgoing_mail = mail(
+                            parent_op.attendee_email,
+                            subject,
+                            message,
+                            email_context,
+                            event,
+                            locale=o.locale,
+                            order=o,
+                            position=parent_op,
+                            attach_tickets=attach_tickets,
+                            attach_ical=attach_ical,
+                            attach_cached_files=attachments
                         )
+                        if outgoing_mail:
+                            o.log_action(
+                                'pretix.plugins.sendmail.order.email.sent.attendee',
+                                user=user,
+                                data=outgoing_mail.log_data(),
+                            )
+                        sent_to_positions.add(parent_op.id)
+                    else:
+                        email_context = get_email_context(event=event, order=o, invoice_address=ia, position=p)
+                        outgoing_mail = mail(
+                            p.attendee_email,
+                            subject,
+                            message,
+                            email_context,
+                            event,
+                            locale=o.locale,
+                            order=o,
+                            position=p,
+                            attach_tickets=attach_tickets,
+                            attach_ical=attach_ical,
+                            attach_cached_files=attachments
+                        )
+                        if outgoing_mail:
+                            o.log_action(
+                                'pretix.plugins.sendmail.order.email.sent.attendee',
+                                user=user,
+                                data=outgoing_mail.log_data(),
+                            )
+                        sent_to_positions.add(p.id)
 
         if send_to_order and o.email:
             with language(o.locale, event.settings.region):

src/pretix/presale/views/order.py

@@ -174,7 +174,6 @@ class OrderPositionDetailMixin(NoSearchIndexViewMixin):
     def position(self):
         qs = OrderPosition.objects.filter(
             order__event=self.request.event,
-            addon_to__isnull=True,
             order__code=self.kwargs['order'],
             positionid=self.kwargs['position']
         ).select_related('order', 'order__event')

src/tests/plugins/paypal2/test_webhook.py

@@ -22,6 +22,7 @@
 import json
 from datetime import timedelta
 from decimal import Decimal
+from unittest.mock import MagicMock
 
 import pytest
 from django.utils.timezone import now
@@ -409,7 +410,8 @@ def test_webhook_mark_paid(env, client, monkeypatch):
         order.payments.update(state=OrderPayment.PAYMENT_STATE_PENDING)
 
     pp_order = Result(get_test_order())
-    monkeypatch.setattr("paypalcheckoutsdk.orders.OrdersGetRequest", lambda *args: pp_order)
+    mock_orders_get_request = MagicMock(return_value=pp_order)
+    monkeypatch.setattr("paypalcheckoutsdk.orders.OrdersGetRequest", mock_orders_get_request)
     monkeypatch.setattr("pretix.plugins.paypal2.payment.PaypalMethod.init_api", init_api)
     with scopes_disabled():
         ReferencedPayPalObject.objects.create(order=order, payment=order.payments.first(),
@@ -497,7 +499,7 @@ def test_webhook_mark_paid(env, client, monkeypatch):
             "resource_version": "2.0"
         }
     ), content_type='application_json')
-
+    mock_orders_get_request.assert_called_once_with('806440346Y391300T')
     order.refresh_from_db()
     assert order.status == Order.STATUS_PAID
 

src/tests/plugins/sendmail/test_rules.py

@@ -197,6 +197,82 @@ def test_sendmail_rule_send_order_vs_pos(send_to, amount_mails, recipients, orde
     assert set(recipients) == set(_recipients)
 
 
+@pytest.mark.django_db
+@pytest.mark.parametrize('send_to,amount_mails,recipients,ticket_mail,addon_mail, products', [
+    (Rule.ATTENDEES, 1, ['addon-attendee@dummy.test'], 'attendee@dummy.test', 'addon-attendee@dummy.test', 'addon'),
+    (Rule.ATTENDEES, 2, ['attendee@dummy.test', 'addon-attendee@dummy.test'], 'attendee@dummy.test',
+     'addon-attendee@dummy.test', 'both'),
+    (Rule.ATTENDEES, 1, ['attendee@dummy.test'], 'attendee@dummy.test', 'attendee@dummy.test', 'both'),
+    (Rule.ATTENDEES, 1, ['attendee@dummy.test'], 'attendee@dummy.test', None, 'addon'),
+    (Rule.ATTENDEES, 1, ['attendee@dummy.test'], 'attendee@dummy.test', None, 'both'),
+    (Rule.ATTENDEES, 1, ['dummy@dummy.test'], None, None, 'addon'),
+    (Rule.ATTENDEES, 1, ['dummy@dummy.test'], None, None, 'both'),
+    (Rule.ATTENDEES, 2, ['dummy@dummy.test', 'addon-attendee@dummy.test'], None, 'addon-attendee@dummy.test', 'both'),
+])
+@scopes_disabled()
+def test_sendmail_rule_send_addons(send_to, amount_mails, recipients, ticket_mail, addon_mail, products, order,
+                                   event, pos, item, item2):
+    djmail.outbox = []
+
+    order.status = order.STATUS_PAID
+    order.save()
+
+    p = pos
+    p.attendee_email = ticket_mail
+    p.save()
+    order.all_positions.create(item=item2, price=0, attendee_email=addon_mail, addon_to=p)
+    rule = order.event.sendmail_rules.create(date_is_absolute=True, send_date=dt_now - datetime.timedelta(hours=1),
+                                             send_to=send_to, subject='meow', template='meow meow meow',
+                                             all_products=False)
+    if products == 'addon':
+        rule.limit_products.set([item2])
+    if products == 'both':
+        rule.limit_products.set([item, item2])
+
+    sendmail_run_rules(None)
+
+    assert len(djmail.outbox) == amount_mails
+
+    _recipients = [mail.to[0] for mail in djmail.outbox]
+    assert set(recipients) == set(_recipients)
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize('send_to,amount_mails,recipients,ticket_mail,addon_mail, products', [
+    (Rule.ATTENDEES, 2, ['attendee@dummy.test', 'addon-attendee@dummy.test'], 'attendee@dummy.test',
+     'addon-attendee@dummy.test', 'addon'),
+    (Rule.ATTENDEES, 2, ['attendee@dummy.test', 'addon-attendee@dummy.test'], 'attendee@dummy.test',
+     'addon-attendee@dummy.test', 'both'),
+])
+@scopes_disabled()
+def test_sendmail_rule_send_addons_one_unp(send_to, amount_mails, recipients, ticket_mail, addon_mail, products, order,
+                                           event, pos, item, item2):
+    djmail.outbox = []
+
+    order.status = order.STATUS_PAID
+    order.save()
+
+    p = pos
+    p.attendee_email = ticket_mail
+    p.save()
+    order.all_positions.create(item=item2, price=0, attendee_email=addon_mail, addon_to=p)
+    order.all_positions.create(item=item2, price=0, addon_to=p)
+    rule = order.event.sendmail_rules.create(date_is_absolute=True, send_date=dt_now - datetime.timedelta(hours=1),
+                                             send_to=send_to, subject='meow', template='meow meow meow',
+                                             all_products=False)
+    if products == 'addon':
+        rule.limit_products.set([item2])
+    if products == 'both':
+        rule.limit_products.set([item, item2])
+
+    sendmail_run_rules(None)
+
+    assert len(djmail.outbox) == amount_mails
+
+    _recipients = [mail.to[0] for mail in djmail.outbox]
+    assert set(recipients) == set(_recipients)
+
+
 @pytest.mark.django_db
 @scopes_disabled()
 def test_sendmail_rule_send_attendees_unset_mail(order, event, item):

src/tests/plugins/sendmail/test_sendmail.py

@@ -406,6 +406,312 @@ def test_sendmail_attendee_product_filter(logged_in_client, sendmail_url, event,
     assert '/order/' not in djmail.outbox[0].body
 
 
+@pytest.mark.django_db
+def test_sendmail_attendee_addon_filter(logged_in_client, sendmail_url, event, order, pos):
+    event.settings.attendee_emails_asked = True
+    with scopes_disabled():
+        addon = Item.objects.create(name='Test addon', event=event, default_price=12)
+        p = pos
+        p.attendee_email = 'attendee1@dummy.test'
+        p.save()
+        order.positions.create(
+            item=addon, price=0, attendee_email='add-on-attendee@dummy.test', addon_to=p
+        )
+
+        djmail.outbox = []
+        response = logged_in_client.post(sendmail_url + 'orders/',
+                                         {'sendto': 'na',
+                                          'action': 'send',
+                                          'recipients': 'attendees',
+                                          'items': addon.pk,
+                                          'subject_0': 'Test subject',
+                                          'message_0': 'This is a test file for sending mails.',
+                                          },
+                                         follow=True)
+    assert response.status_code == 200
+    assert 'alert-success' in response.rendered_content
+    assert len(djmail.outbox) == 1
+    assert djmail.outbox[0].to == ['add-on-attendee@dummy.test']
+    assert '/ticket/' in djmail.outbox[0].body
+    assert '/order/' not in djmail.outbox[0].body
+
+
+@pytest.mark.django_db
+def test_sendmail_attendee_ticket_and_addon_filter(logged_in_client, sendmail_url, event, order, pos):
+    event.settings.attendee_emails_asked = True
+    with scopes_disabled():
+        addon = Item.objects.create(name='Test addon', event=event, default_price=12)
+        p = pos
+        p.attendee_email = 'attendee1@dummy.test'
+        p.save()
+        order.positions.create(
+            item=addon, price=0, attendee_email='add-on-attendee@dummy.test', addon_to=p
+        )
+
+        djmail.outbox = []
+        response = logged_in_client.post(sendmail_url + 'orders/',
+                                         {'sendto': 'na',
+                                          'action': 'send',
+                                          'recipients': 'attendees',
+                                          'items': {addon.pk, p.item_id},
+                                          'subject_0': 'Test subject',
+                                          'message_0': 'This is a test file for sending mails.',
+                                          },
+                                         follow=True)
+    assert response.status_code == 200
+    assert 'alert-success' in response.rendered_content
+    assert len(djmail.outbox) == 2
+    for msg in djmail.outbox:
+        assert msg.to in [['attendee1@dummy.test'], ['add-on-attendee@dummy.test']]
+        assert '/ticket/' in msg.body
+        assert '/order/' not in msg.body
+
+
+@pytest.mark.django_db
+def test_sendmail_attendee_ticket_and_same_addon_filter(logged_in_client, sendmail_url, event, order, pos):
+    event.settings.attendee_emails_asked = True
+    with scopes_disabled():
+        addon = Item.objects.create(name='Test addon', event=event, default_price=12)
+        p = pos
+        p.attendee_email = 'attendee1@dummy.test'
+        p.save()
+        order.positions.create(
+            item=addon, price=0, attendee_email='attendee1@dummy.test', addon_to=p
+        )
+
+        djmail.outbox = []
+        response = logged_in_client.post(sendmail_url + 'orders/',
+                                         {'sendto': 'na',
+                                          'action': 'send',
+                                          'recipients': 'attendees',
+                                          'items': {addon.pk, p.item_id},
+                                          'subject_0': 'Test subject',
+                                          'message_0': 'This is a test file for sending mails.',
+                                          },
+                                         follow=True)
+    assert response.status_code == 200
+    assert 'alert-success' in response.rendered_content
+    assert len(djmail.outbox) == 1
+    assert djmail.outbox[0].to == ['attendee1@dummy.test']
+    assert '/ticket/' in djmail.outbox[0].body
+    assert '/order/' not in djmail.outbox[0].body
+
+
+@pytest.mark.django_db
+def test_sendmail_attendee_addon_unpersonalized_filter(logged_in_client, sendmail_url, event, order, pos):
+    event.settings.attendee_emails_asked = True
+    with scopes_disabled():
+        addon = Item.objects.create(name='Test addon', event=event, default_price=12)
+        p = pos
+        p.attendee_email = 'attendee1@dummy.test'
+        p.save()
+        order.positions.create(
+            item=addon, price=0, addon_to=p
+        )
+
+        djmail.outbox = []
+        response = logged_in_client.post(sendmail_url + 'orders/',
+                                         {'sendto': 'na',
+                                          'action': 'send',
+                                          'recipients': 'attendees',
+                                          'items': addon.pk,
+                                          'subject_0': 'Test subject',
+                                          'message_0': 'This is a test file for sending mails.',
+                                          },
+                                         follow=True)
+    assert response.status_code == 200
+    assert 'alert-success' in response.rendered_content
+    assert len(djmail.outbox) == 1
+    assert djmail.outbox[0].to == ['attendee1@dummy.test']
+    assert '/ticket/' in djmail.outbox[0].body
+    assert '/order/' not in djmail.outbox[0].body
+
+
+@pytest.mark.django_db
+def test_sendmail_attendee_ticket_and_addon_unp_filter(logged_in_client, sendmail_url, event, order, pos):
+    event.settings.attendee_emails_asked = True
+    with scopes_disabled():
+        addon = Item.objects.create(name='Test addon', event=event, default_price=12)
+        p = pos
+        p.attendee_email = 'attendee1@dummy.test'
+        p.save()
+        order.positions.create(
+            item=addon, price=0, addon_to=p
+        )
+
+        djmail.outbox = []
+        response = logged_in_client.post(sendmail_url + 'orders/',
+                                         {'sendto': 'na',
+                                          'action': 'send',
+                                          'recipients': 'attendees',
+                                          'items': {addon.pk, p.item_id},
+                                          'subject_0': 'Test subject',
+                                          'message_0': 'This is a test file for sending mails.',
+                                          },
+                                         follow=True)
+    assert response.status_code == 200
+    assert 'alert-success' in response.rendered_content
+    assert len(djmail.outbox) == 1
+    assert djmail.outbox[0].to == ['attendee1@dummy.test']
+    assert '/ticket/' in djmail.outbox[0].body
+    assert '/order/' not in djmail.outbox[0].body
+
+
+@pytest.mark.django_db
+def test_sendmail_attendee_ticket_unp_and_addon_filter(logged_in_client, sendmail_url, event, order, pos):
+    event.settings.attendee_emails_asked = True
+    with scopes_disabled():
+        addon = Item.objects.create(name='Test addon', event=event, default_price=12)
+        order.positions.create(
+            item=addon, price=0, attendee_email='add-on-attendee@dummy.test', addon_to=pos
+        )
+
+        djmail.outbox = []
+        response = logged_in_client.post(sendmail_url + 'orders/',
+                                         {'sendto': 'na',
+                                          'action': 'send',
+                                          'recipients': 'attendees',
+                                          'items': {addon.pk, pos.item_id},
+                                          'subject_0': 'Test subject',
+                                          'message_0': 'This is a test file for sending mails.',
+                                          },
+                                         follow=True)
+    assert response.status_code == 200
+    assert 'alert-success' in response.rendered_content
+    assert len(djmail.outbox) == 2
+    for msg in djmail.outbox:
+        assert msg.to in [[order.email], ['add-on-attendee@dummy.test']]
+        if msg.to == [order.email]:
+            assert '/ticket/' not in msg.body
+            assert '/order/' in msg.body
+        else:
+            assert msg.to == ['add-on-attendee@dummy.test']
+            assert '/ticket/' in msg.body
+            assert '/order/' not in msg.body
+
+
+@pytest.mark.django_db
+def test_sendmail_attendee_addon_unp_unp_filter(logged_in_client, sendmail_url, event, order, pos):
+    event.settings.attendee_emails_asked = True
+    with scopes_disabled():
+        addon = Item.objects.create(name='Test addon', event=event, default_price=12)
+        order.positions.create(
+            item=addon, price=0, addon_to=pos
+        )
+
+        djmail.outbox = []
+        response = logged_in_client.post(sendmail_url + 'orders/',
+                                         {'sendto': 'na',
+                                          'action': 'send',
+                                          'recipients': 'attendees',
+                                          'items': addon.pk,
+                                          'subject_0': 'Test subject',
+                                          'message_0': 'This is a test file for sending mails.',
+                                          },
+                                         follow=True)
+    assert response.status_code == 200
+    assert 'alert-success' in response.rendered_content
+    assert len(djmail.outbox) == 1
+    assert djmail.outbox[0].to == [order.email]
+    assert '/ticket/' not in djmail.outbox[0].body
+    assert '/order/' in djmail.outbox[0].body
+
+
+@pytest.mark.django_db
+def test_sendmail_attendee_and_addon_unp_unp_filter(logged_in_client, sendmail_url, event, order, pos):
+    event.settings.attendee_emails_asked = True
+    with scopes_disabled():
+        addon = Item.objects.create(name='Test addon', event=event, default_price=12)
+        order.positions.create(
+            item=addon, price=0, addon_to=pos
+        )
+
+        djmail.outbox = []
+        response = logged_in_client.post(sendmail_url + 'orders/',
+                                         {'sendto': 'na',
+                                          'action': 'send',
+                                          'recipients': 'attendees',
+                                          'items': {addon.pk, pos.item_id},
+                                          'subject_0': 'Test subject',
+                                          'message_0': 'This is a test file for sending mails.',
+                                          },
+                                         follow=True)
+    assert response.status_code == 200
+    assert 'alert-success' in response.rendered_content
+    assert len(djmail.outbox) == 1
+    assert djmail.outbox[0].to == [order.email]
+    assert '/ticket/' not in djmail.outbox[0].body
+    assert '/order/' in djmail.outbox[0].body
+
+
+@pytest.mark.django_db
+def test_sendmail_attendee_two_addons_one_unp_filter(logged_in_client, sendmail_url, event, order, pos):
+    event.settings.attendee_emails_asked = True
+    with scopes_disabled():
+        p = pos
+        p.attendee_email = 'attendee1@dummy.test'
+        p.save()
+        addon = Item.objects.create(name='Test addon', event=event, default_price=12)
+        order.positions.create(
+            item=addon, price=0, attendee_email='add-on-attendee@dummy.test', addon_to=p
+        )
+        order.positions.create(
+            item=addon, price=0, addon_to=p
+        )
+
+        djmail.outbox = []
+        response = logged_in_client.post(sendmail_url + 'orders/',
+                                         {'sendto': 'na',
+                                          'action': 'send',
+                                          'recipients': 'attendees',
+                                          'items': addon.pk,
+                                          'subject_0': 'Test subject',
+                                          'message_0': 'This is a test file for sending mails.',
+                                          },
+                                         follow=True)
+    assert response.status_code == 200
+    assert 'alert-success' in response.rendered_content
+    assert len(djmail.outbox) == 2
+    for msg in djmail.outbox:
+        assert msg.to in [['attendee1@dummy.test'], ['add-on-attendee@dummy.test']]
+        assert '/ticket/' in msg.body
+        assert '/order/' not in msg.body
+
+
+@pytest.mark.django_db
+def test_sendmail_attendee_and_two_addons_one_unp_filter(logged_in_client, sendmail_url, event, order, pos):
+    event.settings.attendee_emails_asked = True
+    with scopes_disabled():
+        p = pos
+        p.attendee_email = 'attendee1@dummy.test'
+        p.save()
+        addon = Item.objects.create(name='Test addon', event=event, default_price=12)
+        order.positions.create(
+            item=addon, price=0, attendee_email='add-on-attendee@dummy.test', addon_to=p
+        )
+        order.positions.create(
+            item=addon, price=0, addon_to=p
+        )
+
+        djmail.outbox = []
+        response = logged_in_client.post(sendmail_url + 'orders/',
+                                         {'sendto': 'na',
+                                          'action': 'send',
+                                          'recipients': 'attendees',
+                                          'items': {addon.pk, p.item_id},
+                                          'subject_0': 'Test subject',
+                                          'message_0': 'This is a test file for sending mails.',
+                                          },
+                                         follow=True)
+    assert response.status_code == 200
+    assert 'alert-success' in response.rendered_content
+    assert len(djmail.outbox) == 2
+    for msg in djmail.outbox:
+        assert msg.to in [['attendee1@dummy.test'], ['add-on-attendee@dummy.test']]
+        assert '/ticket/' in msg.body
+        assert '/order/' not in msg.body
+
+
 @pytest.mark.django_db
 def test_sendmail_attendee_subevent_filter(logged_in_client, sendmail_url, event, item, order, pos):
     event.settings.attendee_emails_asked = True